CENTRUM FÖR RÄTTVISA v. SWEDEN JUDGMENT
15. Lastly, in terms of internal oversight, the Privacy Protection Council
of the FRA, which is tasked with monitoring the measures taken to protect
personal integrity, is also composed of members appointed by the
Government. This body appears to be toothless, as evidenced by the fact
that the Data Protection Authority unsuccessfully reproached the FRA in
2010 and 2016 for failing to monitor adequately logs used to detect
unwarranted use of personal data30. The alleged introduction in 2018 of a
central function for monitoring and following up logs, invoked by the
Government, does not suffice. In fact, there is no legal obligation on the
FRA to keep logs and detailed records of each step in bulk interception
operations, including interception, subsequent use and communication of
data. This means that any record-keeping practice, if it exists, essentially
depends on internal procedures and discretion.
Remedies
16. The lack of truly independent authorisation for and supervision of
the implementation of bulk interception measures is aggravated by the
purely virtual character of the remedies available to the intercept subject31.
The law provides for notification of bulk interception to the intercept
subject, when selectors directly related to an individual have been used and
secrecy reasons do not prevail. The guarantee pertains only to natural
persons, not to legal persons such as the applicant. In any event, this law
remains a dead letter32.
17. In addition, at the request of a natural or legal person, the FII may
investigate whether the interception and treatment of intercept material have
been in accordance with the law, and it has done so. Astonishingly, in all
132 cases investigated by the FII it never once found in favour of the
applicant party33. The simple reason for this is that the FII is iudex in causa
See paragraph 76 of this judgment.
The FRA of the EU has emphasised that the effectiveness of remedies depends on the
capacity to issue legally binding decisions, which at a minimum should include the power
to order termination of the surveillance, destruction of unlawfully collected data and
payment of the appropriate compensation (FRA, Surveillance by intelligence services, cited
above, p. 114).
32 See paragraphs 60 and 80 of this judgment. In fact, the HRC asked the Swedish State to
ensure “that affected persons have proper access to effective remedies in cases of abuse.”
(United Nations Human Rights Committee Concluding observations, cited above, § 37).
33 See paragraph 61 of this judgment. In § 218 of this judgment, reference is made to
141 controls at the request of individuals, none of which ever showed “improper signals
collection”. It is not clear what the majority seek to demonstrate in this regard. On the one
hand they admit that decisions may be notified to a “security-cleared special counsel” but
on the other hand they require that the decision be “publicly available” and criticise the
“absence of a possibility for members of the public to obtain reasoned decisions in some
form in response to inquiries” (compare and contrast paragraphs 361 and 372 of this
judgment).
30
31