Surveillance by intelligence services – Volume II: field perspectives and legal update
13.3. Restrictions on
notification obligation
and right of access
The FRA 2015 report details how the obligation to
inform and grant access are completely exempted
in some Member States (the Czech Republic, Ireland,
Lithuania, Poland and Slovakia) and restricted in the
other 23 Member States.515
“The [expert body] drafts a report on the basis of the
complaint, which is sent to the individual. […] [W]hichever of
these options is chosen, it comes down to the same thing:
there is no access to classified documents.” (Expert body)
“The services are obliged to provide information, but there is
no obligation concerning the specific content of information
provided […] they must provide information, but their
response can also be in the negative. For example: ‘no, we
have no data on file’, or similar. If the matter were given
close consideration, then individual legal protection would
have to be improved.” (Academia)
However, there are differences in the conditions and
level of restrictions.516 Limitations can be based on
the direct aspect of the access to information, on
the general aspect of surveillance, on the level of
classifications, on national security, on the operational
impact of surveillance, or on other procedural grounds.
The right to indirect access is the right for an individual
to access his/her own data indirectly through the
DPA or the expert body.517 Such right exists in 12
EU Member States: Austria, Belgium, Bulgaria, Cyprus,
Finland, France, Hungary, Ireland, Italy, Luxembourg,
Portugal and Sweden. Between 2014 and 2016, the
French DPA (CNIL) received an increasing number
of indirect access requests: 159 in 2014, 243 in 2015,
and 435 in 2016.518 The French expert body (CNCTR)
in charge of assessing the legality of the technique
used received 51 complaints between October 2015
and October 2016.519
As stated in the 2015 FRA report,520 of the five Member
States with detailed legislation on general surveillance
of communications, only Germany and Sweden
stipulate a notification requirement in cases of general
surveillance of communications. The obligation to
inform does not apply if a) the search terms are not
515
516
517
518
FRA (2015a), p. 62.
See also UN, GA (2014b), para. 39.
FRA (2015a), pp. 66-67.
See France, CNIL (2014) p. 48; CNIL (2015) p. 57 and
CNIL (2016), p. 63.
519 France, CNCTR (2016), p. 90.
520 FRA (2015a), p. 63.
126
directly related to the individual (Sweden) 521 or b)
if the data are deleted immediately (Germany).522
The German 2016 reform of the BND Law does not
stipulate any notification requirement in case of
foreign-foreign surveillance measures.523
In some Member States – such as Ireland, Latvia, Spain
and Sweden524 – the obligation to inform and/or the
right of access are restricted because of rules applicable
to classified documents and official secrets. In Latvia,
although amendments to the Investigatory Operations
Law adopted on 10 March 2016 strengthened the state’s
obligations concerning the duty of those conducting
operational activities to inform ex post the individual
against whom the activities were conducted, such
notification does not apply in cases of, among others,
a possible threat to another person’s legitimate rights
and interests, national security or criminal procedure.525
The 2015 FRA report detailed how the right of access and
obligation to notify may be limited on the ground that
divulging the information could threaten the objectives
of the intelligence services or national security.526
In ten Member States, individuals are notified or
information is provided at the end of surveillance, and
only when the threat to national security has ceased
to exist: Bulgaria, Croatia, Denmark, Finland, Germany,
Greece, Latvia, the Netherlands, Spain and Romania.527
In Denmark and Finland, the general obligation to
inform individuals at the end of surveillance may be
omitted or postponed upon a court order.528
Finally, in some Member States, additional conditions
on ex post notification or access to data are enshrined
in law.529 For instance, in Sweden, individuals shall be
notified of signals intelligence only if the search terms
used therein are directly related to them, and not if
reasons of confidentiality prevent notification.530
521 Sweden, Signals Intelligence Act (Lag [2008:717] om
signalspaning i försvarsunderrättelsetjänst), Art 11 (a).
522 Germany, G 10 Act, S. 12.
523 Wetzling, T. (2017), p. 14.
524 See FRA (2015a) p. 64 for further information on these
restrictions in Spain and Latvia.
525 Latvia, Investigatory Operations Law, Art. 24 (1).
526 FRA (2015a), p. 65.
527 See FRA (2015a) p. 64 for further information on this
restriction in Romania and Denmark.
528 Denmark, Administration of Justice Act, Consolidated
Act no. 1255 of 16 November 2015 with amendments
(Retsplejeloven, lovbekendtgørelse nr. 1255 af 16. november
2015 med senere ændringer), Section 788 (1), (4).
529 See FRA (2015a) p. 65 for further information on this in
Bulgaria, Croatia and Germany.
530 Sweden, Signals Intelligence Act, Arts. 11 (a) and 11 (b).