Stages of intelligence service oversight
Table 5:
Approval/authorisation of general surveillance of communications in France, Germany, the
Netherlands, Sweden and the United Kingdom
Judicial
DE
FR
NL*
SE
UK**
Notes:
Parliamentary
Executive
✓
Expert
✓
✓
✓
✓
✓
✓
✓
✓
* Situation reflecting the requirements of the Intelligence and Security Services Act 2017, which will be applicable when
the relevant sections enter into force.
** Situation reflecting the requirements of the Investigatory Powers Act, which will be applicable when the relevant
sections enter into force.
Source:
FRA, 2017
The CNCTR provides the prime minister with a nonbinding opinion on both the automatic processing and
the parameters. The oversight body is kept informed
about every modification during the operation and
has permanent, complete and direct access to this
processing and the intelligence gathered. The first
authorisation is valid for two months. It is renewable,
but the renewal request should include the number of
relevant targets obtained by the automatic processing
and an analysis of their relevance. Should this data
reveal the existence of a terrorist threat, the CNCTR
again provides the prime minister with its opinion for
authorising the identification of the person considered
as threat. Since its creation in October 2015, no
negative opinion from the CNCTR were overruled by
the Prime Minister.390
As a general rule, when targeting communications’
content data, prior oversight is required in most
Member States for both targeted surveillance and the
use of selectors in the context of general surveillance
of communications. This changes, however, when
intelligence services solely access metadata through
rules governing access to retained data. In these
cases, it is usually sufficient for the services’ directors
to authorise access.391 This is problematic, because
communications data reveal an individual’s pertinent
personal information in a similar way to content data.392
However, addressing any issue relating to prior
oversight in isolation of the oversight system as a whole
will not offer a complete picture of its effectiveness.
Inevitably, national systems will strike different
390 France, CNCTR (2016), p. 66.
391 This is the case in the United Kingdom for targeted
collection of metadata (Investigatory Powers Act, S. 61).
392 For the required safeguards in case of retention of data
by telecommunications service providers, see CJEU, Joined
Cases C-203/15 and C-698/15, Tele2 Sverige AB v. Postoch
telestyrelsen and Secretary of State for the Home
Department v. Tom Watson and Others, 21 December 2016,
and the analysis of the case in the Introduction.
balances when designing their respective architecture
of checks and balances. Consequently, apparent
strengths or weaknesses of ex ante review may be
undermined or remedied, respectively, in ongoing and
ex post oversight.
10.2. Ongoing and ex post
oversight
To meet the standard of continuity, oversight also needs
to be present at the stage when the measures are being
implemented – in other words, while the operations
are ongoing – as well as at the time when they have
already been concluded. In addition, oversight should
cover all surveillance processes, from collection to the
destruction of data.
The use of general surveillance of communications
makes these functions of the oversight system
particularly crucial safeguards, given that in such
operations ex ante oversight will, by definition,
have a limited scope of review. Ongoing and ex post
oversight can also provide valuable insights in the
form of feedback to the body authorising or approving
general surveillance of communications. This section
focuses on ongoing and ex post oversight of specific
types of operations.
As Annex 5 illustrates, a number of Member States
have expert bodies that undertake ongoing and ex
post review, while only very few provide for judicial
oversight during the implementation of surveillance
measures. FRA’s research shows that most Member
States involve an independent oversight body either
at the stage when surveillance measures are being
implemented or after they have been concluded – or
during both of these stages. Depending on the powers
and competences of the oversight bodies at these
stages, a combination of ongoing and ex post oversight
may be the best approach.
97