CENTRUM FÖR RÄTTVISA v. SWEDEN JUDGMENT
186. In addition, in the applicant’s view, the authorising body should be
capable of verifying the existence of a reasonable suspicion in relation to
any person singled out or targeted. The applicant found unconvincing the
Chamber’s departure, in the present case and in Big Brother Watch and
Others v. the United Kingdom, nos. 58170/13 and 2 others,
13 September 2018, from this allegedly established requirement. The use of
personalised selectors to single out and collect data on an individual, albeit
in the bulk interception context, should be subject to the same threshold as
applied to targeted interception. Otherwise, such selectors can be used as a
work-around method for targeting individuals.
187. If there are no predefined targets, on the other hand, the authorising
body should be capable of verifying that personal data is used in selectors
only to the extent that it is material to a narrowly specified foreign
intelligence objective. The latter is necessary because the use of selectors
relating to specific individuals exposes them to distinct privacy risks,
including about intimate matters and opinions.
188. In the applicant’s view, furthermore, the authorising judicial body
should be provided with an indication of how the data will be analysed and
used (for example, via pattern-based or subject-based analysis, and whether
profiles of individuals will be compiled).
189. As regards supervision at the stages of carrying out the surveillance
activities and after they have been terminated, the applicant accepted that
the Swedish oversight bodies meet the requirement of sufficient
independence from the executive.
190. However, the oversight body must be vested with sufficient powers
to issue legally binding decisions, including stopping and remedying
breaches and seeking the liability of those responsible for such breaches. It
should have access to classified documents and its functioning should be
open to public scrutiny. The supervision powers should concern both
content and communications data and should be exercised at the stages
when collected communications are subject to automated computer analysis,
where a human analyst works on them and where information is
communicated to national authorities, foreign Governments or international
organisations. Storage of data at each stage should also be supervised.
191. In the applicant’s view, in addition, individuals must dispose of
effective remedies which may take three forms: post-fact notification of the
subject of surveillance, a possibility to request information about the
surveillance or the existence of a body that can examine complaints without
requiring the individual to submit evidence.
192. As regards transmitting intercepted material to foreign actors, the
applicant underlined that Contracting States do not have unfettered
discretion as they cannot outsource data processing and analysis in such a
manner as to avoid responsibility under the Convention. The applicant
considered that the minimum standards must include accessible legal
49