The Illustrative Member States whose surveillance laws are examined in this section are Belgium, France, Germany, Italy, Ireland, the Netherlands, Poland and the UK. Together, these countries encompass more than two-thirds of the citizens of the EU. This section of the report looks at the laws of these Illustrative Member States
respecting government surveillance by intelligence services and criminal justice systems in light of the four criteria above, distilled from the Schrems judgment and the ECtHR case law: (i) the specific legal authority for the surveillance measures; (ii) limits on the scope of data that may be collected and retained; (iii) oversight of the surveillance measures; and (iv) legal remedies and forms of redress available where surveillance measures may breach data protection and privacy rights.132 These
criteria must be respected to justify state measures that enable interference with human rights in pursuit of legitimate goals such as state security or national security. For each one of these criteria, this section considers the various ways the laws of the Illustrative Member States address key aspects of the criteria. The object of this overview is to look concretely at how these Member States implement their
surveillance laws and give force to the EU fundamental principles of necessity and proportionality.
As more fully discussed below, these principles are expressly referred to in some form in most of the Illustrative Member States’ surveillance laws, and some have proposed legislation with a view towards conforming their laws with these
principles.133 The focus of this overview is on the specific measures the Illustrative Member States take to provide such adequate and effective guarantees and comply with the broad principles in their laws.
As set out in more detail in Part 1.3.3 above, it has been well established since the
ECtHR’s Plenary Court judgment of 6 September 1978 in Klass that EU Member
States must be able to undertake secret surveillance to effectively counter threats to the security of their citizens.134 They have a wide margin of discretion to set the level
132Schrems; see also supra Part 1.3.4.
133 In France, for example, the principle of proportionality, in particular with respect to the risks to
privacy, secrecy of correspondence and inviolability of the home; and encouraging the implementation of less intrusive surveillance measures where the same outcome can be achieved, were presented by the French Government as being the guiding concepts in the implementation of surveillance
measures pursuant to the recently adopted Intelligence Law No. 2015-912 of 24 July 2015 on
Intelligence (2015 Intelligence Law). The aim of the 2015 Intelligence Law was to fill a legislative gap and provide a legal framework for the intelligence services activities in France. Likewise, in the UK, the Regulation of Investigatory Powers Act 2000 (RIPA) was implemented to consolidate UK
surveillance laws and bring the laws into line with the obligations under the ECHR (as defined below) including the principles of necessity and proportionality. RIPA Explanatory Notes.
134Klass, § 48: “Democratic societies nowadays find themselves threatened by highly sophisticated
of protection for their citizens in terms of national security and public safety, to evaluate threats,135 and to choose the forms of surveillance to counter such threats.136 The threats to security cannot be defined in advance, and the surveillance instruments to be used can therefore vary over time as well. The ECtHR has assessed several types of potentially intrusive surveillance
measures, including direct access of intelligence services to all communications of a certain type, e.g., all phone conversations between two Member States,137 or
technical access to all mobile phones.138 The ECtHR does not condemn any type of surveillance methods or measures as such. Rather, the ECtHR assesses if such measures are “prone to abuse” and what measures are taken by the state to prevent such abuse.139 This assessment of the surveillance practice as a whole (i.e.,
including safeguards)140 determines whether a Member State limits interference with fundamental rights to what is “necessary in a democratic society” within the meaning of Article 8 ECHR.
The comparative overview that follows shows a broad consensus (upheld by the ECtHR) that national security and public safety can be protected by means of electronic surveillance.
Each of the Illustrative Member States authorises and regulates various forms of surveillance by agencies for the purposes of intelligence and internal security under the heading of “national security” or “state security” as well as other interests of the state. Each also authorises surveillance by the criminal justice system for criminal justice purposes to investigate and prosecute serious crimes. The majority of the Illustrative Member States use advanced forms of surveillance, and they are
counter such threats, to undertake the secret surveillance of subversive elements operating within its jurisdiction. The Court therefore has to accept that the existence of some legislation granting powers of secret surveillance over the mail, post and telecommunications.” See also Article 4(2) TEU, Article 8 ECHR, Article 52 Charter, Articles 3(2) and 13 of Directive 95/46.
135 ECtHR, Research Division, National Security and European Case-Law 4 (2013) (“Member States
are recognized to have certain – even a large – measure of discretion when evaluating threats to national security.”).
136Klass, § 49 (“As concerns the fixing of the conditions under which the system of surveillance is to
be operated, the Court points out that that the domestic legislature enjoys a certain discretion. It is certainly not for the Court to substitute for the assessment of the national authorities any other assessment of what might be the best policy in the field.”); id. (collecting further references).
137Liberty, § 64.
138Zakharov, § 270.
139Id. §§ 270–271.
140Kennedy, § 153 (“[P]owers to instruct secret surveillance of citizens are only tolerated under Article
8 [of the] ECHR to the extent that they were strictly necessary for safeguarding democratic institutions. In practice, this means that there must be adequate and effective guarantees against abuse. The assessment depends on all the circumstances of the case, such as the nature, scope and duration of the possible measures, the grounds required for ordering them, the authorities competent to authorise, carry out and supervise them, and the kind of remedy provided by the national law.”).
technically capable of intercepting any kind of communication in their territory. The four largest Illustrative Member States (France, Germany, Poland, and the UK) and the Netherlands explicitly permit certain types of surveillance that are not targeted at identified suspected individuals, and these countries can apply “keywords” or
“selectors” to large communications data flows crossing their territory.
For the publicly-known surveillance programmes,141 each Illustrative Member State limits the use of surveillance through prior approvals – either from judicial authorities or from high-level government ministers. Each has various forms of post-hoc
oversight. The standards required for approval of surveillance, the mechanisms of oversight, the permitted scope of surveillance, and the ability to seek effective and meaningful remedies for abuses of surveillance authority all vary significantly. After this overview, the next section of the report will conduct a similar overview of the legal order for surveillance in the US measured against the same criteria. Then Section 2.3 will assess the range of variation among the measures taken in the Illustrative Member States to establish the EU Benchmark and apply this benchmark to the US legal order.