100
BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM JUDGMENT
stronger domestic surveillance procedures and/or any legal limits which
their agencies might be subject to as regards domestic intelligence
operations. It considered that a suitable safeguard would be to provide that
the bulk material transferred could only be searched if all the material
requirements of a national search were fulfilled and this was duly authorised
in the same way as a search of bulk material obtained by the signals
intelligence agency using its own techniques.
I. European Union law
1. Charter of Fundamental Rights of the European Union
217. Articles 7, 8 and 11 of the Charter provide as follows:
Article 7 – Respect for private and family life
“Everyone has the right to respect for his or her private and family life, home and
communications.”
Article 8 – Protection of personal data
“1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the
consent of the person concerned or some other legitimate basis laid down by law.
Everyone has the right of access to data which have been collected concerning him or
her, and the right to have them rectified.
3. Compliance with these rules shall be subject to control by an independent authority.”
Article 11 – Freedom of expression and information
“1. Everyone has the right to freedom of expression. This right shall include
freedom to hold opinions and to receive and impart information and ideas without
interference by public authority and regardless of frontiers.
2. The freedom and pluralism of the media shall be respected.”
2. EU directives and regulations relating to protection and processing
of personal data
218. The Data Protection Directive (Directive 95/46/EC on the
protection of individuals with regard to the processing of personal data and
on the free movement of such data), adopted on 24 October 1995, regulated
for many years the protection and processing of personal data within the
European Union. As the activities of Member States regarding public safety,
defence and State security fall outside the scope of Community law, the
Directive did not apply to these activities (Article 3(2)).
219. The General Data Protection Regulation, adopted in April 2016,
superseded the Data Protection Directive and became enforceable on
25 May 2018. The regulation, which is directly applicable in Member States1,