42
CENTRUM FÖR RÄTTVISA v. SWEDEN JUDGMENT
destruction of data that had been collected in a way that was incompatible
with a permit issued by the Foreign Intelligence Court.
(β) The Court’s assessment
144. The Court notes that personnel at the FRA treating personal data
are security cleared and, if secrecy applies to the personal data, subject to
confidentiality. They are under an obligation to handle the personal data in a
safe manner. Also, they could face criminal sanctions if tasks relating to the
treatment of personal data are mismanaged (see paragraph 30 above).
Furthermore, the FRA must ensure that personal data is collected only for
certain expressly stated and justified purposes, determined by the direction
of the foreign intelligence activities through tasking directives. The personal
data treated also has to be adequate and relevant in relation to the purpose of
the treatment. No more personal data than what is necessary for that purpose
may be processed. All reasonable efforts have to be made to correct, block
and obliterate personal data which is incorrect or incomplete in relation to
the purpose (paragraph 28).
145. Contrary to the applicant’s claim, there are several provisions
regulating the situations when intercepted data has to be destroyed. For
example, intelligence must be destroyed immediately if it 1) concerns a
specific natural person and has been determined to lack importance for the
purpose of the signals intelligence, 2) is protected by constitutional
provisions of secrecy for the protection of anonymous authors or media
sources, 3) contains information shared between a criminal suspect and his
or her counsel and is thus protected by attorney-client privilege, or
4) involves information given in a religious context of confession or
individual counselling, unless there are exceptional reasons for examining
the information (see paragraph 25 above). Moreover, if communications
have been intercepted between a sender and receiver both in Sweden,
despite the ban on the interception of such communications, they must be
destroyed as soon as their domestic nature has become evident
(paragraph 26). Also, where a temporary permit granted by the FRA has
been revoked by the Foreign Intelligence Court, all intelligence collected on
the basis of that permit must be immediately destroyed (paragraph 27).
146. Although the FRA may maintain databases for raw material
containing personal data up to one year, it has to be kept in mind that raw
material is unprocessed information. That is, it has yet to be subjected to
manual treatment. The Court accepts that it is necessary for the FRA to store
raw material before it can be manually processed. At the same time, the
Court stresses the importance of deleting such data as soon as it is evident
that it lacks pertinence for a signals intelligence mission.
147. In sum, examining the legislation on storing, accessing, examining,
using and destroying intercepted data, the Court is satisfied that it provides
adequate safeguards against abuse of treatment of personal data and thus