12
CENTRUM FÖR RÄTTVISA v. SWEDEN JUDGMENT
H. Notification of secret surveillance measures
44. If search terms directly related to a specific natural person have been
used, he or she is to be notified by the FRA, according to the Signals
Intelligence Act. The notification shall contain information on the date and
purpose of the measures. Such notification shall be given as soon as it can
be done without detriment to the foreign intelligence activities, but no later
than one month after the signals intelligence mission has been concluded
(section 11a).
45. However, the notification may be delayed if secrecy so demands, in
particular defence secrecy or secrecy for the protection of international
relations. If, due to secrecy, no notification has been given within a year
from the conclusion of the mission, the person does not have to be notified.
Furthermore, a notification shall not be given if the measures solely concern
the conditions of a foreign power or the relationship between foreign
powers (section 11b).
I. Remedies
46. The Signals Intelligence Act provides that the Foreign Intelligence
Inspectorate, at the request of an individual, must investigate if his or her
communications have been intercepted through signals intelligence and, if
so, verify whether the interception and treatment of the information have
been in accordance with law. The Inspectorate shall notify the individual
that such an investigation has been carried out (section 10a). A request can
be made by legal and natural persons regardless of nationality and
residence. During the period 2010-2017, 132 requests were handled and no
unlawfulness was established. In 2017, ten such requests were processed; in
2016 the number was 14. The Inspectorate’s decision following a request is
final.
47. Under the FRA Personal Data Processing Act, the FRA is also
required to provide information upon request. Once per calendar year, an
individual may demand information on whether personal data concerning
him or her is being or has been processed. If so, the FRA must specify what
information on the individual is concerned, from where it was collected, the
purpose of the treatment and to which recipients or categories of recipients
the personal data is or was reported. The information is normally to be given
within one month from the request (Chapter 2, section 1). However, this
right to information does not apply if disclosure is prevented by secrecy
(Chapter 2, section 3).
48. Following a request from the individual who has had personal data
registered, the FRA shall promptly correct, block or destroy such data that
has not been processed in accordance with law. The FRA shall also notify
any third party who has received the data, if the individual so requests or if