sou · GYB3103 · 2010-12-23 00:00:00 — The British system provides relatively limited safeguards, particularly in national security cases, where the only performs a post-hoc check of the paper work, the supporting documentation behind the appli- cations approved by the responsible government minister. In practice, the time the Commissioner devotes to this task means that only a few cases chosen at random can be subject to any detailed study. Moreover, no follow-up check is made comparing the product of the interception with the documentation relied upon justifying the interception. The complaints body, the Investigatory Powers Tri- bunal (IPT) has upheld any complaints. Even bearing in mind the fact that very many complaints are likely to be ground- less, the success frequency is remarkably low. the Court notes that more than one half of the offences provided for in the Criminal Code fall within the category of offences eligible for interception It notes that Article 156 para. 1 of the Criminal Code uses very general language when referring to such persons and states that the measure of interception may be used in respect of a suspect, defendant or other person involved in a criminal offence. No explanation has been given as to who exactly falls within the category of other person involved in a criminal offence (paras 43–44) The Court notes that the legislation does not elaborate on the degree of reason- ableness of the suspicion against a person for the purpose of authorising an interception. does it contain safeguards other than the that interception should take place only when it is otherwise impossible to achieve the aims (para. 122My emphasis, ibid. para. 123See , 2000, pp. 106–109. 26839/05, 18 2010. What nonetheless seems to have been decisive for the Court in the case was that there was no evidence of any signifi- cant shortcomings in the application and operation of the surveillance regime (para. The case thus supports the proposition that where the Court concludes there is a high degree of professionalism on the part of the /security agencies in complying with the statutory rules for using surveillance, then a relatively limited control/oversight mechanism is acceptable. I should note that I do not agree with this approach. I would argue that, to be credible watchdog, a control mechanism must have a mandate which allows it to study both the lawfulness and the merits of an application afterwards. It must have a minimum degree of competence and resources, e.g. to carry out inspections when and if this is deemed to be necessary. This more robust approach is advocated by inter alia the Commission.125 However, it seems clear that the Court pitches the test somewhat lower. Fortunately, this is not an issue in . Follow-up controls have recently been created in in the form of the Security and and it is unnecessary to go into detail on the Convention requirements in this respect. It suffices to say here that the system put in place must involve not simply a rule that irrelevant conversations be destroyed, but close supervision by a competent external body, most suitably with some form of judicial competence, that this rule is complied with. This in turn will entail administrative routines for enabling the external body to investigate compliance, e.g. logging of all calls recorded, logging of staff present, closely controlled equipment, recordings made in such a way as to reduce the risk for subsequent editing etc.126 6.4Issues for further discussion There are two issues which I think should be discussed in the pre- sent report. The first is whether all forms of secret surveillance have to comply with the above requirements. One can argue that the 125Venice Commission, 2007, para. 126Although rules must be in place and be observed, all deviations from such rules by the or the authorizing body need not constitute a violation of the Convention, if the misuse or error is corrected by a higher court, e.g. by disregarding the evidence so obtained. See Remmers and Hamer v. , No. 29839/96, decision of 18 1998. See, however, the less demanding different types of surveillance mentioned earlier (aural, visual, location information) in different contexts and in different locations (the home and elsewhere) involve different levels of interference with privacy, and so different levels of foreseeability are permissible in the regulatory framework. The Court accepts differential levels of safeguards.127 As noted above, in section 4, the Court accepts that differential levels of foreseeability are permissible in general depen- ding upon the degree of interference involved in Convention rights. Recently, in Uzun it has confirmed that different levels of foresee- ability are acceptable for different types of surveillance measure involving infringements of Article 8. It stated that the stricter prin- ciples (set out above) are not applicable as such to cases such as the present one, concerning surveillance via GPS of movements in public places and thus a measure which must be considered to inter- fere less with the private life of the person concerned than the inter- ception of his or her telephone conversations It will therefore apply the more general principles on adequate protection against arbitrary interference with Article 8 rights as summarised above (at para. In the circumstances, it accepted the then existing general authorization to use technical means was sufficient legal basis for the measure. However, in reaching this conclusion, it took into account a variety of other safeguards which in practice restricted the use of these technical measures, in particular, the fact that they could only be used to investigate offences of a sufficient gravity, and, as already noted, that the domestic courts applied a proportio- nality test and could exclude evidence. (It can be noted that the German law was later amended to provide for judicial authorization to use GPS receivers, where the time period in question exceeds one month). The purpose of defining powers with precision is to reduce the scope for misuse of, or overuse of, power. Other things being equal, the more the power in question interferes with privacy, the greater the potential damage to privacy if the power is misused or overused. It does seem thus reasonable to take the approach that operations and measures which involve a greater infringements of privacy should be provided for by clearer authority, and subject to more restrictions, than operations which involve lesser infringe- PG and JH, op. cit What is required by way of safeguard will depend, to some extent at least, on the nature and extent of the interference in question (at para. ments of privacy.128 Precision focuses the minds of everyone involved in the investigation and authorization process on their responsibilities, which are ultimately backed up by the criminal offence of misuse of office. The same applies to providing for special authorization procedures – whether by senior officers acting as gatekeepers or prosecutors – for the use of particular types of measure, either generally, or in situations which are perceived as being particularly sensitive. Having said this, this principle of precision can only be a point of departure. The argument can be misused, e.g. to justify low levels of precision regarding measures which involve a small interference with each individual targets privacy, but because the measure is used extensively, the cumulative effect can be a large global inter- . And one can also envisage situations in which a degree of imprecision in regulating a secret surveillance power can be com- pensated for by tighter post hoc controls. Not much guidance can be derived from the Courts vague reference in Uzun (referred to above, section 5.3.4) interferences which disclose more information on a persons conduct, opinions or feelings. It is difficult authori- tatively to rank the different types of secret state surveillance identi- fied earlier on the basis of the degree of infringement each involves in privacy. This is partly because the notion of privacy can be assumed to vary from culture to culture and from time to time129 even if some indications of common European can be derived from the compilations of state practice made by academics and second issue is, does the case law give any indications that a degree of difference in the amount and type of regulation is permissible depending upon the purpose for which surveillance is being undertaken – preventive or investigative – and/or the underlying interests to be protected – the prosecution of crime or the protection of national security? Another aspect of this issue is whether the case law permits identifies situations where even privileged communications can be monitored. The national security issue is closely related to the issue of the degree of accessibility and foreseeability required for strategic 128One judge in the English court of appeal judgment in , op. cit, took this approach, but the other two – mistakenly in my view – disproved it. See also the McDonald Com- mission Report, p. 514, which drew the logical procedural consequence of the principle and argued that the more intrusive the technique, the higher should be the level of authorisation. However, this too relates to safeguards, not the level of precision. in one state, tax returns are highly confidential, in another they are not. 130See, in particular, , 2005. surveillance, so the two can conveniently be treated together and I do this in section 6.6. 6.5Differential standards for different forms of surveillance To begin with, the Court made it clear in Bykov that bugging, whether or not participatory, involves at least the same level of inter- with private life as does telephone tapping.131 One can try to draw a distinction in the degree of the interference in private life between bugging in a private place and a public place, because of the allegedly reduced reasonable expectation of privacy. But in many cases of bugging in public spaces the operation may well result in more, or even much more, surplus information, that is, information concerning other people who may have nothing to do with the target. So even if the interference with the targets privacy may be less, I would say that the same, or more or less the same, legal frame- work should apply to both situations. To turn now to the degree of regulation required for teledata. The Court considered the British system in PG and JH. This involved, simply put, the requesting the disclosure of the infor- mation from the telephone company. Where it refused to disclose this information, the could request a court to issue an order compelling it to disclose it. The legal regulation of the system con- sisted of exceptions in the relevant statutes, permitting the tele- phone company to disclose the requested data to the , with- out the penalty which would otherwise apply for revealing personal information. The Court noted that the information obtained concerned the telephone numbers called from B.s flat between two specific dates. It did not include any information about the contents of those calls, or who made or received them. The data obtained, and the use that could be made of them, were therefore strictly limited. While it does not appear that there are any specific statutory provisions (as opposed to internal policy guidelines) governing storage and destruction of such information, the Court is not per- 131 In the Court's opinion, these principles apply equally to the use of a radio transmitting device, which, in terms of the nature and degree of the intrusion involved, is virtually identical to telephone tapping (at para. SOU 2007:22, p. 182 and Vetter v. where the court contented itself with noting that comme les interceptions dentretiens téléphoniques, les écoutes de conversations par le biais de la pose de micros représentent une atteinte grave au respect de la vie privée. (at para. 26, my emphasis). suaded that the lack of such detailed formal regulation raises any risk of arbitrariness or misuse. is it apparent that there was any lack of foreseeability. Disclosure to the was permitted under the relevant statutory framework where necessary for the purposes of the detection and prevention of crime, and the material was used at the applicants trial on criminal charges to corroborate other evidence relevant to the timing of telephone calls. It is not apparent that the applicants did not have an adequate indication as to the circumstances in, and conditions on, which the public authorities were empowered to resort to such a measure.132 In constructing the legal framework for authorizing, and con- trolling, the use of teledata I think it reasonable to take account of the dual purposes behind it, namely the obtaining intelligence and the obtaining of evidence. The two functions set out above are obviously closely related, as it is necessary first to identify the par- ticipants in a criminal conspiracy and then to amass evidence against them. Intelligence can later become evidence. Information that, e.g. A, according to his mobile, was at a certain location at a certain time period can be highly valuable circumstantial evidence, dis- crediting, or proving his version of events. It may well be that the intelligence function is more, or much more common as far as regards teledata. If the objective is simply obtaining intelligence, then it is the who are the primary judge of whether teledata is needed, and what sort, and extent, of teledata is needed. The time period during which the investigation proceeds might also differ. The remedies available after the surveillance has ceased will also be different. There will be differences in the handling of surplus in- formation. Where the object of the surveillance is exploratory, to obtain information generally on a loose grouping of people, or a phenomenon, less information is likely to be regarded as surplus as compared to an investigation of a specific criminal offence com- mitted, or planned, by a specific group. (Having said all this, the fact that the know best what and how much intelligence is needed does not mean that they are best placed to judge whether the gain to the investigation outweighs the loss to the human rights of the suspect and others caught up in the intelligence gathering operation – quite the contrary). It is fair to say that the Court set low standards of accordance with the law in the PG and JH case. There was no judicial authori- 132 At paras 46-47. sation of the interception of teledata in the British system. The question is whether the Court has properly appreciated the type of information which can nowadays be obtained by intercepting tele- data.133 As already mentioned, one can argue that data relating to internet usage is more sensitive than mobile numbers called, which in turn is more sensitive than location information. There is some empirical evidence that people regard location information as the least sensitive type of information.134 However, in practice, a person can be accessing the internet from his or her mobile, or using his or her laptop to make calls at the same time as he or she is surfing the net. Monitoring this usage, in realtime or afterwards, will give the monitor information on all three categories of data. It seems, then, unworkable to set different levels of precision and control for these three different types of data. There seems to be no doubt that interception of teledata is a use- ful investigative and intelligence tool.135 However, in the lack of availability of reliable information on how often and in what ways teledata interception has promoted the effectiveness of in- vestigations and intelligence work, has made it difficult to measure how useful it has been and to weigh this against the interference in personal integrity this entails.136 When an interception of teledata is made for intelligence purposes, one should be clear that the legality and proportionality of it will not be subject to any subsequent check in a criminal trial. Thus, some form of subsequent control is absolutely necessary to prevent misuse and overuse. The existence and proper functioning of the British controls over interception of teledata was not raised in the PG and JH case, nor did it arise in the Heglas case. However, I would say that the Court is very likely to note that some form of subsequent control system over teledata is necessary when and if it is confronted with this issue again. I will not go into the proposed Swedish system of subsequent control over this. However, I would like to note one thing. The problem of abuse of this measure is to be dealt with by the Security and reporting to the prosecutor. However, the issue of overuse is likely to be more serious matter in practice. When and if a pattern of overuse is detected by the Board, this is likely to emerge some 133Cf 2008, p. 134van Loenen et al., 2008, p. 135See e.g. 1990 and Krüpe-Gescher and Dorsch, 2005 (summarizing the results of a study of German practice carried out under the auspices of in ). 136SOU 2007:22, p. time, or some considerable time, after the measures have terminated. A confirmed pattern of overuse must reasonably lead to criticism of the authority involved. This imposition of accountability will have a forward-looking element in the sense of improving the system. However, there must also be a backward-looking element. It is unclear to me in what way the Security and is to react if it comes to the conclusion that overuse but not abuse has occurred. Where there is only a finding that overuse has occurred, and no imposition of accountability whatsoever, the risk is that the authorizing will always err on the side of caution and favour overusing the interception of teledata because of the operational ad- vantages this can give. Lastly as far as this issue is concerned, I will deal with visual surveillance both outside and of the home. Although case law is lacking on the issue, I would argue that visual recorded surveillance of the home, or other private space such as a hotel room, should satisfy similar material standards as those which apply to telephone tapping or bugging. As noted above, the reason for requiring statu- tory authority (even though the Court has not spelled this out) is that major interferences in privacy should require the considered attention of the legislature. If the three types of surveillance are regarded as involving more or less the same level of interference in privacy, then the logical consequence is that the following issues should be set out in statute for visual surveillance of the home; the offences which may give rise to recorded visual surveillance of the home, the ways in which different categories of people (suspects, suspects contact persons etc.) qualify for this measure being used against them, a limit on the duration of the visual surveillance of the home, the procedure to be followed for examining, using and storing the data obtained; the precautions to be taken when com- municating the data to other parties; and the circumstances in which recordings may or must be erased or the tapes destroyed. As already made clear in the preceding sections, visual surveillance outside of the home has so far not, as such, been regarded by the Court as an interference with private life. However, retention of this data is very likely to be regarded as such an interference. The main case dealing with standards of retention of law enforcement data is S and Marper v. UK.137 The case, where the Court, sat as a Grand Chamber, considered the retention of fingerprints and DNA 137 Nos 30562/04 and 30566/04, . samples taken from a person suspected of a criminal offence. Under English law at the time, these may be retained indefinitely, even if, in the subsequent criminal proceedings, the suspect is acquitted. The Court began by considering whether the retention of three different categories of identifiers, namely fingerprints, cellular samples and DNA profiles138 involved interferences with private life. The respondent government had argued that retention of this data did not interfere with the physical and psychological integrity of the persons concerned; nor their right to personal development. How- ever, Court considered that stated that given the nature and the amount of personal information contained in cellular samples, their retention per se must be regarded as interfering with [private life] (para. As regards DNA profiles, the Court placed weight on the fact that the information contained in these allows the authorities to go beyond simple identification of people. As regards finger- prints, while these had less of an impact on private life, the unique information fingerprints contained about the individual concerned allowing his or her identification with precision in a wide range of circumstances meant that their retention without the individuals consent cannot not be regarded as neutral or insignificant and so this was also an interference with the right to respect for private life (paras 84–85). A photograph or film can of a person can be regarded by the person it concerns as extremely sensitive, depending upon the sub- jectively perceived potential for embarrassment or even damage to personal interests dissemination of this record to the general public, or particular people, can cause. Or its dissemination can be regarded with indifference or even welcomed by the individual concerned. One cannot therefore say that all visual records in themselves contain the same potential for interference with private life as does all DNA samples. On the other hand, one can see a visual record as raising comparable issues to a fingerprint. Although it is naturally possible to draw distinctions between fingerprints and photographs, I would say that the same general points should apply. The significance of the English system for retention of DNA and fingerprint records was that there was no mechanism in place for weighing the gain to the in their work in detecting and investigating crimes against the interference the retention of these 138 A DNA profile is obtained by analysing a reference sample from an individual. It consists of a set of numbers which can be put in the form of a barcode. This allows later automated matching of the profile with subsequent profiles. records involved in private life. In S and Marper, the Court was struck by the blanket and indiscriminate nature of the power of retention in and . The material may retained irrespec- tive of the nature or gravity of the offence or of the age of the suspect. Likewise, retention was not limited in time and there existed only limited possibilities for an acquitted individual to have the data removed from the nationwide database or to have the materials destroyed [and] there is no provision for independent review of the justification for the retention (para. The government had argued that simple retention of the data could not have any signifi- cant effect on the individuals concerned, but the Court disagreed. The Court considered that the presumption of innocence (set out in Article 6(2)) was relevant as part of the interpretative context, even if data retention was not as such a voicing of a continued suspicion. The Court considered that there was a clear risk of stig- matization in the blanket retention of data, and that retention could be especially harmful in the case of minors given their special situation and the importance of their development and inte- gration in society (paras 122, 124). In this respect, the Court paid attention to the concerns voiced that young people and ethnic mino- rities are over-represented in the database.