Surveillance by intelligence services – Volume II: field perspectives and legal update
with a right. First, the scope of the legislation must be
such that the applicant can possibly be affected by it.
Second, the ECtHR looks at the availability of effective
remedies at the national level. If there are no effective
remedies, the ECtHR considers interference with the
right to private life to occur with the mere existence
of legislation permitting surveillance. In practice,
once intelligence services intercept a signal and start
collecting data, they interfere with the right to private
life. The CJEU has followed the same point of view.79
ECtHR case law: interference with the right
to private life
“[T]he Court accepts that an applicant can claim to be the
victim of a violation occasioned by the mere existence of
secret surveillance measures, or legislation permitting secret surveillance measures, if the following conditions are
satisfied. Firstly, the Court will take into account the scope
of the legislation permitting secret surveillance measures
by examining whether the applicant can possibly be affected by it, either because he or she belongs to a group
of persons targeted by the contested legislation or because
the legislation directly affects all users of communication
services by instituting a system where any person can
have his or her communications intercepted. Secondly, the
Court will take into account the availability of remedies
at the national level and will adjust the degree of scrutiny depending on the effectiveness of such remedies. […]
[W]here the domestic system does not afford an effective
remedy to the person who suspects that he or she was
subjected to secret surveillance, widespread suspicion
and concern among the general public that secret surveillance powers are being abused cannot be said to be
unjustified […]. In such circumstances the menace of surveillance can be claimed in itself to restrict free communication through the postal and telecommunication services,
thereby constituting for all users or potential users a direct
interference with the right guaranteed by Article 8. There
is therefore a greater need for scrutiny by the Court and
an exception to the rule, which denies individuals the right
to challenge a law in abstracto, is justified. In such cases
the individual does not need to demonstrate the existence
of any risk that secret surveillance measures were applied
to him. By contrast, if the national system provides for effective remedies, a widespread suspicion of abuse is more
difficult to justify. In such cases, the individual may claim
to be a victim of a violation occasioned by the mere existence of secret measures or of legislation permitting secret
measures only if he is able to show that, due to his personal
situation, he is potentially at risk of being subjected to such
measures.”
Under the GDPR, any processing of personal data –
including collection of data – amounts to interference.
Intelligence services sometimes collect data by
requesting telecommunications providers to transfer
their customers’ data to them. Under EU data protection
law, such data collection constitutes an interference.
At the same time, a question arises as to the definition
of ‘collection’ of data. Figure 2 indicates that, in the
Netherlands, the collection of data includes the stage
when intelligence services extract data from an
intercepted signal, filter and, eventually, store it.
Among EU Member States, the general understanding
is that the interception of a signal is a form of data
collection. This is reflected, for example, in the
respective laws of France, Germany and the United
Kingdom regarding interception of interception of
electronic communications. In France, after foreign
electronic communications are gathered from an
intercepted signal, their exploitation is subject to
authorisation by the prime minister.80 If communications
using connections based on subscriptions from the
French territory are identified, these are immediately
deleted.81 Finally, the collected, transcribed or extracted
data must be destroyed within a time period specified
by law.82 In Germany, the intelligence services capture
telecommunications data and store them without
any other prior processing.83 They must then, within
a certain time period, identify the data and delete
those not relevant to the purposes for which the
surveillance measure was implemented. In the United
Kingdom, the intelligence services intercept electronic
communications in the course of their transmission.84
Subsequently, they select certain intercepted data for
examination. The selected data are then disclosed
to authorised persons.
However, the mere collection of data by intelligence
services is not universally accepted as the starting
point of an interference with the right to private life.
As previously noted, intelligence services store the data
they have collected and, when needed, later access
them for analysis. Some suggest that an interference
begins only when intelligence services actually
access and analyse the previously collected data. For
example, the governments of the United Kingdom and
Ireland argued before the CJEU – in a case concerning
ECtHR, Roman Zakharov v. Russia [GC], No. 47143/06, 4 December 2015, para. 171
79
34
CJEU, Joined Cases C-293/12 and C-594/12, Digital Rights
Ireland and Seitlinger, 8 April 2014; CJEU, Joined Cases
C-203/15 and C-698/15, Tele2 Sverige and Watson v. Home
Secretary, 21 December 2016, para. 100.
80 France, Interior Security Code (Code de la sécurité
intérieure), Art. L. 854-2.
81 Ibid. Art. L. 854-1.
82 Ibid. Art. L. 854-5.
83 Germany, Federal Intelligence Act (Gesetz über den
Bundesnachrichtendienst) (BNDG), s. 2.
84 United Kingdom, Investigatory Powers Act 2016, Part 6,
Chapter 1.