• Home /
• News /
• 2022 /
• January /
• Bulgaria: Secret surveillance data "could be used for nefarious purposes" due to lack of safeguards, rules ECHR

Bulgaria: Secret surveillance data "could be used for nefarious purposes" due to lack of safeguards, rules ECHR

Topic

Country/Region

11 January 2022

The European Court of Human Rights has ruled that Bulgarian law regulating secret surveillance by the the police, prosecutors, and military and security agencies is of insufficient quality to protect individuals against violations of the right to privacy, and that the data gathered through secret surveillance operations "could be used for nefarious purposes" due to a lack of safeguards.

See the judgment: Case of Ekimdzhiev and others v. Bulgaria (Application no. 70078/12, pdf) and: Legal summary (pdf)

See also, by one of the applicants in the case: The use and misuse of telephone taps and communications data by Bulgarian intelligence by Alexander Kashumov (Statewatch Analysis, June 2013)

The text below is a press release published by the European Court of Human Rights on 11 January 2021.

Flaws in legal safeguards and oversight procedures around secret surveillance

In today’s Chamber judgment [1] in the case of Ekimdzhiev and Others v. Bulgaria (application no. 70078/12) the European Court of Human Rights held, unanimously, that there had been:

a violation of Article 8 (right to respect for private life and correspondence) of the European Convention on Human Rights, in respect of secret surveillance, and

a violation of Article 8 in respect of retention and accessing of communication data.

The case concerned secret surveillance and the system of retention and subsequent accessing of communications data in Bulgaria.

Two of the applicants had previously had a judgment in their favour in the case Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria (no. 62540/00).

The Court found in particular that the relevant legislation governing secret surveillance did not meet the quality-of-law requirement of the Convention and was unable to keep surveillance to only that which was necessary.

Similarly, the Court found that the laws governing retention and accessing communications data did not meet the quality-of-law requirement of the Convention, and they were incapable of limiting such retention and accessing to what was strictly necessary.

Principal facts

The applicants are two Bulgarian nationals, Mihail Tiholov Ekimdzhiev and Aleksandar Emilov Kashamov, who are lawyers, and two non-governmental organisations, the Association for European Integration and Human Rights and the Access to Information Foundation. Mr Ekimdzhiev and Mr Kasamov were born in 1964 and 1971 and live in Plovdiv (Bulgaria) and Sofia respectively. The Association for European Integration and Human Rights was founded in 1998 and is based in Plovdiv. The Access to Information Foundation was founded in 1997 and is based in Sofia.

The applicants asserted that the nature of their activities put them at risk of both secret surveillance and of having their communications data accessed by the authorities under the laws authorising such activity in Bulgaria. They did not allege that they had in fact been placed under surveillance or had had their communications data accessed by the authorities.

Under the main relevant pieces of legislation (the Special Surveillance Means Act 1997 and Articles 172 to 176 of the Code of Criminal Procedure), covert surveillance is legal in Bulgaria. This includes, among other methods, visual surveillance, interception of telephone and electronic communications and eavesdropping. Surveillance techniques can be used for national security or when a “serious intentional offence” is suspected, that is to say an offence with a sentence of more than five years’ imprisonment. Examples included terrorism, murder, embezzlement, desertion in wartime and unlawfully dealing in nuclear materials. The most common offences for which they had been used are racketeering and drugs offences.

Surveillance information can be requested and used by bodies under the umbrella of the Ministry of Internal Affairs (such as the police), prosecutors and some other military and security agencies. The presidents of a limited list of courts can issue warrants to carry out the surveillance.

The system is overseen mainly by a National Bureau and in addition by a special parliamentary committee.

Under the main relevant pieces of legislation (sections 251b and following of the Electronic Communications Act 2007 and Article 159a of the Code of Criminal Procedure), the retention and subsequent accessing by the authorities of communications data is likewise legal in Bulgaria. All communication service providers in the country are obliged by law to retain such data for all of their users for six months, and the authorities can access the retained data to detect and investigate serious crime and some other law-enforcement purposes. Access warrants can be issued by the presidents of all district courts or judges to whom they delegate that task. The system is overseen by a special parliamentary committee and, in part, by the personal-data-protection authorities.

Complaints, procedure and composition of the Court

Relying on Article 8 (right to respect for private and family life) and Article 13 (right to an effective remedy) of the European Convention on Human Rights, the applicants alleged, in particular, that under the system of secret surveillance in Bulgaria the communications of anyone in the country could be intercepted, and that under the system of retention and subsequent accessing of communications data in Bulgaria the communications data of anyone in the country could be accessed by the authorities. They complained that the laws governing those two matters, as applied in practice, did not provide sufficient safeguards against arbitrary or abusive secret surveillance and accessing of communications data. They also complained they had no effective remedy in respect of those breaches.

The application was lodged with the European Court of Human Rights on 19 October 2012.

Judgment was given by a Chamber of seven judges, composed as follows:

Tim Eicke (the United Kingdom), President,
Yonko Grozev (Bulgaria),
Faris Vehabović (Bosnia and Herzegovina),
Iulia Antoanella Motoc (Romania),
Armen Harutyunyan (Armenia),
Gabriele Kucsko-Stadlmayer (Austria),
Ana Maria Guerra Martins (Portugal),

and also Andrea Tamietti, Section Registrar.

Decision of the Court

Secret surveillance

The Court accepted that the relevant law was accessible to people such as the applicants in this case. The Court found it established that the grounds for surveillance set out in law met the Convention requirements, with the exception of the term “objects”, which was insufficiently clear within the meaning of section 12(1) of the Special Surveillance Means Act 1997. It found that there was a lack of proper judicial oversight over decisions to issue warrants. In terms of storing, accessing and destroying data, the Court found that the lack of clear regulation had led to a situation where secret surveillance data could be used for nefarious purposes. It highlighted that the protection for legal-professional privilege was inadequate.

Regarding oversight by the authorities, the Court considered that the specific body’s (the National Bureau for Control of Special Means of Surveillance) independence could not be guaranteed, particularly as its members were given prior vetting by an agency whose requests they were meant to oversee, and they didn’t seem to be able to secure unfettered access to the relevant places and material. The system of overseeing secret surveillance in Bulgaria as it was currently organised did not appear capable of providing effective guarantees against abusive surveillance. The court noted that the restrictive notification procedures – often the only lawful way in which the people could learn that they had been subjected to surveillance – appeared inadequate, often not making clear, in response to requests, whether there had been no surveillance, rather than just no illegal surveillance. As for the remedy – a civil claim which was dependent on just such notification – it only led to damages and did not appear to be effective.

Ultimately, the Court held that the relevant legislation governing secret surveillance, especially as applied in practice, did not meet the quality-of-law requirement of the Convention and was unable to keep surveillance to only that which was necessary. There had been a violation of Article 8.

Retention and accessing of communication data

Under this heading, the Court noted that the law was accessible, and that it provided that safeguards had to be put in place and data destroyed after a statutory period.

In terms of the process for accessing data, the Court noted that requests did not have to give supporting material, and the decisions themselves did not have to be reasoned. Overall, it did not effectively guarantee that access was granted only when genuinely necessary and proportionate in each case. The Court found that the oversight was too weak to ensure that the retention of communications data and its subsequent accessing was not open to abuse.

In terms of notification, the Government had not provided sufficient information on the new dataprotection procedures. In the absence of such information, the Court had to consider the notification procedure inadequate. The Court reiterated its above findings concerning the remedies available to the applicants or others in their situation.

As the laws governing retention and accessing communications data did not meet the quality-of-law requirement of the Convention, they were incapable of limiting such retention and accessing to what was necessary, leading to a violation of Article 8.

Just satisfaction (Article 41)

The Court held that a finding of a breach of the Convention was sufficient in respect of just satisfaction in this case. It held that Bulgaria was to pay 3,290.69 euros (EUR) in total in respect of costs and expenses.

Binding force and enforcement (Article 46)

The Court emphasised that pursuant to Article 46, a member State had to make the necessary changes to domestic law to end the violation and restore as far as possible the situation which would have obtained if it had not taken place, and to ensure its laws were compatible with the Convention In this case, the measures would have to supplement those which the Bulgarian authorities had already taken to implement the judgment Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria (62540/00).

The judgment is available only in English.

[1] Under Articles 43 and 44 of the Convention, this Chamber judgment is not final. During the three-month period following its delivery, any party may request that the case be referred to the Grand Chamber of the Court. If such a request is made, a panel of five judges considers whether the case deserves further examination. In that event, the Grand Chamber will hear the case and deliver a final judgment. If the referral request is refused, the Chamber judgment will become final on that day.

Once a judgment becomes final, it is transmitted to the Committee of Ministers of the Council of Europe for supervision of its execution.
Further information about the execution process can be found here: www.coe.int/t/dghl/monitoring/execution.