sou · H3B331 · 2015-03-30 00:00:00 — Enligt en särskild tidsbegränsad bestämmelse får uppgifter hämtas in också om brottslig verksamhet som innefattar vissa brott med lägre straffminimum än fängelse (3 §). De brott som omfattas av bestämmelsen utgör sådan samhällsfarlig brottslighet som bekämpas av Säkerhetspolisen. En del av vårt uppdrag har varit att analysera Säkerhetspolisens behov av en sådan möjlighet och att lämna förslag på hur detta behov bör tillgodoses och balanseras mot integritetsintresset. Genom vår kartläggning har det kommit fram att tillämpningen av inhämtningslagen har lett till beaktansvärd nytta i samband med underrättelsearbete avseende brottslig verksamhet som innefattar flera av de brott som omfattas av bestämmelsen. Vi be- dömer därför att möjligheten att hämta in uppgifter om brottslig verksamhet som innefattar dessa brott bör finnas kvar och att den i fortsättningen bör gälla permanent. Vidare har det kommit fram att Säkerhetspolisen har ett stort behov av att kunna hämta in uppgifter om brottslig verksamhet som innefattar s.k. statsstyrt företagsspioneri samt grov misshandel och olaga frihetsberövande som begås i avsikt att påverka offentliga organ eller den som yrkesmässigt bedriver nyhetsförmedling eller annan journalistik att vidta eller avstå från att vidta en åtgärd eller att hämnas en åtgärd (s.k. systemhotande brottslighet). Vi föreslår därför att möjligheten att hämta in uppgifter ska omfatta även dessa brott. The Electronic Communications Act contains provisions stating that suppliers of publicly available electronic communications services are to retain certain data generated or processed in connection with providing such services so that these data can be used for law enforce- ment purposes. Our remit has been to propose the changes deemed appropriate to strengthen the protection of privacy with respect to these regulations. The Data Collection Act regulates the powers of the Authority, the and the Swedish Customs to access such information. The Inquiry has had instructions to survey and evaluate the application of the Act in practice and to consider whether it should be changed. Another purpose of our remit has been to analyse the ’s need for special powers to collect data about some forms of criminal activity that are not covered by the general rule in the Data Collection Act and to present proposals on how such a need should be met and the balance to be struck with the interests of privacy. Protection of private life etc. In the background section of the report, we describe the rules on the protection of individuals’ private lives contained in the , Convention for the Protection of Human Rights and Fundamental Freedoms and the EU Charter of Fundamental Rights. This section also discusses certain provisions on the protection of individuals’ personal data. In addition, it describes the activities of the various law enforcement authorities and the provisions regulating these authorities’ powers to demand access to certain information about electronic com- munications that they need in their activities. Retention Directive (Directive 2006/24/EC of Parliament and of retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public com- munications networks and amending Directive 2002/58/EC) aimed to harmonise EU Member States’ regulations on the obligations of suppliers of publicly available electronic communications services or of public communications networks to retain certain data about electronic communications to ensure that the data is available for detecting, investigating and prosecuting serious crime. The provisions implementing the Directive in Swedish law are contained in the Act. On the Court of of Union delivered its judgment in joined cases C 293/12 and C 594/12, Digital Rights et al., concerning the validity of the Data Retention Directive. In its judgment, the Court declared the Directive invalid. The Court noted that the Directive entailed a wide-ranging and particularly serious interference in the right to respect for private life and the protection of personal data. However, the Court found that an obligation to retain data is an effective measure for achieving the purpose of fighting serious crime and maintaining public safety. Nonetheless, since the Directive did not lay down clear and precise rules governing the scope of the interference in the rights at issue, the Court considered that the interference was not limited to what was strictly necessary to achieve its purpose. In its judgment, the Court identified certain circumstances to which particular attention was paid in assessing whether the Directive satisfied the require- ments of proportionality. On balance, the Court found that the legislative assemblies of Union had exceeded their authority when the Directive was adopted, since it does not satisfy the principle of proportionality with regard to the rights concerned. Which categories of data should be retained? The obligation to retain data is regulated in Swedish law by provisions in the Act and Ordinance. These pro- visions require suppliers of electronic communications networks and communications services to retain certain data concerning telephone calls, internet traffic, message processing and other matters. The obligation applies for six months calculated from the date on which the communications concluded. The obligation to retain this data is a measure that infringes on rights that are guaranteed to individuals in accordance with the Instrument of Government, Convention for the Pro- tection of Human Rights and Fundamental Freedoms and the EU Charter of Fundamental Rights. For such a measure to be acceptable, it must be objectively appropriate for achieving the measure’s purpose and it must be proportionate. It is evident from information obtained from the that all the categories of data retained under current rules are of great importance for law enforcement activities. Our assessment is there- fore that the data retention obligation does not cover anything other than what is strictly necessary to achieve the purpose of the regulations. Consequently, no changes should be made in the categories of data that are to be retained. Requirement for retention within the EU? According to the Court of , control by an independent authority is a fundamental component of the protection provided to individuals in connection with the processing of personal data. In the data retention judgment, the Court pointed out that one deficiency in the Data Retention Directive was that it could not be held that the Directive fully ensured the control by an independent authority of compliance with the requirements of protection and security. According to the Court, this was a consequence of the fact that the Directive did not require the data to be retained within Union. Against this backdrop, we considered whether a prohibition should be introduced against data that is retained under Swedish rules being transferred to a third country for storage there. found that the way in which the Swedish regulations are designed enables the supervisory authority, the Authority, to conduct and effective supervision even of suppliers that choose to store data outside the EU. We have also taken into consideration that personal data may only be transferred to a third country if the country concerned ensures an adequate level of protection for the data. The adequate protection requirement means, among other things, that the third country must have established control mechanisms that monitor compliance with the country’s rules on protection of personal data. Our assessment is therefore that control by an independent authority is guaranteed in Swedish law even with regard to suppliers that might choose to store data outside the EU. Moreover, we have found that a requirement in national law for retention within the EU or the EEA is in- compatible with other EU regulations in the area and with ’s commitments under the Data Protection Convention. Against this backdrop, our assessment is that no general prohibition should be introduced against data that is retained under Swedish data retention rules being transferred to a third country for storage there. Collection of subscription data One of the deficiencies in the Data Retention Directive that the Court of pointed out in its judgment was that the Directive did not give any objective criteria for limiting the access of the national authorities to the retained data or their use of that data. The Court also noted that the Directive did not require that access to data was made dependent on a prior review carried out by a court or by an independent body tasked with ensuring that access is limited to what is strictly necessary. Subscription data retained under the Swedish data retention rules may be released to law enforcement authorities without any require- ment that the crime for which the data are released is of any particular degree of severity. Moreover, data may be collected following a decision of the law enforcement authority, without prior control by an independent body. Against this backdrop, we have considered several different measures that could contribute to strengthening controls over the application by the law enforcement authorities of the rules on collecting subscription data. For example, we have considered whether a supervisory body ought to be instructed to exercise supervision specifically focused on the application of these rules. However, our assessment is that the disadvantages of such a system outweigh the advantages. On the other hand, we propose that the authority to make decisions on collecting subscription data should be limited to certain specially designated officials at the authority requesting the data. In addition, we propose that decisions on collecting such data should be documented in a certain . The Inquiry considers that these measures could contribute to higher quality in the decision-making process and to more effective supervision by the Parliamentary Ombudsmen, the Chancellor of , and the Swedish Commission on Security and Integrity Protection. We also present proposals on certain clarifica- tions in the provision on collecting subscription data. The purpose of this will be to make it clear that the provision can be applied in the law enforcement authorities’ intelligence activities. Information covered by professional confidentiality In its judgment, the Court of underlined that one of the deficiencies of the Data Retention Directive was that it did not contain any exceptions to the data retention requirement, which meant that it applied even to persons whose communications are subject to confidentiality under national law. We have therefore considered whether a prohibition should be introduced against collecting data concerning communications with persons subject to professional confidentiality. However, in Swedish law it is normally the contents of the data that determine whether it is subject to confidentiality. When collecting metadata, the authority collecting the data normally has no knowledge of the contents of the communications. Our assessment is therefore that a prohibition of this kind would be very difficult to apply. Moreover, in our view, it would have very practical significance. This is because the principle of proportionality normally prevents data being collected if the authorities, by way of exception, should be aware in advance that the communications are subject to confidentiality. On the other hand, we propose the introduction of rules requiring the data concerning such communications to be destroyed in cases where the authorities later learn that the communications are subject to such confidentiality. Part of our remit was to survey the application of the Data Collection Act until now. The method that we chose to investigate this issue was an in-depth examination of a sample of intelligence cases in which the Data Collection Act had been applied by the Authority, the or Swedish Customs. In connection with the investigation, in each of the cases selected, the Inquiry studied the decision taken in the cases under the Data Collection Act and background written material. After that, a representative of the Inquiry interviewed the case officer responsible for the case. The purpose was to gain an in-depth understanding of the issues of benefit, need and interference in privacy. The results of the survey are presented in detail in the report and were an important part of the material on which we based our analysis, assessments and proposals concerning the Data Collection Act. We found that the way in which the law enforcement authorities process cases under the Data Collection Act is essentially satisfactory. We also found that the Act is an important tool in the authorities’ intelligence activities. In the vast majority of cases, the Act is applied so as to give the authorities access to relevant information that helps to advance the intelligence cases. There are therefore grounds for concluding that the Act is of con- siderable benefit for intelligence activities. However, it also leads to interference in the privacy of both the individuals concerned in the cases and those with whom they have been in contact. Decision-making procedure in the Data Collection Act The Court of pointed out in the data retention judgment that the Directive did not prescribe that the access of the competent national authorities to retained data should be subject to prior review carried out by a court or an independent authority. Therefore, and in accordance with our terms of reference, we have considered whether a general court should be entrusted with taking decisions on collecting data. However, we have found that matters concerning the collection of data in intelligence activities are not particularly well-suited for review by a general court. The purpose of intelligence activities, which are separate from and precede a preliminary investigation, is to obtain material for processing and analysis through a broad collection of information and knowledge. The basic purpose of intelligence activities is to study and identify potential criminal activities in order to prevent the crime from being carried out. These activities are often part of a more wide- ranging approach. Since the activities, unlike a preliminary investi- gation, do not focus on any specific criminal act – and often not on any specifically identified person either – the interest of the parties does not play the same kind of role in intelligence activities as in a preliminary investigation. Consequently, in the intelligence phase the privacy aspect is characterised more by the perspective of citizens’ interests than by the type of two party procedure that is well- suited for review by a general court. There is also reason to doubt whether the courts would be able to satisfy the need for speedy decisions. We have also considered whether the decision-making powers under the Data Collection Act should be entrusted to a prosecutor or a new decision-making body, such as a special board. These options have the same weaknesses as a court review. There are also other disadvantages. In our assessment, for example, giving pro- secutors the task of taking decisions to order collection of data would be difficult to reconcile with the role prosecutors have in the criminal law system. Given that the current decision-making procedure works well, our assessment is therefore that decisions under the Data Collection Act should be taken by the law enforce- ment authorities. Measures within the framework of existing decision-making procedures We have also considered certain measures that could be taken within the framework of existing decision-making procedures and that could contribute to strengthening controls over the application of these procedures. Among other things, we have considered whether it is possible to tighten up the possibility of delegating decision-making powers within the decision-making authority. However, we have found that the current provision on delegation is formulated as strictly as can reasonably be demanded. We there- fore do not propose any changes in this provision. Both the Authority and Swedish Customs now have centrally placed units that have a broad responsibility for creating standard guidelines for processing cases under the Data Collection Act and following up how these activities are managed within the authority. We consider that this is highly likely to help raise and guarantee the quality of the decision making process at these authorities. Furthermore, both the Authority and the Swedish Customs are now developing new systems for delegating decision- making powers under the Act. We believe we can assume that in this process, the authorities will ensure that decisions are taken at a sufficiently high level to guarantee a decision-making procedure that meets high standards of competence and legal certainty. We have also considered whether it would be possible to take any measure or measures to improve the conditions for supervision by the Swedish Commission on Security and Integrity Protection. Our conclusion is that it should be prescribed that the authorities’ obligation to inform the Commission of decisions taken under the Data Collection Act should be met by the authority concerned submitting the actual decision to the Commission. On the other hand, we do not consider it would be appropriate to change the requirements concerning the information the decisions must contain. We also do not consider it necessary to change the requirements concerning documentation in cases under the Data Collection Act. The reason for this is that it has emerged that the grounds for data collection decisions are generally documented in the cases and are therefore available to the Commission. Finally, we have also considered whether there is reason to increase the possibilities for telecommunications operators to provide information to the Commission concerning the enforcement of decisions under the Data Collection Act. However, in our assess- ment, such a possibility would not lead to any improvement in the conditions for supervision by the Commission. The need of the for special powers to collect information about certain criminal activities According to the general rule in the Data Collection Act, data may be collected if the circumstances are such that the measure is of particular importance for preventing or detecting criminal activities that include crimes for which the law does not envisage a more lenient sentence than imprisonment for two years. The Act also contains a special time-limited provision allowing data to be collected concerning criminal activities that include certain crimes with lower minimum sentences than imprisonment for two years (Section 3). The crimes covered by this provision are the types of criminal activity that pose a threat to society and that are targeted by the . Part of our remit has been to analyse the extent to which the needs such an option and to present proposals on how this need should be met while striking a balance with the interests of privacy. It has emerged from our review that the way in which the Data Collection Act has been applied has led to considerable benefits in connection with intelligence activities relating to criminal activities that include several of the crimes that are now covered by this section of the law. In our opinion, the possibility of collecting data concerning criminal activities that include these crimes should therefore be retained and should have permanent application in the future. Moreover, it has emerged that the has a great need to be able to collect data concerning criminal activities that include state-sponsored industrial espionage and gross assault and unlawful deprivation of committed with the intention of influencing public bodies or a person professionally engaged in news coverage or other journalism to take or refrain from taking a measure or to take revenge for a measure (‘system-threatening crime’). We therefore propose that the possibility of collecting data should also extend to these crimes. lag om ändring i Härigenom föreskrivs att 27 kap. 22 § ska ha följande lydelse. Hemlig avlyssning av elektronisk kommunikation får inte avse telefonsamtal eller andra meddelanden där någon som yttrar sig, på grund av bestämmelserna i 36 kap. 5 § andra–sjätte styckena, inte skulle ha kunnat höras som vittne om det som har sagts eller på annat sätt kommit fram. Om det under avlyssningen kommer fram att det är fråga om ett sådant samtal eller meddelande, ska avlyss- ningen avbrytas. Hemlig rumsavlyssning får inte avse samtal eller annat tal där någon som angetts i första stycket talar. Om det under rumsavlyss- ningen kommer fram att det är fråga om ett sådant samtal eller tal, ska avlyssningen avbrytas. Upptagningar och uppteckningar ska förstöras i de delar som de omfattas av förbud enligt första eller andra stycket. övervakning av elektronisk kom- munikation ska för- störas i de delar innehållet avser uppgifter som, på grund av be- 1 Senaste lydelse 2014:1419. stämmelserna i 36 kap. 5 § andra– sjätte styckena, inte skulle ha kunnat inhämtas genom vittnes- förhör i domstol. Denna lag träder i kraft . lag om ändring i lagen (2003:389) om elektronisk kommunikation Härigenom föreskrivs att 6 kap. 22 § lagen (2003:389) om elektro- nisk kommunikation ska ha följande lydelse. Nuvarande lydelse Föreslagen lydelse Den som tillhandahåller ett elektroniskt kommunikationsnät eller en elektronisk kommunikationstjänst och därvid har fått del av eller tillgång till uppgift som avses i 20 § första stycket ska på begäran lämna 1. uppgift som avses i 20 § första stycket 1 till en myndighet som i ett särskilt fall behöver en sådan uppgift för delgivning enligt delgivningslagen (2010:1932), om myndigheten finner att det kan antas att den som söks för delgivning håller sig undan eller att det annars finns synnerliga skäl, 2. uppgift som avses i 20 § 2. uppgift som avses i 20 § första stycket 1 och som gäller första stycket 1 och som gäller misstanke om brott till en åkla- misstanke om brott eller brottslig verksamhet till en åklagarmyn- en, Säkerhetspolisen eller någon dighet, , Säker- annan myndighet som ska in- hetspolisen eller någon annan gripa mot brottet, myndighet som ska ingripa mot brottet eller den brottsliga verk- 3. uppgift som avses i 20 § första stycket 1 och 3 samt uppgift om i vilket geografiskt område en viss elektronisk kommunika- tionsutrustning finns eller har funnits till , om myndigheten finner att uppgiften behövs i samband med efter- forskning av personer som har försvunnit under sådana omständig- heter att det kan befaras att det finns fara för deras liv eller allvarlig risk för deras hälsa, 2 Senaste lydelse 2014:734. 4.uppgift som avses i 20 § första stycket 1 till Kronofogde- myndigheten om myndigheten behöver uppgiften i exekutiv verk- samhet och myndigheten finner att uppgiften är av väsentlig bety- delse för handläggningen av ett ärende, 5.uppgift som avses i 20 § första stycket 1 till , om verket finner att uppgiften är av väsentlig betydelse för handlägg- ningen av ett ärende som avser kontroll av skatt eller avgift eller rätt folkbokföringsort enligt folkbokföringslagen (1991:481), 6.uppgift som avses i 20 § första stycket 1 till , om myndigheten finner att uppgiften behövs i samband med under- rättelse, efterforskning eller identifiering vid olyckor eller dödsfall eller för att myndigheten ska kunna fullgöra en uppgift som avses i 12 § polislagen (1984:387),