• Home /
• News /
• 2022 /
• January /
• ECHR: Strasbourg Court provides a strong standard on data retention and secret surveillance

ECHR: Strasbourg Court provides a strong standard on data retention and secret surveillance

Topic

Country/Region

28 January 2022

In a judgment of 11th of January 2022, the European Court of Human Rights ruled that Bulgaria’s legislation on secret surveillance is in breach of the European Convention on Human Rights. The Strasbourg-based court was asked to evaluate Bulgaria’s surveillance law, as well as several articles in the country’s criminal code.

This story via Access Information Programme Bulgaria. See also our previous article on the judgment, the judgment: Case of Ekimdzhiev and others v. Bulgaria (Application no. 70078/12, pdf) and: Legal summary (pdf)

The applicants are two Bulgarian nationals, Mihail Ekimdzhiev and Aleksandar Kashamov, who are lawyers, and two non-governmental organisations, the Association for European Integration and Human Rights, and the Access to Information Program (AIP), where the lawyers work. The applicants asserted that the nature of their activities puts them at risk of both secret surveillance and of having their communications data accessed by the authorities under the laws authorising such activity in Bulgaria.

Complaints

Relying on Article 8 (right to respect for private and family life) and Article 13 (right to an effective remedy) of the Convention, the applicants alleged, in particular, that under the system of secret surveillance in Bulgaria the e-communications of anyone in the country could be intercepted, and that under the system of retention and subsequent accessing of communications data in Bulgaria, the e-communications data of anyone in the country could be accessed by the authorities. They complained that the laws governing those two matters, as applied in practice, did not provide sufficient safeguards against arbitrary or abusive secret surveillance and accessing of e-communications data.

Judgment of the Court

The Court held that the “legislation governing secret surveillance did not meet the quality-of-law requirement” in the European Convention on Human Rights, and the Bulgarian government “was unable to keep surveillance to only that which was necessary.” According to the Court, the laws in Bulgaria that regulate wiretapping and surveillance are of poor quality and cannot guarantee that the interference with the privacy of citizens meets the criteria of a democratic society.

Secret surveillance

The Court considered that the relevant regulatory body’s (the National Bureau for Control of Special Surveillance Means) independence could not be guaranteed, particularly as its members were subject to prior screening to get security clearance by a security agency whose requests they were meant to oversee. Consequently, the Bureau did not seem to be able to exert its supervisory role being under the risk to be deprived of the necessary access to relevant classified information and material. In particular, in 2017 the security clearance of the deputy president of the Bureau was deliberately and unfoundedly removed, and his access to relevant documents thus made impossible, which impeded the effective work of the entire body.

Retention and accessing of communication data

In terms of the process for accessing e-communications data, the Court found a violation in the status quo that requests of the police and the security agencies did not have to be accompanied by supporting material, and the access permits themselves did not have to be reasoned. Overall, the procedure did not effectively guarantee that access was granted only when genuinely necessary and proportionate in each case. The Court found that the oversight was too weak to ensure that the retention of e-communications data and its subsequent accessing was not open to abuse.

In terms of subsequent notification of the data subjects of the fact that they have been subjected to access of their e-communications data, the Bulgarian government had not provided sufficient information on the new data protection procedures. In the absence of such information, the Court had to consider the notification procedure inadequate.

Alexander Kashamov, Head of the AIP Legal team, said:

“The Strasbourg Court judgment is highly important and sets a precedent. In a democracy, state bodies should be transparent to citizens, while the latter’s private life and communications should enjoy a guaranteed degree of confidentiality. On the contrary, transparent citizens and а non-transparent state are characteristics of an authoritarian and а totalitarian state. Holding that a system of secret surveillance should provide effective protection against abuse, including an independent and efficient supervisory body and a right to be informed, the Court delivers a strong message to both established and new democracies within the 47 Council of Europe members.”

---

Image: mitko_denev, CC BY-NC 2.0