52
SZABÓ AND VISSY v. HUNGARY JUDGMENT– SEPARATE OPINION
of judicial authorization complemented by some form of follow-up control
that conditions are being complied with. The power to “contact chain”, i.e.
identify people in contact with each other, should be framed narrowly:
contact chaining of metadata should normally only be possible for people
suspected of “actual involvement in particularly seriously offences”, such as
terrorism. Strengthened justification requirements and procedural
safeguards should apply, such as the involvement of a privacy advocate,
with regard to searches of content data. In the view of the Commission,
notification that one has been subject to strategic surveillance is not an
absolute requirement of Article 8 of the Convention. If a state has a general
complaints procedure to an independent oversight body, this can
compensate for non-notification19.
11. On 21 April 2015, the PACE approved Resolution 2045(2015) on
mass surveillance, urging the Council of Europe member and observer
States to ensure that their national laws only allow for the collection and
analysis of personal data, including metadata, with the consent of the person
concerned or following a court order granted on the basis of reasonable
suspicion of the target being involved in criminal activity.
12. In May 2015, the Council of Europe Commissioner for Human
Rights published an issue paper on “Democratic and effective oversight of
national security services”, advocating that independent ex ante
authorisation should be extended to untargeted bulk collection of
information, the collection of and access to communications data, including
when held by the private sector, and, potentially, computer network
exploitation. The process by which intrusive measures are authorised or reauthorised should itself be subject to scrutiny. States must ensure that
individuals can also access a supervisory institution equipped to make
legally binding orders.
13. Reacting to the worldwide debate on mass surveillance, the
European Union (EU) did not speak with one voice. The first institutional
position came from the European Commission, with its Communications to
the European Parliament and the Council on the Functioning of the Safe
Harbour from the Perspective of EU Citizens and Companies Established20,
and on “Restoring Trust in EU-US data flows”21, both of 27 November
2013. Following the Schrems judgment by the Court of Justice, the
Commission delivered a Communication to the European Parliament and
the Council on the Transfer of Personal Data from the EU to the United
19
CDL-AD(2015)006, paragraphs 3, 16, 24, 51, and 103-105.
COM(2013) 847 final. The Commission identified a number of shortcomings and set out
13 recommendations. On the basis of these recommendations, the Commission held talks
with the U.S. authorities since January 2014 with the aim of putting in place a renewed and
stronger arrangement for transatlantic data exchanges.
21
COM(2013) 846 final.
20