Checks and balances applied by the ECtHR in cases of mass surveillance Bart van der Sloot Senior Researcher Tilburg Institute for Law, Technology, and Society (TILT) Tilburg University, Netherlands www.bartvandersloot.com

Overview 1. Exhaustion of domestic remedies 2. Time limit 3. Harm 4. Legal persons 5. Assessment 6. In accordance with the law 7. Legitimate aim<> Necessity 8. Oversight 9. Information sharing

Sources B. van der Sloot, ‘Is the Human Rights Framework Still Fit for the Big Data Era? A Discussion of the ECtHR’s Case Law on Privacy Violations Arising from Surveillance Activities’, IN: S. Gutwirth, R. Leenes & P. De Hert (eds.), ‘Data Protection on the Move’, Springer, Dordrecht, 2016, pp 411-436. B. van der Sloot, 'A new approach to the right to privacy, or how the European Court of Human Rights embraced the non- domination principle', Computer Law & Security Review, 2018.

Exhaustion of domestic remedies If ‘the applicant had made a general complaint to the IPT, and if that complaint been upheld, the tribunal did not have the power to annul any of the RIPA provisions or to find any interception arising under RIPA to be unlawful as a result of the incompatibility of the provisions themselves with the Convention. [] Accordingly, the Court considers that the applicant was not required to advance his complaint regarding the general compliance of the RIPA regime for internal communications with Article 8 § 2 before the IPT in order to satisfy the requirement under Article 35 § 1 that he exhaust domestic remedies.’ ECtHR, Kennedy v. the United Kingdom, application no. 26839/05, 18 May 2010. See also: pre-judicial questions

Exhaustion of domestic remedies ‘while the Court acknowledges that since Kennedy was decided in 2010 the IPT has shown itself to be an effective remedy which applicants complaining about the actions of the intelligence services and/or the general operation of surveillance regimes should first exhaust in order to satisfy the requirements of Article 35 § 1 of the Convention, it would nevertheless accept that at the time the applicants in the first and second of the joined cases introduced their applications, they could not be faulted for relying on Kennedy as authority for the proposition that the IPT was not an effective remedy for a complaint about the general Convention compliance of a surveillance regime.’ ECtHR, BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM, Applications nos. 58170/13, 62322/14 and 24960/15, 13 September 2018

Time limit The ECtHR stressed that the applicant complained ‘more than six months later, on 12 September 2007. The fact that he did not have knowledge of the exact content of the recording is immaterial because the lack of such knowledge could not prevent him from formulating a complaint under Article 8 of the Convention in relation to the secret taping of his interrogation. Nor can the Court accept that the criminal proceedings against the applicant constituted an obstacle to his raising grievances in this respect. It follows that the complaints concerning the secret taping of the applicant’s interrogation have been introduced out of time and must be rejected in accordance with Article 35 §§ 1 and 4 of the Convention. By contrast, the concomitant complaints concerning the mere existence in Bulgaria of laws and practices which have established a system for secret surveillance relate to a continuing situation—in as much as the applicant may at any time be placed under such surveillance without his being aware of it. It follows that his complaints in that respect cannot be regarded as having been raised out of time.’ ECtHR, Lenev v. Bulgaria, application no. 41452/07, 04 December 2012

Harm ‘[W]here the domestic system does not afford an effective remedy to the person who suspects that he or she was subjected to secret surveillance, widespread suspicion and concern among the general public that secret surveillance powers are being abused cannot be said to be unjustified. In such circumstances the menace of surveillance can be claimed in itself to restrict free communication through the postal and telecommunication services, thereby constituting for all users or potential users a direct interference with the right guaranteed by Article 8. There is therefore a greater need for scrutiny by the Court and an exception to the rule, which denies individuals the right to challenge a law in abstracto, is justified.’ ECtHR, Roman Zakharov v. Russia, application no. 47143/06, 04 December 2015.

Legal persons The Court pointed to the statutory objectives of the association and found that the ‘rights in issue in the present case are those of the applicant association, not of its members. There is therefore a sufficiently direct link between the association as such and the alleged breaches of the Convention. It follows that it can claim to be a victim within the meaning of Article 34 of the Convention.’ ECtHR, Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria, application no. 62540/00, 08 June 2007, § 59.

Assessment ‘However, as with other cases in which domestic law has been considered in abstracto and amendments have been made to the legislation while the application was pending (see, for example, Association for European Integration and Human Rights and Ekimdzhiev), in the present case the Court must review the Convention compliance of the law in force at the date of its examination of the applicants’ complaints.’ ‘The Court has considered the Convention compatibility of regimes which expressly permit the bulk interception of communications on two occasions: first in Weber and Saravia (cited above), and then in Liberty and Others v. the United Kingdom, no. 58243/00, 1 July 2008.’ ECtHR, BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM, Applications nos. 58170/13, 62322/14 and 24960/15, 13 September 2018 See also: pilot cases

In accordance with the law ‘The “quality of law” in this sense implies that the domestic law must not only be accessible and foreseeable in its application, but it must also ensure that secret surveillance measures are applied only when “necessary in a democratic society”, in particular by providing for adequate and effective safeguards and guarantees against abuse.’ ECtHR, BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM, Applications nos. 58170/13, 62322/14 and 24960/15, 13 September 2018

In accordance with the law Legal basis: directed at the executive power Interference should have a legal basis All conditions contained in the law should be respected Understandability: directed at legislative power <> citizens Accessible Foreseeable Quality of the law: directed at legislative power <> executive power 1. Must clearly describe what powers are assigned to the governmental agency 2. The terms and conditions under which it can use these powers 3. What parliamentary and judicial oversight is applied to the use of power 4. What safeguards and remedies are in place for citizens

Foreseeability ‘The Court has held on several occasions that the reference to “foreseeability” in the context of secret surveillance cannot be the same as in many other fields. Foreseeability in the special context of secret measures of surveillance, such as the interception of communications, cannot mean that an individual should be able to foresee when the authorities are likely to resort to such measures so that he can adapt his conduct accordingly. However, especially where a power vested in the executive is exercised in secret, the risks of arbitrariness are evident. It is therefore essential to have clear, detailed rules on secret surveillance measures, especially as the technology available for use is continually becoming more sophisticated. The domestic law must be sufficiently clear to give citizens an adequate indication as to the circumstances in which and the conditions on which public authorities are empowered to resort to any such measures’ ECtHR, BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM, Applications nos. 58170/13, 62322/14 and 24960/15, 13 September 2018.

Clarity ‘Moreover, the law must indicate the scope of any discretion conferred on the competent authorities and the manner of its exercise with sufficient clarity to give the individual adequate protection against arbitrary interference. In its case-law (see Huvig, cited above, § 34; Valenzuela Contreras, cited above, § 46; Weber and Saravia, cited above, § 95; and Association for European Integration and Human Rights and Ekimdzhiev, cited above, § 76) on the interception of communications in criminal investigations, the Court has developed the following minimum requirements that should be set out in law in order to avoid abuses of power: the nature of offences which may give rise to an interception order; a definition of the categories of people liable to have their communications intercepted; a limit on the duration of interception; the procedure to be followed for examining, using and storing the data obtained; the precautions to be taken when communicating the data to other parties; and the circumstances in which intercepted data may or must be erased or destroyed. In Roman Zakharov (cited above, § 231) the Court confirmed that the same six minimum requirements also applied in cases where the interception was for reasons of national security; however, in determining whether the impugned legislation was in breach of Article 8, it also had regard to the arrangements for supervising the implementation of secret surveillance measures, any notification mechanisms and the remedies provided for by national law’ ECtHR, BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM, Applications nos. 58170/13, 62322/14 and 24960/15, 13 September 2018

Clarity ‘The applicants argue that in the present case the Court should “update” those requirements by including requirements for objective evidence of reasonable suspicion in relation to the persons for whom data is being sought, prior independent judicial authorisation of interception warrants, and the subsequent notification of the surveillance subject [] although the Court would agree that the additional requirements proposed by the applicants might constitute important safeguards in some cases, for the reasons set out below it does not consider it appropriate to add them to the list of minimum requirements in the case at hand.’ ECtHR, BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM, Applications nos. 58170/13, 62322/14 and 24960/15, 13 September 2018

Clarity ‘the Court considers that the decision to operate a bulk interception regime was one which fell within the wide margin of appreciation afforded to the Contracting State. Furthermore, in view of the independent oversight provided by the Interception of Communications Commissioner and the IPT, and the extensive independent investigations which followed the Edward Snowden revelations, it is satisfied that the intelligence services of the United Kingdom take their Convention obligations seriously and are not abusing their powers under section 8(4) of RIPA. Nevertheless, an examination of those powers has identified two principal areas of concern; first, the lack of oversight of the entire selection process, including the selection of bearers for interception, the selectors and search criteria for filtering intercepted communications, and the selection of material for examination by an analyst; and secondly, the absence of any real safeguards applicable to the selection of related communications data for examination.’ ECtHR, BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM, Applications nos. 58170/13, 62322/14 and 24960/15, 13 September 2018

Legitimate aim <> Necessity “national authorities enjoy a certain margin of appreciation in choosing the means for achieving the legitimate aim of protecting national security. However, this margin is subject to European supervision embracing both legislation and decisions applying it. In view of the risk that a system of secret surveillance set up to protect national security may undermine or even destroy democracy under the cloak of defending it, the Court must be satisfied that there are adequate and effective guarantees against abuse. The assessment depends on all the circumstances of the case, such as the nature, scope and duration of the possible measures, the grounds required for ordering them, the authorities competent to authorise, carry out and supervise them, and the kind of remedy provided by the national law. The Court has to determine whether the procedures for supervising the ordering and implementation of the restrictive measures are such as to keep the “interference” to what is “necessary in a democratic society”’ ECtHR, BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM, Applications nos. 58170/13, 62322/14 and 24960/15, 13 September 2018

Oversight ‘Review and supervision of secret surveillance measures may come into play at three stages: when the surveillance is first ordered, while it is being carried out, or after it has been terminated. As regards the first two stages, the very nature and logic of secret surveillance dictate that not only the surveillance itself but also the accompanying review should be effected without the individual’s knowledge. Consequently, since the individual will necessarily be prevented from seeking an effective remedy of his or her own accord or from taking a direct part in any review proceedings, it is essential that the procedures established should themselves provide adequate and equivalent guarantees safeguarding his or her rights.’ ECtHR, BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM, Applications nos. 58170/13, 62322/14 and 24960/15, 13 September 2018

Information sharing ‘the applicants submitted that information acquired from the NSA fell into three categories: material which the NSA had provided to the United Kingdom intelligence services unsolicited, and which on its face derived from intercept; communications which the United Kingdom intelligence services had either asked the NSA to intercept, or to make available to them as intercept; and material obtained by the NSA other than by the interception of communications. [] As the Government, at the hearing, informed the Court that it was “implausible and rare” for intercept material to be obtained “unsolicited”, the Court will restrict its examination to material falling into the second and third categories.’ ECtHR, BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM, Applications nos. 58170/13, 62322/14 and 24960/15, 13 September 2018

Information sharing ‘The parties dispute whether the six minimum requirements commonly applied in cases concerning the interception of communications [] should apply in the present case. It is true that the interference in this case is not occasioned by the interception of communications by the respondent State. However, as the material obtained is nevertheless the product of intercept, those requirements which relate to its storage, examination, use, onward dissemination, erasure and destruction must be present. Indeed, as the Venice Commission noted, as States could use intelligence sharing to circumvent stronger domestic surveillance procedures and/or any legal limits which their agencies might be subject to as regards domestic intelligence operations, a suitable safeguard would be to provide that the bulk material transferred could only be searched if all the material requirements of a national search were fulfilled and this was duly authorised in the same way as a search of bulk material obtained by the signals intelligence agency using its own techniques.’ ECtHR, BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM, Applications nos. 58170/13, 62322/14 and 24960/15, 13 September 2018