GRAND CHAMBER
CASE OF CENTRUM FÖR RÄTTVISA v. SWEDEN
(Application no. 35252/08)
 
 
JUDGMENT
 
Art 8 • Private life • Convention compliance of secret surveillance regime including bulk interception of communications and intelligence sharing • Need to develop case-law in light of important differences between targeted interception and bulk interception • Adapted test for examining bulk interception regimes through global assessment • Focus on “end-to-end safeguards” to take into account the increasing degree of intrusion with privacy rights as the bulk interception process moves through different stages • Shortcomings through: absence of clear rule on destroying intercepted material not containing personal data; absence of a requirement to consider privacy of individuals when deciding whether to transmit intelligence material to foreign partners; dual role of Foreign Intelligence Inspectorate and absence of reasoned decisions in ex post facto control, not sufficiently compensated by safeguards 
 
STRASBOURG
25 May 2021
 
This judgment is final but it may be subject to editorial revision. In the case of Centrum för rättvisa v. Sweden,
The European Court of Human Rights, sitting as a Grand Chamber composed of:
 Robert Spano, President,
 Jon Fridrik Kjølbro,
 Angelika Nußberger,
 Paul Lemmens,
 Yonko Grozev,
 Vincent A. De Gaetano,
 Paulo Pinto de Albuquerque,
 Faris Vehabović,
 Iulia Antoanella Motoc,
 Carlo Ranzoni,
 Mārtiņš Mits,
 Gabriele Kucsko-Stadlmayer,
 Marko Bošnjak,
 Tim Eicke,
 Darian Pavli,
 Erik Wennerström,
 Saadet Yüksel, judges,
and Søren Prebensen, Deputy Grand Chamber Registrar,
Having deliberated in private on 11 July, 4 and 6 September 2019 and on 17 February 2021,
Delivers the following judgment, which was adopted on the last-mentioned date:
PROCEDURE
1. The case originated in an application (no. 35252/08) against the Kingdom of Sweden lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by a Swedish foundation, Centrum för rättvisa (“the applicant”), on 14 July 2008. 2. The applicant was represented by Mr F. Bergman and Ms A. Evans, lawyers practising in Stockholm. The Swedish Government (“the Government”) were represented by their Agent, Ms E. Hammarskjöld, Director General for Legal Affairs, Ministry for Foreign Affairs. 3. The applicant alleged that the Swedish legislation and practice in the field of signals intelligence violated its rights under Article 8 of the Convention and that it did not have an effective remedy in this regard, contrary to Article 13 of the Convention. 4. The application was allocated to the Third Section of the Court (Rule 52 § 1 of the Rules of Court). On 1 November 2011 (admissibility) and 14 October 2014 (admissibility and merits) the application was communicated to the respondent Government. On 19 June 2018 a Chamber of that Section, composed of Branko Lubarda, President, Helena Jäderblom, Helen Keller, Pere Pastor Vilanova, Alena Poláčková, Georgios A. Serghides, Jolien Schukking, judges, and Stephen Phillips, Section Registrar, gave judgment. The Chamber unanimously declared the application admissible and held that there had been no violation of Article 8 of the Convention and that there was no need to examine separately the complaint under Article 13. 5. On 19 September 2018 the applicant requested the referral of the case to the Grand Chamber in accordance with Article 43 of the Convention. On 4 February 2019 the panel of the Grand Chamber granted that request. 6. The composition of the Grand Chamber was determined according to the provisions of Article 26 §§ 4 and 5 of the Convention and Rule 24. The President of the Grand Chamber decided that in the interests of the proper administration of justice, the case should be assigned to the same Grand Chamber as the case of Big Brother Watch and Others v. the United Kingdom (nos. 58170/13 and 2 others) (Rules 24, 42 § 2 and 71). 7. The applicant and the Government each filed observations (Rule 59 § 1) on the merits of the case. 8. The President of the Grand Chamber granted leave to the Governments of Estonia, France, the Netherlands and Norway to intervene in the written procedure, in accordance with Article 36 § 2 of the Convention and Rule 44 § 3. 9. A hearing took place in public in the Human Rights Building, Strasbourg, on 10 July 2019. There appeared before the Court:
(a)  for the respondent Government
Mrs E. Hammarskjöld, Director General for Legal Affairs, Ministry for Foreign Affairs,              Agent,
Mrs G. Isaksson, Deputy Director, Ministry for Foreign Affairs,
Mrs J. Sjöstrand, Senior Legal Adviser, Ministry for Foreign Affairs,
Mr J.Garton, Deputy Director-General, Ministry of Defence,
Mr M. Andersson, Senior Legal Adviser, Ministry of Defence
Mr H. Sellman, Deputy Director, Ministry of Justice,
Ms F. Krzyzanski, Legal Adviser, Ministry of Infrastructure,
Ms M. Dráb, Chief Legal Adviser, National Defence Radio Establishment,
Mr C. Hellsten, Senior Adviser, National Defence Radio Establishment,              Advisers. (b)  for the applicant
Mr F. Bergman, Counsel,
Mrs A. Evans, Counsel,
Mr A. Ottosson, Counsel,
Mrs E. Palm,  Adviser. The Court heard addresses by Ms Evans, Mr Bergman and Ms Hammarskjöld. THE FACTS
10. The applicant, Centrum för rättvisa, is a foundation established in 2002. It has its headquarters in Stockholm. 11. The applicant represents clients in proceedings concerning rights and freedoms under the Convention or related proceedings under Swedish law. It is also involved in education and research projects and participates in the general public debate on issues concerning individuals’ rights and freedoms. 12. The applicant communicates on a daily basis with individuals, organisations and companies in Sweden and abroad by email, telephone and fax. It asserts that a large part of that communication is particularly sensitive from a privacy perspective. Due to the nature of its function as a non-governmental organisation scrutinising the activities of State actors, it believes that there is a risk that its communications have been or will be intercepted and examined by way of signals intelligence. 13. The applicant has not brought any domestic proceedings, contending that there is no effective remedy for its Convention complaints. RELEVANT LEGAL FRAMEWORK AND PRACTICE
DOMESTIC LAW AND PRACTICEGenerally on signals intelligence

14. Signals intelligence can be defined as intercepting, processing, analysing and reporting intelligence from electronic signals. These signals may be processed to text, images and sound. The intelligence collected through these procedures may concern both the content of a communication and its related communications data (the data describing, for instance, how, when and between which addresses the electronic communication is conducted). The intelligence may be intercepted over the airways – usually from radio links and satellites – and from cables. Whether a signal is transmitted over the airways or through cables is controlled by the communications service providers, that is, the telecom, internet, cable and other such companies which provide various forms of electronic transfer of information. A great majority of the traffic relevant for signals intelligence is cable-based. The term “communications bearers” (or “signal carriers”) refers to the medium used for transmitting one or more signals. Unless indicated below, the regulation of Swedish signals intelligence does not distinguish between the content of communications and their communications data or between airborne and cable-based traffic. 15. Foreign intelligence is, according to the Foreign Intelligence Act (Lagen om försvarsunderrättelseverksamhet; 2000:130), conducted in support of Swedish foreign, defence and security policy, and in order to identify external threats to the country. The activities should also assist in Sweden’s participation in international security cooperation. Intelligence under the Act may only be conducted in relation to foreign circumstances (section 1(1)). This does not preclude that some of the foreign circumstances may have ramifications in Sweden, for example, when following the espionage operations of a foreign power targeting Sweden (preparatory works to amended legislation on foreign intelligence, prop. 2006/07:63, p. 43). 16. The Government determines the direction of the activities; it also decides which authorities may issue more detailed directives and which authority is to conduct the intelligence activities (section 1(2) and 1(3)). The Government issues general tasking directives annually. Foreign intelligence may not be conducted for the purpose of solving tasks in the area of law enforcement or crime prevention, which come under the mandate of the Police Authority, the Security Police and other authorities and which are regulated by different legislation. However, authorities that conduct foreign intelligence may support authorities dealing with law enforcement or crime prevention (section 4). Examples of such support are cryptanalysis and technical help on information security (preparatory works to amended legislation on foreign intelligence, prop. 2006/07:63, p. 136). 17. The collection of electronic signals is one form of foreign intelligence. It is regulated by the Signals Intelligence Act (Lagen om signalspaning i försvarsunderrättelseverksamhet; 2008:717), which entered into force on 1 January 2009. Several amendments were made to the Act on 1 December 2009, 1 January 2013, 1 January 2015 and 15 July 2016. Supplementary provisions are found in the Signals Intelligence Ordinance (Förordningen om signalspaning i försvarsunderrättelseverksamhet; 2008:923). The legislation authorises the National Defence Radio Establishment (Försvarets radioanstalt; henceforth “the FRA”) to conduct signals intelligence (section 2 of the Ordinance compared to section 1 of the Act). 18. During signals intelligence all cable-based cross-border communications are transferred to certain points of collection. No information is stored at these points and a limited amount of data traffic is transferred to the FRA by communications bearers (parliamentary committee report SOU 2016:45, p. 107). 19. The FRA may conduct signals intelligence within the area of foreign intelligence only as a result of a detailed tasking directive issued by the Government, the Government Offices, the Armed Forces or, as from January 2013, the Security Police and the National Operative Department of the Police Authority (Nationella operativa avdelningen i Polismyndigheten; hereafter “NOA”) (sections 1(1) and 4(1) of the Act) in accordance with the issuer’s precise intelligence requirements. However, the direction of the FRA’s “development activities” may be determined solely by the Government (section 4(2)). A detailed tasking directive determines the direction of the intelligence activities and may concern a certain phenomenon or situation, but it may not solely target a specific natural person (section 4(3)). 20. The mandate of the Security Police and the NOA to issue detailed tasking directives aims to improve these authorities’ ability to obtain data about foreign circumstances at a strategic level concerning international terrorism and other serious international crime that may threaten essential national interests. At the time of introduction of the new rules, the Government stated in the preparatory works (prop. 2011/12:179, p. 19) that the mandate is in accordance with the prohibition on conducting signals intelligence for the purpose of solving tasks in the area of law enforcement or crime prevention. 21. According to the Foreign Intelligence Ordinance (Förordningen om försvarsunderrättelseverksamhet; 2000:131), a detailed tasking directive shall include information about (i) the issuing authority, (ii) the part of the Government’s annual tasking directive it concerns, (iii) the phenomenon or situation intended to be covered, and (iv) the need for intelligence on that phenomenon or situation (section 2a). B. Scope of application of signals intelligence
22. The purposes for which electronic signals may be collected as part of foreign intelligence are specified in the Signals Intelligence Act (section 1 (2)) which provides that signals intelligence may be conducted only to survey:
1. external military threats to the country;
2. conditions for Swedish participation in international peacekeeping or humanitarian missions or threats to the safety of Swedish interests in the performance of such operations;
3. strategic circumstances concerning international terrorism or other serious cross-border crime that may threaten essential national interests;
4. the development and proliferation of weapons of mass destruction, military equipment and other similar specified products;
5. serious external threats to society’s infrastructure;
6. foreign conflicts with consequences for international security;
7. foreign intelligence operations against Swedish interests; and
8. the actions or intentions of a foreign power that are of substantial importance for Swedish foreign, security or defence policy. 23. These eight purposes are further elaborated upon in the preparatory works to the legislation (prop. 2008/09:201, pp. 108-109):
“The purposes for which permits to conduct signals intelligence may be granted are listed in eight points. The first point concerns external military threats to the country. Military threats include not only imminent threats, such as threats of invasion, but also phenomena that may in the long term develop into security threats. Consequently, the wording covers the surveying of military capabilities and capacities in our vicinity. The second point comprises both surveying necessary to provide an adequate basis for a decision whether to participate in international peacekeeping or humanitarian missions and surveying performed during ongoing missions concerning threats to Swedish personnel or other Swedish interests. The third point refers to strategic surveying of international terrorism or other serious cross-border crime, such as drug or human trafficking of such severity that it may threaten significant national interests. The task of signals intelligence in relation to such activities is to survey them from a foreign and security policy perspective; the intelligence needed to combat the criminal activity operatively is primarily the responsibility of the police. The fourth point addresses the need to use signals intelligence to follow, among other things, activities relevant to Sweden’s commitments in regard to non-proliferation and export control, even in cases where the activity does not constitute a crime or contravenes international conventions. The fifth point includes, among other things, serious IT-related threats emanating from abroad. That the threats should be of a serious nature means that they, for example, should be directed towards vital societal systems for energy and water supply, communication or monetary services. The sixth point refers to the surveying of such conflicts between and in other countries that may have consequences for international security. It may concern regular acts of war between States but also internal or cross-border conflicts between different ethnic, religious or political groups. The surveying of the conflicts includes examining their causes and consequences. The seventh point signifies that intelligence activities conducted against Swedish interests can be surveyed through signals intelligence. The eighth point provides the opportunity to conduct signals intelligence against foreign powers and their representatives in order to survey their intentions or actions that are of substantial importance to Swedish foreign, security or defence policy. Such activities may relate only to those who represent a foreign power. Through the condition “substantial importance” it is emphasised that it is not sufficient that the phenomenon is of general interest but that the intelligence should have a direct impact on Swedish actions or positions in various foreign, security or defence policy matters. ...”
24. The FRA may collect electronic signals also in order to monitor changes in the international signals environment, technical advances and signals protection and to develop the technology needed for signals intelligence (section 1(3)). This is regarded as “development activities” and, according to the relevant preparatory works (prop. 2006/07:63, p. 72), they do not generate any intelligence reports. Signals intercepted in the context of the FRA’s development activities do not interest the authorities for the data they might contain but only for the possibility to analyse the systems and routes through which information is transmitted. The FRA may share experiences gained on technological issues with other authorities. Development activities usually do not focus on communications between individuals, although information on individuals’ identities may be intercepted. 25. Signals intelligence conducted on cables may only concern signals crossing the Swedish border in cables owned by a communications service provider (section 2). Communications between a sender and receiver within Sweden may not be intercepted, regardless of whether the source is airborne or cable-based. If such signals cannot be separated at the point of collection, the recording of or notes about them shall be destroyed as soon as it becomes clear that such signals have been collected (section 2a). 26. Interception of cable-based signals is automated and must only concern signals that have been identified through the use of selectors (or “search terms”). Such selectors are also used to identify signals over the airways, if the procedure is automated. The selectors must be formulated in such a way that the interference with personal integrity is limited as far as possible. Selectors directly relating to a specific natural person may only be used if this is of exceptional importance for the intelligence activities (section 3). 27. The preparatory works to the Signals Intelligence Act (prop. 2006/07:63, p. 90) clarify that the exceptional importance requirement under section 3 is needed in view of the fact that the use of search terms that are attributable to a particular individual, such as personal names, telephone numbers, email or IP addresses, involves special risks from a privacy protection perspective. The use of such search terms should only be considered under special conditions and should be preceded by a thorough necessity assessment, notably, as to whether the information which can thereby be obtained is of such importance that it justifies the measure. As an example, the text refers to the following hypothetical situation: a national crisis caused by an IT attack against systems of crucial importance to society where immediate action needs to be taken to identify the individual actors. 28. After the signals have been intercepted they are processed, which means that they are, for example, subjected to cryptanalysis or translation. Then the information is analysed and reported to the authority that gave the FRA the mission to collect the intelligence in question. 29. The process has been described by the respondent Government as comprising six stages, as follows:
1. a choice is made of segments of the signals intelligence environment that are most relevant;
2. selectors are applied automatically to signals in the chosen segments in order to intercept and gradually reduce what is collected;
3. the data is further processed through automatic and manual means using, among others, cryptoanalysis, structuring and language translation;
4. the processed information is analysed by an analyst in order to identify intelligence within;
5. a report is written and disseminated to selected recipients of foreign intelligence; and
6. feedback on the use and effects of the intelligence provided is requested and shared with those involved in the process. C. Authorisation of signals intelligence
30. For all signals intelligence, including the development activities, the FRA must apply for a permit to the Foreign Intelligence Court (Försvarsunderrättelsedomstolen). The application shall contain the mission request that the FRA has received, with information on the relevant detailed tasking directive and the need for the intelligence sought. Also, the communications bearers to which the FRA requires access have to be specified, along with the selectors or categories of selectors that will be used. Finally, the application must state the duration for which the permit is requested (section 4a). 31. A permit may only be granted if the mission is in accordance with the provisions of the Foreign Intelligence Act and the Signals Intelligence Act, if the purpose of the interception of signals cannot be met in a less interfering manner, if the mission can be expected to yield information whose value is clearly greater than the possible interference with personal integrity, if the selectors or categories of selectors are in accordance with the Signals Intelligence Act and if the application does not concern solely a specific natural person (section 5). 32. If granted, the permit shall specify the mission for which signals intelligence may be conducted, the bearers to which the FRA will have access, the selectors or categories of selectors that may be used, the duration of the permit and other conditions necessary to limit the interference with personal integrity (section 5a). 33. The FRA itself may decide to grant a permit, if the application for a permit from the Foreign Intelligence Court might cause delay or other inconveniences of essential importance for one of the specified purposes of the signals intelligence. If the FRA grants a permit, it has to report to the court immediately and the court shall without delay decide in the matter. The court may revoke or amend the permit (section 5b). 34. The composition of the Foreign Intelligence Court and its activities are regulated by the Foreign Intelligence Court Act (Lagen om Försvarsunderrättelsedomstol; 2009:966). The court consists of one president, one or two vice-presidents and two to six other members. The president is a permanent judge, nominated by the Judges Proposals Board (Domarnämnden) and appointed by the Government. The vice-presidents, who must be legally trained and have previous experience as judges, and the other members, who are required to have special expertise of relevance for the court’s work, are appointed by the Government on four-year terms. The applications for signals intelligence permits are discussed during hearings, which may be held behind closed doors, if it is clear that information classified as secret would be exposed as a result of a public hearing. During the court’s examination, the FRA as well as a privacy protection representative (integritetsskyddsombud) are present. The representative, who does not represent any particular person but the interests of individuals in general, monitors integrity issues and has access to the case file and may make statements. Privacy protection representatives are appointed by the Government for a period of four years and must be or have been permanent judges or attorneys. The court may hold a hearing and decide on an application without the presence of a representative only if the case is of such urgency that a delay would severely compromise the purpose of the application. The court’s decisions are final. D. The duration of signals intelligence
35. A permit may be granted for a specific period of time, maximum six months. An extension may, after a renewed examination, be granted for six months at a time (Signals Intelligence Act, section 5a). E. Procedures to be followed for storing, accessing, examining, using and destroying the intercepted data
36. The Foreign Intelligence Inspectorate (Statens inspektion för försvarsunderrättelseverksamheten (SIUN); see further paragraphs 50-54 below) oversees access to the communications bearers. Communications service providers are obliged to transfer cable-based signals crossing the Swedish borders to “collaboration points” agreed upon with the Inspectorate. The Inspectorate, in turn, provides the FRA with access to bearers in so far as such access is covered by a signals intelligence permit and, in so doing, implements the permits issued by the Foreign Intelligence Court (Chapter 6, section 19a of the Electronic Communications Act (Lagen om elektronisk kommunikation; 2003:389)). The Council on Legislation (Lagrådet), the body giving opinions on request by the Government or a Parliamentary committee on certain draft bills, has expressed the view that an interference with private life and correspondence already arises at this point, because of the State obtaining access to the telecommunications (prop. 2006/07:63, p. 172). 37. According to the Signals Intelligence Act, intercepted data must be destroyed immediately by the FRA if it (i) concerns a specific natural person and lacks importance for the signals intelligence, (ii) is protected by constitutional provisions on secrecy for the protection of anonymous authors and media sources, (iii) contains information shared between a suspect and his or her legal counsel and is thus protected by attorney-client privilege, or (iv) involves information given in a religious context of confession or individual counselling, unless there are exceptional reasons for examining the information (section 7). 38. If communications have been intercepted between a sender and receiver who are both in Sweden, despite the prohibition on such interception, they shall be destroyed as soon as the domestic nature of the communications has become evident (section 2a). 39. If a permit urgently granted by the FRA (see paragraph 21 above) is revoked or amended by the Foreign Intelligence Court, all intelligence collected which is thereby no longer authorised must be immediately destroyed (section 5b(3)). 40. The FRA Personal Data Processing Act (Lagen om behandling av personuppgifter i Försvarets radioanstalts försvarsunderrättelse- och utvecklingsverksamhet; 2007:259) contains provisions on the treatment of personal data within the area of signals intelligence. The Act entered into force on 1 July 2007, with amendments effective from 30 June 2009, 15 February 2010 and 1 March 2018. The purpose of the Act is to protect against violations of personal integrity (Chapter 1, section 2). The FRA shall ensure, inter alia, that personal data is collected only for certain expressly stated and justified purposes. Such purpose is either determined by the direction of the foreign intelligence activities through a detailed tasking directive or by what is necessary in order to follow changes in the signals environment, technical advances and signals protection. Also, the personal data treated has to be adequate and relevant in relation to the purpose of the treatment. No more personal data than what is necessary for that purpose may be processed. All reasonable efforts have to be made to correct, block and obliterate personal data that is incorrect or incomplete (Chapter 1, sections 6, 8 and 9). 41. Personal data may not be processed solely because of what is known of a person’s race or ethnicity, political, religious or philosophical views, membership of a union, health or sexual life. If, however, personal data is treated for a different reason, this type of information may be used if it is absolutely necessary for the treatment. Information about a person’s physical appearance must always be formulated in an objective way with respect for human dignity. Intelligence searches may only use the above-mentioned personal indicators as selectors if this is absolutely necessary for the purpose of the search (Chapter 1, section 11). 42. Personnel at the FRA who process personal data go through an official security clearance procedure and are subject to confidentiality with regard to data to which secrecy applies. They could face criminal sanctions if tasks relating to the processing of personal data are mismanaged (Chapter 6, section 2). 43. Personal data that has been subjected to automated processing is to be destroyed as soon as it is no longer needed (Chapter 6, section 1). 44. Further provisions on the treatment of personal data are laid down in the FRA Personal Data Processing Ordinance (Förordningen om behandling av personuppgifter i Försvarets radioanstalts försvars­underrättelse- och utvecklingsverksamhet; 2007:261). It provides, inter alia, that the FRA may keep databases for raw material containing personal data. Raw material is unprocessed information which has been collected through automated treatment. Personal data in such databases shall be destroyed within one year from when it was collected (section 2). F. Conditions for communicating the intercepted data to other parties
45. The intelligence collected is to be reported to the authorities concerned, as determined under the Foreign Intelligence Act (Signals Intelligence Act, section 8). 46. The Government Offices, the Armed Forces, the Security Police, the NOA, the Inspectorate of Strategic Products (Inspektionen för strategiska produkter), the Defence Material Administration (Försvarets materialverk), the Defence Research Agency (Totalförsvarets forskningsinstitut), the Civil Contingencies Agency (Myndigheten för samhällsskydd och beredskap) and the Swedish Customs (Tullverket) may have direct access to completed intelligence reports to the extent the FRA so decides (section 9 of the FRA Personal Data Processing Ordinance). However, to date, no decisions permitting direct access have been taken by the FRA. 47. The FRA may also grant the Security Police and the Armed Forces direct access to data which constitute analysis results in a data collection for analyses and which is needed for the authorities to be able to make strategic assessments of the terrorist threat against Sweden and Swedish interests (Chapter 1, section 15 of the FRA Personal Data Processing Act, and section 13a of the Ordinance). 48. According to the preparatory works (prop 2017/18:36), the above-mentioned access is given within the framework of cooperation between the FRA, the Security Police and the Armed Forces in a working group called the National Centre for Assessment of Terrorist Threats (Nationellt centrum för terrorhotbedömning; “NCT”) where a number of analysts from the three authorities work together and write reports containing strategic assessments of terrorist threats. With the FRA’s permission and as long as the data is relevant for such terrorist threat assessments, the NCT analysts have direct access to “analysis results” contained in the FRA databases. The analysts do not, however, have direct access to the FRA’s databases to conduct their own free searches. Furthermore, while the information made available to the analysts through direct access may contain personal data, the assessments made by the NCT are of a strategic, general nature and are not, as such, directed at individual persons. 49. Personal data may be communicated to other States or international organisations only if this is not prevented by secrecy and if necessary for the FRA to perform its activities within international defence and security cooperation. The Government may adopt rules or decide in a specific case to allow such communication of personal data also in other cases, where necessary for the activities of the FRA (Chapter 1, section 17 of the FRA Personal Data Processing Act). The FRA may disclose personal data to a foreign authority or an international organisation if it is beneficial for the Swedish government (statsledningen) or Sweden’s comprehensive defence strategy (totalförsvaret); information so communicated must not harm Swedish interests (section 7 of the FRA Personal Data Processing Ordinance). G. Supervision of the implementation of signals intelligence
50. The Foreign Intelligence Act (section 5) and the Signals Intelligence Act (section 10) provide that an authority is to oversee the foreign intelligence activities in Sweden and verify that the FRA’s activities are in compliance with the provisions of the Signals Intelligence Act. The supervisory authority – the Foreign Intelligence Inspectorate – is, among other things, tasked with monitoring the implementation of the Foreign Intelligence Act and the associated Ordinance and reviewing whether foreign intelligence activities are performed in compliance with the applicable directives (section 4 of the Foreign Intelligence Inspectorate Instructions Ordinance (Förordningen med instruktion för Statens inspektion för försvarsunderrättelseverksamheten; 2009:969)). It also reviews compliance with the Signals Intelligence Act by examining in particular the selectors used, the destruction of intelligence and the communication of reports; if an inspection reveals that a particular intelligence collection is incompatible with a permit, the Inspectorate may decide that the operation shall cease or that the intelligence shall be destroyed (section 10 of the Signals Intelligence Act). The FRA shall report to the Inspectorate the selectors which directly relate to a specific natural person (section 3 of the Signals Intelligence Ordinance). 51. The Foreign Intelligence Inspectorate is led by a board whose members are appointed by the Government for terms of at least four years. The president and the vice-president shall be or have been permanent judges. Other members are selected from candidates proposed by the party groups in the Parliament (section 10 (3) of the Signals Intelligence Act). 52. Any opinions or suggestions for measures arising from the Inspectorate’s inspections shall be forwarded to the FRA, and if necessary also to the Government. The Inspectorate also submits annual reports on its inspections to the Government (section 5 of the Foreign Intelligence Inspectorate Instructions Ordinance), which are made available to the public. Furthermore, if the Inspectorate notices potential crimes, it shall report the matter to the Prosecution Authority (Åklagarmyndigheten), and, if deficiencies are discovered that may incur liability for damages for the State, a report shall be submitted to the Chancellor of Justice (Justitiekanslern). A report may also be submitted to the Data Protection Authority (Datainspektionen), which is the supervisory authority on the treatment of personal data by the FRA (section 15). 53. From the establishment of the Inspectorate in 2009 until 2017 the Inspectorate conducted 102 inspections in total. Those resulted in 15 opinions submitted to the FRA and one to the Government. No inspections have revealed reasons to cease an intelligence collection or to destroy the results. According to the Inspectorate’s annual reports, which contain brief descriptions of the inspections, those have included numerous detailed examinations of the selectors used, the destruction of intelligence, the communication of reports, the treatment of personal data and the overall compliance with the legislation, directives and permits relevant to the signals intelligence activities. For instance, between 2010 and 2014 the use of selectors was inspected on seventeen occasions, which led to one opinion and a proposal for changes to the FRA’s processing routines. During the same period the destruction of data related to signals intelligence was audited on nine occasions. Those also resulted in one opinion, in 2011, inviting the FRA to amend its internal regulations, which it did the same year. During 2011 the Inspectorate also verified whether the FRA was conducting data collection for other countries in accordance with the law, which did not lead to any opinion being issued. An inspection in 2014 concerned a general review of the FRA’s cooperation with other States and international organisations in intelligence matters. It did not give rise to any opinion or suggestion to the FRA. In 2015 and 2016 an overall review to assess compliance with the limitations stated in permits issued by the Foreign Intelligence Court resulted in one observation. In 2016 and 2017 the Inspectorate carried out a detailed inspection of the treatment by the FRA of personal data. The inspection concerned the processing of sensitive personal data in connection with strategic circumstances relating to international terrorism and other serious cross-border crime threatening significant national interests. The inspection did not give rise to any opinion or suggestion. However, during that year, one opinion was submitted to the Government following an inspection of whether the FRA’s intelligence activities complied with the tasking directives given. During the years 2009-2017 the Inspectorate found reason to make a report to another authority – the Data Protection Authority – on one occasion, concerning the interpretation of a legal provision. In its annual reports, the Inspectorate has noted that it has been given access to all the information necessary for its inspections. 54. The supervisory activities of the Foreign Intelligence Inspectorate have been audited by the National Audit Office (Riksrevisionen), a body answerable to Parliament. In a report published in 2015 the Office noted that the FRA had routines in place for handling the Inspectorate’s opinions and that the supervision helped develop the activities of the FRA. Suggestions were dealt with in a serious manner and, when called for, gave rise to reforms. With the exception of one case when the FRA referred the matter to the Government, the FRA took the action decided by Inspectorate. At the same time the Office criticised the Inspectorate’s lack of documentation of inspections and the fact that there were no clearly specified goals for the inspections. 55. Within the FRA there is a Privacy Protection Council tasked with continuously monitoring measures taken to ensure protection of personal integrity. The members are appointed by the Government. The Council reports its observations to the FRA management or, if the Council finds reasons for it, to the Inspectorate (section 11 of the Signals Intelligence Act). 56. Further provisions on supervision are found in the FRA Personal Data Processing Act. The FRA shall appoint one or several data protection officers and report the appointment to the Data Protection Authority (Chapter 4, section 1). The data protection officer is tasked with independently monitoring that the FRA treats personal data in a legal and correct manner and point out any deficiencies. If deficiencies are suspected and no correction is made, a report shall be submitted to the Data Protection Authority (Chapter 4, section 2). 57. The Data Protection Authority, which is an authority under the Government, has, on request, access to the personal data that is processed by the FRA and to documentation on the treatment of personal data along with the security measures taken in this regard as well as access to the facilities where personal data is processed (Chapter 5, section 2). If the Authority finds that personal data is or could be processed illegally, it shall try to remedy the situation by communicating its observations to the FRA (Chapter 5, section 3). It may also apply to the Administrative Court (förvaltningsrätten) in Stockholm to have illegally processed personal data destroyed (Chapter 5, section 4). According to copies of an email exchange of April 2019 between the applicant and the Administrative Court, there was no trace in that court’s electronic records of the latter possibility having been used by the Data Protection Authority. H. Notification of secret surveillance measures
58. If selectors directly related to a specific natural person have been used, he or she is to be notified by the FRA, according to the Signals Intelligence Act. The notification shall contain information on the date and purpose of the measures. Such notification shall be given as soon as this can be done without detriment to the foreign intelligence activities, but no later than one month after the signals intelligence mission has been concluded (section 11a). 59. However, the notification may be delayed if secrecy so demands, in particular defence secrecy or secrecy for the protection of international relations. If, due to secrecy considerations, no notification has been given within a year from the conclusion of the mission, the person does not have to be notified. Furthermore, notification shall not be given if the measures solely concern the conditions of a foreign power or the relationship between foreign powers (section 11b). 60. In its 2010 report, the Data Protection Authority noted, inter alia, that the procedure for notification to individuals had never been used by the FRA, due to secrecy considerations (see paragraph 75 below). I. Remedies
61. The Signals Intelligence Act provides that the Foreign Intelligence Inspectorate, at the request of an individual, must investigate if his or her communications have been intercepted through signals intelligence and, if so, verify whether the interception and treatment of the information have been in accordance with the law. The Inspectorate shall notify the individual that such an investigation has been carried out (section 10a). A request can be made by legal and natural persons regardless of nationality and residence. During the period 2010-2017, 132 requests were handled and no unlawfulness was established. In 2017, ten such requests were processed; in 2016 the number was 14. The Inspectorate’s decision following a request is final. 62. Under the FRA Personal Data Processing Act, the FRA is also required to provide information upon request. Once per calendar year, an individual may demand information on whether personal data concerning him or her is being or has been processed. If so, the FRA must specify what information on the individual is concerned, from where it was collected, the purpose of the treatment and to which recipients or categories of recipients the personal data is or was reported. The information is normally to be given within one month from the request (Chapter 2, section 1). However, this right to information does not apply if disclosure is prevented by secrecy considerations (Chapter 2, section 3). 63. Following a request from an individual who has had personal data registered, the FRA shall promptly correct, block or destroy such data that has not been processed in accordance with law. The FRA shall also notify any third party who has received the data, if the individual so requests or if substantial harm or inconvenience could be avoided through a notification. No such notification has to be given if it is impossible or would involve a disproportionate effort (Chapter 2, section 4). 64. The FRA’s decisions on disclosure and corrective measures in regard to personal data may be appealed against to the Administrative Court in Stockholm (Chapter 6, section 3). According to copies of an email exchange of April 2019 between the applicant and the Administrative Court, there was no trace in that court’s electronic records of that possibility having been used. 65. The State is liable for damages following a violation of personal integrity caused by treatment of personal data not in accordance with the FRA Personal Data Processing Act (Chapter 2, section 5). A request for damages shall be submitted to the Chancellor of Justice. 66. In addition to the above remedies, laid down in the legislation relating to signals intelligence, Swedish law provides for a number of other means of scrutiny and complaints mechanisms. The Parliamentary Ombudsmen (Justititeombudsmannen) supervise the application of laws and regulations in public activities; courts and authorities are obliged to provide information and opinions at the request of the Ombudsmen (Chapter 13, section 6 of the Instrument of Government – Regeringsformen), including access to minutes and other documents. The Ombudsmen shall ensure, in particular, that the courts and authorities observe the provisions of the Instrument of Government on objectivity and impartiality and that citizens’ fundamental rights and freedoms are not encroached upon in public activities (section 3 of the Parliamentary Ombudsmen Instructions Act – Lagen med instruktion för Riksdagens ombudsmän; 1986:765). The supervision, under which the Foreign Intelligence Court and the FRA come, is conducted by means of examining complaints from the public and through inspections and other investigations (section 5). The examination is concluded by a decision in which, although not legally binding, the opinion of the Ombudsman is given as to whether the court or authority has contravened the law or otherwise taken a wrongful or inappropriate action; the Ombudsman may also initiate criminal or disciplinary proceedings against a public official who has committed a criminal offence or neglected his or her duty in disregarding the obligations of the office (section 6). 67. With a mandate similar to the Parliamentary Ombudsmen, the Chancellor of Justice scrutinises whether officials in public administration comply with laws and regulations and otherwise fulfil their obligations (section 1 of the Chancellor of Justice Supervision Act – Lagen om justitiekanslerns tillsyn; 1975:1339). The Chancellor does so by examining individual complaints or conducting inspections and other investigations, which could be directed at, for instance, the Foreign Intelligence Court and the FRA. According to copies of an email exchange of April 2019 between the applicant and the office of the Chancellor of Justice, twelve such complaints were received in 2008 and one in 2013. Following examination, none of those had been judged to require action. 68. At the request of the Chancellor, courts and authorities are obliged to provide information and opinions as well as access to minutes and other documents (sections 9 and 10). The decisions of the Chancellor of Justice are similar in nature to the decisions of the Parliamentary Ombudsmen, including their lack of legally binding power. By tradition, however, the opinions of the Chancellor and the Ombudsmen command great respect in Swedish society and are usually followed (see Segerstedt-Wiberg and Others v. Sweden, no. 62332/00, § 118, ECHR 2006-VII). The Chancellor has the same power as the Ombudsmen to initiate criminal or disciplinary proceedings (sections 5 and 6). 69. The Chancellor of Justice is also authorised to determine complaints and claims for damages directed against the State, including compensation claims for alleged violations of the Convention. The Supreme Court and the Chancellor of Justice have developed precedents in recent years, affirming that it is a general principle of law that compensation for Convention violations can be ordered without direct support in Swedish statute to the extent that Sweden has a duty to provide redress to victims of Convention violations through a right to compensation for damages (see Lindstrand Partners Advokatbyrå AB v. Sweden, no. 18700/09, §§ 58-62 and 67, 20 December 2016, with further references). On 1 April 2018, through the enactment of a new provision – Chapter 3, section 4 – of the Tort Liability Act (Skadeståndslagen; 1972:207), the right to compensation for violations of the Convention was codified. 70. In addition to its above-mentioned supervisory functions under the Foreign Intelligence Inspectorate Instructions Ordinance and the FRA Personal Data Processing Act (see paragraphs 52, 56 and 57 above), the Data Protection Authority is generally entrusted with protecting individuals against violations of their personal integrity through the processing of personal data, under the Act with Supplementary Provisions to the EU General Data Protection Regulation (Lagen med kompletterande bestämmelser till EU:s dataskyddsförordning) which entered into force on 25 May 2018, the same day as the new EU regulation it supplements (see paragraph 94 below). In regard to the signals intelligence conducted by the FRA, the Personal Data Act (Personuppgiftslagen; 1998:204) continues to apply, although it is otherwise replaced by the new EU Regulation and the supplementary act. It gives the Data Protection Authority the same general supervisory task. In performing this task, the Authority may receive and examine individual complaints. J. Secrecy at the FRA
71. The Public Access to Information and Secrecy Act (Offentlighets‑ och sekretesslagen; 2009:400) contains a specific provision on the FRA’s signals intelligence activities. Secrecy applies to information on an individual’s personal or economic circumstances, unless it is evident that the information can be disclosed without the individual concerned or any other person closely related to him or her being harmed. The presumption is for secrecy (Chapter 38, section 4). 72. According to the Act, secrecy also generally applies to foreign intelligence activities in regard to information concerning another State, international organisation, authority, citizen or legal person in another State, if it can be presumed that a disclosure will interfere with Sweden’s international relations or otherwise harm the country (Chapter 15, section 1). 73. Secrecy further applies to information on activities related to the defence of the country or the planning of such activities or to information that is otherwise related to the country’s comprehensive defence strategy, if it can be presumed that a disclosure will harm the country’s defence or otherwise endanger national security (Chapter 15, section 2). 74. Information which is protected by secrecy under the Public Access to Information and Secrecy Act may not be disclosed to a foreign authority or an international organisation unless (i) such disclosure is permitted by an express legal provision (cf. section 7 of the FRA Personal Data Processing Ordinance, paragraph 34 above), or (ii) the information in an analogous situation may be communicated to a Swedish authority and the disclosing authority finds it evident that the communication of the information to the foreign authority or the international organisation is consistent with Swedish interests (Chapter 8, section 3 of the Act). K. The reports of the Data Protection Authority
75. On 12 February 2009 the Government ordered the Data Protection Authority to examine the handling of personal data at the FRA from an integrity perspective. In its report, published on 6 December 2010, the Authority stated that its conclusions were overall positive. Issues relating to the processing of personal data and to personal integrity were given serious consideration by the FRA and a considerable amount of time and resources were spent on creating routines and educating its personnel in order to minimise the risk of unwarranted interferences with personal integrity. Moreover, no evidence had been found which indicated that the FRA was handling personal data for purposes not authorised by the legislation in force. However, the Authority noted, inter alia, that there was a need to improve the methods for separating domestic and cross-border communications. Even if the FRA had implemented mechanisms in that area, there was no guarantee that domestic communications were never intercepted, and, although the occasions had been very few, such communications had in fact been intercepted. The Authority further noted that the procedure for notification to individuals (paragraphs 58-60 above) had never been used by the FRA, due to secrecy considerations. 76. A second report was issued by the Authority on 24 October 2016. Again, the Authority found no evidence that personal data had been collected for other purposes than those stipulated for the signals intelligence activities. It also noted that the FRA continuously reviewed whether data intercepted was still needed for those purposes. A similar review was made concerning the communications bearers from which the FRA obtained intelligence. Moreover, there was nothing to indicate that the provisions on destruction of personal data had been disregarded (see paragraphs 37-39 above). However, the FRA was criticised for not adequately monitoring logs used to detect unwarranted use of personal data, a shortcoming that had been pointed out already in 2010. L. The report of the Signals Intelligence Committee
77. On 12 February 2009 the Government also decided to appoint a committee predominantly composed of members of parliament, the Signals Intelligence Committee (Signalspaningskommittén), with the task of monitoring the signals intelligence conducted by the FRA in order to examine the implications for personal integrity. The report was presented on 11 February 2011 (Uppföljning av signalspaningslagen; SOU 2011:13). The Committee’s examination focused primarily on signals intelligence conducted over the airways, as such activities on cable-based traffic had not yet commenced on a larger scale. 78. The Committee concluded that concerns of personal integrity were taken seriously by the FRA and formed an integral part of the development of its procedures. It noted, however, that there were practical difficulties in separating domestic cable-based communications from those crossing the Swedish border. Any domestic communications that were not separated at the automated stage were instead separated manually at the processing or analysing stage. The Committee further observed that the selectors used for communications data were less specific than those used for interception of the content of a communication and that, consequently, a larger number of individuals could have such data stored by the FRA. 79. Another finding in the report was that the FRA’s development activities (see paragraph 24 above) could lead to non-relevant communications being intercepted and possibly read or listened to by FRA personnel. However, the Committee noted that the development activities were directly essential for the FRA’s ability to conduct signals intelligence. Moreover, information obtained through the development activities could be used in regular intelligence activities only if such use conformed with the purposes established by law and the relevant tasking directives issued for the signals intelligence. 80. Like the Data Protection Authority, the Committee pointed out that, in reality, the obligation on the FRA to notify individuals who had been directly and personally subjected to secret surveillance measures was very limited due to secrecy; it concluded therefore that this obligation served no purpose as a guarantee for legal certainty or against integrity interferences. The Committee found, however, that, in particular, the authorisation procedure before the Foreign Intelligence Court, in deciding on permits to conduct signals intelligence measures (see paragraphs 30-34 above), and the supervisory functions performed by the Foreign Intelligence Inspectorate (see paragraphs 36 and 50-54 above) and the Privacy Protection Council (see paragraph 55 above) provided important protection for individuals’ personal integrity. It noted, in this respect, that, although the Privacy Protection Council formed part of the FRA, it acted in an independent manner.
relevant INTERNATIONAL lawThe United Nations

81. Resolution no. 68/167, on The Right to Privacy in the Digital Age, adopted by the General Assembly on 18 December 2013, reads as follows:
“The General Assembly,
... 4. Calls upon all States:
... (c) To review their procedures, practices and legislation regarding the surveillance of communications, their interception and the collection of personal data, including mass surveillance, interception and collection, with a view to upholding the right to privacy by ensuring the full and effective implementation of all their obligations under international human rights law;
(d) To establish or maintain existing independent, effective domestic oversight mechanisms capable of ensuring transparency, as appropriate, and accountability for State surveillance of communications, their interception and the collection of personal data ...”
The Council of EuropeThe Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 1981 and its Additional Protocol (CETS No. 108)

82. The Convention, in force for Sweden since 1 October 1985, sets out standards for data protection in the sphere of automatic processing of personal data in the public and private sectors. It provides, in so far as relevant, as follows:
Preamble
“The member States of the Council of Europe, signatory hereto,
Considering that the aim of the Council of Europe is to achieve greater unity between its members, based in particular on respect for the rule of law, as well as human rights and fundamental freedoms;
Considering that it is desirable to extend the safeguards for everyone’s rights and fundamental freedoms, and in particular the right to the respect for privacy, taking account of the increasing flow across frontiers of personal data undergoing automatic processing;
Reaffirming at the same time their commitment to freedom of information regardless of frontiers;
Recognising that it is necessary to reconcile the fundamental values of the respect for privacy and the free flow of information between peoples,
Have agreed as follows:”
Article 1 – Object and purpose
“The purpose of this Convention is to secure in the territory of each Party for every individual, whatever his nationality or residence, respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data relating to him (“data protection”).”
Article 8 – Additional safeguards for the data subject
“Any person shall be enabled:
a.  to establish the existence of an automated personal data file, its main purposes, as well as the identity and habitual residence or principal place of business of the controller of the file;
b.  to obtain at reasonable intervals and without excessive delay or expense confirmation of whether personal data relating to him are stored in the automated data file as well as communication to him of such data in an intelligible form;
c.  to obtain, as the case may be, rectification or erasure of such data if these have been processed contrary to the provisions of domestic law giving effect to the basic principles set out in Articles 5 and 6 of this convention;
d.  to have a remedy if a request for confirmation or, as the case may be, communication, rectification or erasure as referred to in paragraphs b and c of this article is not complied with.”
Article 9 – Exceptions and restrictions
“1. No exception to the provisions of Articles 5, 6 and 8 of this Convention shall be allowed except within the limits defined in this article. 2. Derogation from the provisions of Articles 5, 6 and 8 of this Convention shall be allowed when such derogation is provided for by the law of the Party and constitutes a necessary measure in a democratic society in the interests of:
a.  protecting State security, public safety, the monetary interests of the State or the suppression of criminal offences;
b.  protecting the data subject or the rights and freedoms of others.
...”
Article 10 – Sanctions and remedies
“Each Party undertakes to establish appropriate sanctions and remedies for violations of provisions of domestic law giving effect to the basic principles for data protection set out in this chapter.”
83. The Explanatory Report to the above-mentioned Convention explains the following as regards its Article 9:
“... 55. Exceptions to the basic principles for data protection are limited to those which are necessary for the protection of fundamental values in a democratic society. The text of the second paragraph of this article has been modelled after that of the second paragraphs of Articles 6, 8, 10 and 11 of the European Human Rights Convention. It is clear from the decisions of the Commission and the Court of Human Rights relating to the concept of ‘necessary measures’ that the criteria for this concept cannot be laid down for all countries and all times, but should be considered in the light of the given situation in each country. 56. Littera a in paragraph 2 lists the major interests of the State which may require exceptions. These exceptions are very specific in order to avoid that, with regard to the general application of the convention, States would have an unduly wide leeway. States retain, under Article 16, the possibility to refuse application of the convention in individual cases for important reasons, which include those enumerated in Article 9. The notion of ‘State security’ should be understood in the traditional sense of protecting national sovereignty against internal or external threats, including the protection of the international relations of the State...”
84. The Additional Protocol to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, regarding supervisory authorities and transborder data flows of 8 November 2001 (CETS No. 181), in force for Sweden since 1 July 2004, provides as follows, in so far as relevant:
Article 1 – Supervisory authorities
“1. Each Party shall provide for one or more authorities to be responsible for ensuring compliance with the measures in its domestic law giving effect to the principles stated in Chapters II and III of the Convention and in this Protocol.
2.  a. To this end, the said authorities shall have, in particular, powers of investigation and intervention, as well as the power to engage in legal proceedings or bring to the attention of the competent judicial authorities violations of provisions of domestic law giving effect to the principles mentioned in paragraph 1 of Article 1 of this Protocol.
b. Each supervisory authority shall hear claims lodged by any person concerning the protection of his/her rights and fundamental freedoms with regard to the processing of personal data within its competence. 3. The supervisory authorities shall exercise their functions in complete independence. 4. Decisions of the supervisory authorities, which give rise to complaints, may be appealed against through the courts.
...”
Article 2 – Transborder flows of personal data to a recipient which is not subject to the jurisdiction of a Party to the Convention
“1. Each Party shall provide for the transfer of personal data to a recipient that is subject to the jurisdiction of a State or organisation that is not Party to the Convention only if that State or organisation ensures an adequate level of protection for the intended data transfer. 2. By way of derogation from paragraph 1 of Article 2 of this Protocol, each Party may allow for the transfer of personal data:
a.  if domestic law provides for it because of:
–  specific interests of the data subject, or
–  legitimate prevailing interests, especially important public interests, or
b.  if safeguards, which can in particular result from contractual clauses, are provided by the controller responsible for the transfer and are found adequate by the competent authorities according to domestic law.”
Recommendation of the Committee of Ministers of the Council of Europe on the protection of personal data in the area of telecommunication services
85. Recommendation No. R (95) 4 of the Committee of Ministers on the protection of personal data in the area of telecommunication services, with particular reference to telephone services, adopted on 7 February 1995, reads, insofar as relevant, as follows:
“2.4. Interference by public authorities with the content of a communication, including the use of listening or tapping devices or other means of surveillance or interception of communications, must be carried out only when this is provided for by law and constitutes a necessary measure in a democratic society in the interests of:
a.  protecting state security, public safety, the monetary interests of the state or the suppression of criminal offences;
b.  protecting the data subject or the rights and freedoms of others.
2.5. In the case of interference by public authorities with the content of a communication, domestic law should regulate:
a.  the exercise of the data subject’s rights of access and rectification;
b.  in what circumstances the responsible public authorities are entitled to refuse to provide information to the person concerned, or delay providing it;
c.  storage or destruction of such data. If a network operator or service provider is instructed by a public authority to effect an interference, the data so collected should be communicated only to the body designated in the authorisation for that interference.”
The 2015 Report of the European Commission for Democracy through Law (“the Venice Commission”) on the Democratic Oversight of Signals Intelligence Agencies
86. In this report, published in December 2015, the Venice Commission noted, at the outset, the value that bulk interception could have for security operations, since it enabled the security services to adopt a proactive approach, looking for hitherto unknown dangers rather than investigating known ones. However, it also noted that intercepting bulk data in transmission, or requirements that telecommunications companies store and then provide telecommunications content data or metadata to law‑enforcement or security agencies involved an interference with the privacy and other human rights of a large proportion of the population of the world. In this regard, the Venice Commission considered that the main interference with privacy occurred when stored personal data were accessed and/or processed by the agencies. For this reason, the computer analysis (usually with the help of selectors) was one of the important stages for balancing personal integrity concerns against other interests. 87. According to the report, the two most significant safeguards were the authorisation (of collection and access) and the oversight of the process. It was clear from the Court’s case-law that the latter had to be performed by an independent, external body. While the Court had a preference for judicial authorisation, it had not found this to be a necessary requirement. Rather, the system had to be assessed as a whole, and where independent controls were absent at the authorisation stage, particularly strong safeguards had to exist at the oversight stage. In this regard, the Venice Commission considered the example of the system in the United States, where authorisation was given by the Foreign Intelligence Surveillance Court. However, it noted that despite the existence of judicial authorisation, the lack of independent oversight of the conditions and limitations set by the court was problematic. 88. Similarly, the Commission observed that notification of the subject of surveillance was not an absolute requirement of Article 8 of the Convention, since a general complaints procedure to an independent oversight body could compensate for non-notification. 89. The report also considered internal controls to be a “primary safeguard”. Recruitment and training were key issues; in addition, it was important for the agencies to build in respect for privacy and other human rights when promulgating internal rules. 90. The report also considered the position of journalists. It accepted that they were a group which required special protection, since searching their contacts could reveal their sources (and the risk of discovery could be a powerful disincentive to whistle-blowers). Nevertheless, it considered there to be no absolute prohibition on searching the contacts of journalists, provided that there were very strong reasons for doing so. It acknowledged, however, that the journalistic profession was not one which was easily identified, since NGOs were also engaged in building public opinion and even bloggers could claim to be entitled to equivalent protections. 91. Finally, the report considered briefly the issue of intelligence sharing, and in particular the risk that States could thereby circumvent stronger domestic surveillance procedures or any legal limits which their agencies might be subject to as regards domestic intelligence operations. It considered that a suitable safeguard would be to provide that the bulk material transferred could only be searched if all the material requirements of a national search were fulfilled and this was duly authorised in the same way as a search of bulk material obtained by the signals intelligence agency using its own techniques. European union LAWCharter of Fundamental Rights of the European Union

92. Articles 7, 8 and 11 of the Charter provide as follows:
Article 7 – Respect for private and family life
“Everyone has the right to respect for his or her private and family life, home and communications.”
Article 8 – Protection of personal data
“1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which have been collected concerning him or her, and the right to have them rectified. 3. Compliance with these rules shall be subject to control by an independent authority.”
Article 11 – Freedom of expression and information
“1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. 2. The freedom and pluralism of the media shall be respected.”
European Union directives and regulations relating to protection and processing of personal data
93. The Data Protection Directive (Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data), adopted on 24 October 1995, regulated for many years the protection and processing of personal data within the European Union. As the activities of Member States regarding public safety, defence and State security fell outside the scope of Community law, the Directive did not apply to these activities (Article 3(2)). 94. The General Data Protection Regulation, adopted in April 2016, superseded the Data Protection Directive and became enforceable on 25 May 2018. The regulation, which is directly applicable in Member States, contains provisions and requirements pertaining to the processing of personally identifiable information of data subjects inside the European Union, and applies to all enterprises, regardless of location, doing business with the European Economic Area. Business processes that handle personal data must be built with data protection by design and by default, meaning that personal data must be stored using pseudonymisation or full anonymization, and use the highest-possible privacy settings by default, so that the data are not available publicly without explicit consent, and cannot be used to identify a subject without additional information stored separately. No personal data may be processed unless it is done under a lawful basis specified by the regulation, or if the data controller or processor has received explicit, opt-in consent from the data’s owner. The data owner has the right to revoke this permission at any time. 95. A processor of personal data must clearly disclose any data collection, declare the lawful basis and purpose for data processing, how long data are being retained, and if they are being shared with any third-parties or outside of the European Union. Users have the right to request a portable copy of the data collected by a processor in a common format, and the right to have their data erased under certain circumstances. Public authorities, and businesses whose core activities centre around regular or systematic processing of personal data, are required to employ a data protection officer (DPO), who is responsible for managing compliance with the GDPR. Businesses must report any data breaches within 72 hours if they have an adverse effect on user privacy. 96. The Privacy and Electronic Communications Directive (Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector), adopted on 12 July 2002, states, in recitals 2 and 11:
“(2)  This Directive seeks to respect the fundamental rights and observes the principles recognised in particular by the Charter of fundamental rights of the European Union. In particular, this Directive seeks to ensure full respect for the rights set out in Articles 7 and 8 of that Charter. (11)  Like Directive 95/46/EC, this Directive does not address issues of protection of fundamental rights and freedoms related to activities which are not governed by Community law. Therefore it does not alter the existing balance between the individual’s right to privacy and the possibility for Member States to take the measures referred to in Article 15(1) of this Directive, necessary for the protection of public security, defence, State security (including the economic well-being of the State when the activities relate to State security matters) and the enforcement of criminal law. Consequently, this Directive does not affect the ability of Member States to carry out lawful interception of electronic communications, or take other measures, if necessary for any of these purposes and in accordance with the European Convention for the Protection of Human Rights and Fundamental Freedoms, as interpreted by the rulings of the European Court of Human Rights. Such measures must be appropriate, strictly proportionate to the intended purpose and necessary within a democratic society and should be subject to adequate safeguards in accordance with the European Convention for the Protection of Human Rights and Fundamental Freedoms.”
The Directive further provides, in so far as relevant:
Article 1 – Scope and aim
“1. This Directive harmonises the provisions of the Member States required to ensure an equivalent level of protection of fundamental rights and freedoms, and in particular the right to privacy, with respect to the processing of personal data in the electronic communication sector and to ensure the free movement of such data and of electronic communication equipment and services in the Community. 2. The provisions of this Directive particularise and complement Directive 95/46/EC for the purposes mentioned in paragraph 1. Moreover, they provide for protection of the legitimate interests of subscribers who are legal persons. 3. This Directive shall not apply to activities which fall outside the scope of the Treaty establishing the European Community, such as those covered by Titles V and VI of the Treaty on European Union, and in any case to activities concerning public security, defence, State security (including the economic well-being of the State when the activities relate to State security matters) and the activities of the State in areas of criminal law.”
Article 15 – Application of certain provisions of Directive 95/46/EC
“1. Member States may adopt legislative measures to restrict the scope of the rights and obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article 9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defence, public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system, as referred to in Article 13(1) of Directive 95/46/EC. To this end, Member States may, inter alia, adopt legislative measures providing for the retention of data for a limited period justified on the grounds laid down in this paragraph. All the measures referred to in this paragraph shall be in accordance with the general principles of Community law, including those referred to in Article 6(1) and (2) of the Treaty on European Union.”
97. On 15 March 2006 the Data Retention Directive (Directive 2006/24/EC on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC) was adopted. Prior to the judgment of 2014 declaring it invalid (see the paragraph below), it provided, inter alia, as follows:
Article 1 - Subject matter and scope
“1. This Directive aims to harmonise Member States’ provisions concerning the obligations of the providers of publicly available electronic communications services or of public communications networks with respect to the retention of certain data which are generated or processed by them, in order to ensure that the data are available for the purpose of the investigation, detection and prosecution of serious crime, as defined by each Member State in its national law. 2. This Directive shall apply to traffic and location data on both legal entities and natural persons and to the related data necessary to identify the subscriber or registered user. It shall not apply to the content of electronic communications, including information consulted using an electronic communications network.”
Article 3 – Obligation to retain data
“1. By way of derogation from Articles 5, 6 and 9 of Directive 2002/58/EC, Member States shall adopt measures to ensure that the data specified in Article 5 of this Directive are retained in accordance with the provisions thereof, to the extent that those data are generated or processed by providers of publicly available electronic communications services or of a public communications network within their jurisdiction in the process of supplying the communications services concerned.
...”
Relevant case-law of the Court of Justice of the European Union (“CJEU”)Digital Rights Ireland Ltd v. Minister for Communications, Marine and Natural Resources and Others and Kärntner Landesregierung and Others (Cases C-293/12 and C-594/12; ECLI:EU:C:2014:238)

98. In a judgment of 8 April 2014 the CJEU declared invalid the Data Retention Directive 2006/24/EC laying down the obligation on the providers of publicly available electronic communication services or of public communications networks to retain all traffic and location data for periods from six months to two years, in order to ensure that the data were available for the purpose of the investigation, detection and prosecution of serious crime, as defined by each Member State in its national law. The CJEU noted that, even though the directive did not permit the retention of the content of the communication, the traffic and location data covered by it might allow very precise conclusions to be drawn concerning the private lives of the persons whose data had been retained. Accordingly, the obligation to retain the data constituted in itself an interference with the right to respect for private life and communications guaranteed by Article 7 of the Charter of Fundamental Rights of the EU and the right to protection of personal data under Article 8 of the Charter. 99. The access of the competent national authorities to the data constituted a further interference with those fundamental rights, which the CJEU considered to be “particularly serious”. The fact that data were retained and subsequently used without the subscriber or registered user being informed was, according to the CJEU, likely to generate in the minds of the persons concerned the feeling that their private lives were the subject of constant surveillance. The interference satisfied an objective of general interest, namely to contribute to the fight against serious crime and terrorism and thus, ultimately, to public security. However, it failed to satisfy the requirement of proportionality. 100. Firstly, the directive covered, in a generalised manner, all persons and all means of electronic communication as well as all traffic data without any differentiation, limitation or exception being made in the light of the objective of fighting against serious crime. It therefore entailed an interference with the fundamental rights of practically the entire European population. It applied even to persons for whom there was no evidence capable of suggesting that their conduct might have a link, even an indirect or remote one, with serious crime. 101. Secondly, the directive did not contain substantive and procedural conditions relating to the access of the competent national authorities to the data and to their subsequent use. By simply referring, in a general manner, to serious crime, as defined by each Member State in its national law, the directive failed to lay down any objective criterion by which to determine which offences might be considered to be sufficiently serious to justify such an extensive interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter. Above all, the access by the competent national authorities to the data retained was not made dependent on a prior review carried out by a court or by an independent administrative body whose decision sought to limit access to the data and their use to what was strictly necessary for the purpose of attaining the objective pursued. 102. Thirdly, the directive required that all data be retained for a period of at least six months, without any distinction being made between the categories of data on the basis of their possible usefulness for the purposes of the objective pursued or according to the persons concerned. The CJEU concluded that the directive entailed a wide-ranging and particularly serious interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter, without such an interference being precisely circumscribed by provisions to ensure that it was actually limited to what was strictly necessary. The CJEU also noted that the directive did not provide for sufficient safeguards, by means of technical and organisational measures, to ensure effective protection of the data retained against the risk of abuse and against any unlawful access and use of those data. Tele2 Sverige AB v Post- och telestyrelsen and Secretary of State for the Home Department v Tom Watson and Others (Cases C‑203/15 and C‑698/15; ECLI:EU:C:2016:970)
103. In Secretary of State for the Home Department v. Watson and Others, the applicants had sought judicial review of the legality of section 1 of the United Kingdom Data Retention and Investigatory Powers Act 2014 (“DRIPA”), pursuant to which the Secretary of State could require a public telecommunications operator to retain relevant communications data if he or she considered it necessary and proportionate for one or more of the purposes falling within paragraphs (a) to (h) of section 22(2) of the Regulation of Investigatory Powers Act 2000 (“RIPA”). The applicants claimed, inter alia, that section 1 was incompatible with Articles 7 and 8 of the Charter and Article 8 of the Convention. 104. By judgment of 17 July 2015, the High Court held that the Digital Rights judgment laid down “mandatory requirements of EU law” applicable to the legislation of Member States on the retention of communications data and access to such data. Since the CJEU, in that judgment, held that Directive 2006/24 was incompatible with the principle of proportionality, national legislation containing the same provisions as that directive could, equally, not be compatible with that principle. In fact, it followed from the underlying logic of the Digital Rights judgment that legislation that established a general body of rules for the retention of communications data was in breach of the rights guaranteed in Articles 7 and 8 of the Charter, unless that legislation was complemented by a body of rules for access to the data, defined by national law, which provided sufficient safeguards to protect those rights. Accordingly, section 1 of DRIPA was not compatible with Articles 7 and 8 of the Charter as it did not lay down clear and precise rules providing for access to and use of retained data and access to that data was not made dependent on prior review by a court or an independent administrative body. 105. On appeal by the Secretary of State, the Court of Appeal sought a preliminary ruling from the CJEU. 106. Before the CJEU this case was joined with the request for a preliminary ruling from the Administrative Court of Appeal (kammarrätten) in Stockholm in Case C-203/15 Tele2 Sverige AB v Post- och telestyrelsen. Following an oral hearing in which some fifteen EU Member States intervened, the CJEU gave judgment on 21 December 2016. The CJEU held that Article 15(1) of Directive 2002/58, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter, had to be interpreted as precluding national legislation governing the protection and security of traffic and location data and, in particular, access of the competent national authorities to the retained data, where the objective pursued by that access, in the context of fighting crime, was not restricted solely to fighting serious crime, where access was not subject to prior review by a court or an independent administrative authority, and where there was no requirement that the data concerned should be retained within the European Union. 107. The CJEU declared the Court of Appeal’s question whether the protection afforded by Articles 7 and 8 of the Charter was wider than that guaranteed by Article 8 of the Convention inadmissible. 108. Following the handing down of the CJEU’s judgment, the case was relisted before the Court of Appeal. On 31 January 2018 it granted declaratory relief in the following terms: that section 1 of DRIPA was inconsistent with EU law to the extent that it permitted access to retained data where the object pursued by access was not restricted solely to fighting serious crime; or where access was not subject to prior review by a court or independent administrative authority. Ministerio Fiscal (Case C-207/16; ECLI:EU:C:2018:788)
109. This request for a preliminary ruling arose after Spanish police, in the course of investigating the theft of a wallet and mobile telephone, asked the investigating magistrate to grant them access to data identifying the users of telephone numbers activated with the stolen telephone during a period of twelve days prior to the theft. The investigating magistrate rejected the request on the ground, inter alia, that the acts giving rise to the criminal investigation did not constitute a “serious” offence. The referring court subsequently sought guidance from the CJEU on fixing the threshold of seriousness of offences above which an interference with fundamental rights, such as competent national authorities’ access to personal data retained by providers of electronic communications services, may be justified. 110. On 2 October 2018 the Grand Chamber of the CJEU ruled that Article 15(1) of Directive 2002/58/EC, read in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, had to be interpreted as meaning that the access of public authorities to data for the purpose of identifying the owners of SIM cards activated with a stolen mobile telephone, such as the surnames, forenames and, if need be, addresses of the owners, entailed an interference with their fundamental rights which was not sufficiently serious to entail that access being limited, in the area of prevention, investigation, detection and prosecution of criminal offences, to the objective of fighting serious crime. In particular, it indicated that:
“In accordance with the principle of proportionality, serious interference can be justified, in areas of prevention, investigation, detection and prosecution of criminal offences, only by the objective of fighting crime which must also be defined as ‘serious’. By contrast, when the interference that such access entails is not serious, that access is capable of being justified by the objective of preventing, investigating, detecting and prosecuting ‘criminal offences’ generally.”
111. It did not consider access to the data which were the subject of the request to be a particularly serious interference because it:
“only enables the SIM card or cards activated with the stolen mobile telephone to be linked, during a specific period, with the identity of the owners of those SIM cards. Without those data being cross-referenced with the data pertaining to the communications with those SIM cards and the location data, those data do not make it possible to ascertain the date, time, duration and recipients of the communications made with the SIM card or cards in question, nor the locations where those communications took place or the frequency of those communications with specific people during a given period. Those data do not therefore allow precise conclusions to be drawn concerning the private lives of the persons whose data is concerned.”
Maximillian Schrems v. Data Protection Commissioner (Case C‑362/14; ECLI:EU:C:2015:650)
112. This request for a preliminary ruling arose from a complaint against Facebook Ireland Ltd which was made to the Irish Data Protection Commissioner by Mr. Schrems, an Austrian privacy advocate. Mr. Schrems challenged the transfer of his data by Facebook Ireland to the United States and the retention of his data on servers located in that country. The Data Protection Commissioner rejected the complaint since, in a decision of 26 July 2000, the European Commission had considered that the United States ensured an adequate level of protection of the personal data transferred (“the Safe Harbour Decision”). 113. In its ruling of 6 October 2015, the CJEU held that the existence of a Commission decision finding that a third country ensured an adequate level of protection of the personal data transferred could not eliminate or even reduce the powers available to the national supervisory authorities under the Charter or the Data Protection Directive. Therefore, even if the Commission had adopted a decision, the national supervisory authorities had to be able to examine, with complete independence, whether the transfer of a person’s data to a third country complied with the requirements laid down by the Directive. 114. However, only the CJEU could declare a decision of the Commission invalid. In this regard, it noted that the safe harbour scheme was applicable solely to the United States’ undertakings which adhered to it, and United States’ public authorities were not themselves subject to it. Furthermore, national security, public interest and law enforcement requirements of the United States prevailed over the safe harbour scheme, so that United States’ undertakings were bound to disregard, without limitation, the protective rules laid down by the scheme where they conflicted with such requirements. The safe harbour scheme therefore enabled interference by United States’ public authorities with the fundamental rights of individuals, and the Commission had not, in the Safe Harbour Decision, referred either to the existence, in the United States, of rules intended to limit any such interference or to the existence of effective legal protection against the interference. 115. As to whether the level of protection in the United States was essentially equivalent to the fundamental rights and freedoms guaranteed within the EU, the CJEU found that legislation was not limited to what was strictly necessary where it authorised, on a generalised basis, storage of all the personal data of all the persons whose data were transferred from the EU to the United States without any differentiation, limitation or exception being made in the light of the objective pursued and without an objective criterion being laid down for determining the limits of the access of the public authorities to the data and of their subsequent use. Therefore, under EU law legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications had to be regarded as compromising the essence of the fundamental right to respect for private life. Likewise, legislation not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, compromised the essence of the fundamental right to effective judicial protection. 116. Finally, the Court found that the Safe Harbour Decision denied the national supervisory authorities their powers where a person called into question whether the decision was compatible with the protection of the privacy and of the fundamental rights and freedoms of individuals. The Commission had not had competence to restrict the national supervisory authorities’ powers in that way and, consequently, the CJEU held the Safe Harbour Decision to be invalid. Data Protection Commissioner v Facebook Ireland and Maximillian Schrems Case (C-311/18; ECLI:EU:C:2020:559)
117. Following the judgment of the CJEU of 6 October 2015, the referring court annulled the rejection of Mr Schrems’ complaint and referred that decision back to the Commissioner. In the course of the Commissioner’s investigation, Facebook Ireland explained that a large part of personal data were transferred to Facebook Inc. pursuant to the standard data protection clauses set out in the annex to Commission Decision 2010/87/EU, as amended. 118. Mr Schrems reformulated his complaint, claiming, inter alia, that the United States’ law required Facebook Inc. to make the personal data transferred to it available to certain United States’ authorities, such as the National Security Agency (“the NSA”) and the Federal Bureau of Investigation. Since those data were used in the context of various monitoring programmes in a manner incompatible with Articles 7, 8 and 47 of the Charter, Decision 2010/87/EU could not justify the transfer of those data to the United States. On this basis, he asked the Commissioner to prohibit or suspend the transfer of his personal data to Facebook Inc. 119. In a draft decision published on 24 May 2016, the Commissioner took the provisional view that the personal data of European Union citizens transferred to the United States were likely to be consulted and processed by the United States’ authorities in a manner incompatible with Articles 7 and 8 of the Charter and that United States’ law did not provide those citizens with legal remedies compatible with Article 47 of the Charter. The Commissioner found that the standard data protection clauses in the annex to Decision 2010/87/EU were not capable of remedying that defect, since they did not bind the United States’ authorities. 120. Having considered the United States’ intelligence activities under section 702 of FISA and Executive Order 12333, the High Court concluded that the United States carried out mass processing of personal data without ensuring a level of protection essentially equivalent to that guaranteed by Articles 7 and 8 of the Charter; and that European Union citizens did not have available to them the same remedies as citizens of the United States, with the consequence that United States’ law did not afford European Union citizens a level of protection essentially equivalent to that guaranteed by Article 47 of the Charter. It stayed the proceedings and referred a number of questions to the CJEU for a preliminary ruling. It asked, inter alia, whether European Union law applied to the transfer of data from a private company in the European Union to a private company in a third country; if so, how the level of protection in the third country should be assessed; and whether the level of protection afforded by the United States respected the essence of the rights guaranteed by Article 47 of the Charter. 121. In a judgment of 16 July 2020 the CJEU held that the General Data Protection Regulation (“GDPR”) applied to the transfer of personal data for commercial purposes by an economic operator established in a Member State to another economic operator established in a third country, irrespective of whether, at the time of that transfer or thereafter, those data were liable to be processed by the authorities of the third country in question for the purposes of public security, defence and State security. Moreover, the appropriate safeguards, enforceable rights and effective legal remedies required by the GDPR had to ensure that data subjects whose personal data were transferred to a third country pursuant to standard data protection clauses were afforded a level of protection essentially equivalent to that guaranteed within the European Union. To that end, the assessment of the level of protection afforded in the context of such a transfer had to take into consideration both the contractual clauses agreed between the controller or processor established in the European Union and the recipient of the transfer established in the third country concerned and, as regards any access by the public authorities of that third country to the personal data transferred, the relevant aspects of the legal system of that third country. 122. Furthermore, unless there was a valid Commission adequacy decision, the competent supervisory authority was required to suspend or prohibit a transfer of data to a third country if, in the view of that supervisory authority and in the light of all the circumstances of that transfer, the standard data protection clauses adopted by the Commission were not or could not be complied with in that third country and the protection of the data transferred (as required by European Union law) could not be ensured by other means. 123. In order for the Commission to adopt an adequacy decision, it had to find, duly stating reasons, that the third country concerned ensured, by reason of its domestic law or its international commitments, a level of protection of fundamental rights essentially equivalent to that guaranteed in the European Union legal order. In the CJEU’s view, the Safe Harbour decision was invalid. Section 702 of the Foreign Intelligence Security Act (“FISA”) did not indicate any limitations on the power it conferred to implement surveillance programmes for the purposes of foreign intelligence or the existence of guarantees for non-US persons potentially targeted by those programmes. In those circumstances, it could not ensure a level of protection essentially equivalent to that guaranteed by the Charter. Furthermore, as regards the monitoring programmes based on Executive Order 12333, it was clear that that order also did not confer rights which were enforceable against the United States’ authorities in the courts. Privacy International v Secretary of State for Foreign and Commonwealth Affairs and Others (Case C-623/17; ECLI:EU:C:2020:790) and La Quadrature du Net and Others, French Data Network and Others and Ordre des barreaux francophones et germanophone and Others (Cases C-511/18, C-512/18 and C-520/18; ECLI:EU:C:2020:791)
124. On 8 September 2017 the United Kingdom Investigatory Powers Tribunal (“IPT”) gave judgment in the case of Privacy International, which concerned the acquisition by the intelligence services of bulk communications data under section 94 of the Telecommunications Act 1984 and bulk personal data. The IPT found that, following their avowal, the regimes were compliant with Article 8 of the Convention. However, it identified the following four requirements which appeared to flow from the CJEU judgment in Watson and Others and which seemed to go beyond the requirements of Article 8 of the Convention: a restriction on non-targeted access to bulk data; a need for prior authorisation (save in cases of validly established emergency) before data could be accessed; provision for subsequent notification of those affected; and the retention of all data within the European Union. 125. On 30 October 2017 the IPT made a request to the CJEU for a preliminary ruling clarifying the extent to which the Watson requirements could apply where the bulk acquisition and automated processing techniques were necessary to protect national security. In doing so, it expressed serious concern that if the Watson requirements were to apply to measures taken to safeguard national security, they would frustrate them and put the national security of Member States at risk. In particular, it noted the benefits of bulk acquisition in the context of national security; the risk that the need for prior authorisation could undermine the intelligence services’ ability to tackle the threat to national security; the danger and impracticality of implementing a requirement to give notice in respect of the acquisition or use of a bulk database, especially where national security was at stake; and the impact an absolute bar on the transfer of data outside the European Union could have on Member States’ treaty obligations. 126. A public hearing took place on 9 September 2019. The Privacy International case was heard together with cases C‑511/18 and C‑512/18, La Quadrature du Net and Others, and C‑520/18, Ordre des barreaux francophones et germanophone and Others, which also concerned the application of Directive 2002/58 to activities related to national security and the combating of terrorism. Thirteen States intervened in support of the States concerned. 127. Two separate judgments were handed down on 6 October 2020. In Privacy International the CJEU found that national legislation enabling a State authority to require providers of electronic communications services to forward traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security fell within the scope of the Directive on privacy and electronic communications. The interpretation of that Directive had to take account of the right to privacy, guaranteed by Article 7 of the Charter, the right to protection of personal data, guaranteed by Article 8, and the right to freedom of expression, guaranteed by Article 11. Limitations on the exercise of those rights had to be provided for by law, respect the essence of the rights, and be proportionate, necessary, and genuinely meet the objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. Furthermore, limitations on the protection of personal data must apply only in so far as is strictly necessary; and in order to satisfy the requirement of proportionality, the legislation must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards, so that the persons whose personal data are affected have sufficient guarantees that data will be protected effectively against the risk of abuse. 128. In the opinion of the CJEU, national legislation requiring providers of electronic communications services to disclose traffic data and location data to the security and intelligence agencies by means of general and indiscriminate transmission – which affected all persons using electronic communications services – exceeded the limits of what was strictly necessary and could not be considered to be justified as required by the Directive on privacy and electronic communications read in light of the Charter. 129. However, in La Quadrature du Net and Others the CJEU confirmed that while the Directive on privacy and electronic communications, read in light of the Charter, precluded legislative measures which provided for the general and indiscriminate retention of traffic and location data, where a Member State was facing a serious threat to national security that proved to be genuine and present or foreseeable, it did not preclude legislative measures requiring service providers to retain, generally and indiscriminately, traffic and location data for a period limited to what was strictly necessary, but which could be extended if the threat persisted. For the purposes of combating serious crime and preventing serious threats to public security, a Member State could also provide - if it was limited in time to what was strictly necessary - for the targeted retention of traffic and location data, on the basis of objective and non-discriminatory factors according to the categories of person concerned or using a geographical criterion, or of IP addresses assigned to the source of an Internet connection. It was also open to a Member State to carry out a general and indiscriminate retention of data relating to the civil identity of users of means of electronic communication, without the retention being subject to a specific time limit. 130. Furthermore, the Directive on privacy and electronic communications, read in light of the Charter, did not preclude national rules which required providers of electronic communications services to have recourse, first, to the automated analysis and real-time collection of traffic and location data, and secondly, to the real-time collection of technical data concerning the location of the terminal equipment used, where it was limited to situations in which a Member State was facing a serious threat to national security that was genuine and present or foreseeable, and where recourse to such analysis may be the subject of an effective review by a court or independent administrative body whose decision was binding; and where recourse to the real-time collection of traffic and location data was limited to persons in respect of whom there was a valid reason to suspect that they were involved in terrorist activities and was subject to a prior review carried out either by a court or by an independent administrative body whose decision was binding. RELEVANT COMPARATIVE LAW AND PRACTICEContracting StatesOverview

131. At least seven Contracting States (being Finland, France, Germany, the Netherlands, Sweden, Switzerland and the United Kingdom) officially operate bulk interception regimes over cables and/or the airways.
132  In one additional State (Norway) a draft law is being debated: if enacted, it will also authorise bulk interception. 133. The bulk interception regime in the United Kingdom is described in detail in the Court’s judgment in the case of Big Brother Watch and Others v. the United Kingdom (nos. 58170/13 and 2 others, 25 May 2021). 134. As regards intelligence sharing agreements, at least thirty-nine Contracting States have either concluded intelligence sharing agreements with other States, or have the possibility for such agreements. Two expressly prohibit and two expressly permit the State to ask a foreign power to intercept material on their behalf. In the remaining States, the position on this issue is not clear. 135. Finally, in most States the applicable safeguards are broadly the same as for domestic operations, with various restrictions on the use of the received data and in some cases an obligation to destroy them if they became irrelevant. Judgment of the German Federal Constitutional Court of 19 May 2020 (1 BvR 2835/17)
136. In this judgment, the Constitutional Court considered whether the Federal Intelligence Service’s powers to conduct strategic (or “signals”) intelligence on foreign telecommunications were in breach of the fundamental rights contained in the Basic Law (Grundgesetz). 137. The regime in question involved the interception of both content and related communications data and aimed only to monitor foreign telecommunications outside of German territory. Such surveillance could be carried out for the purpose of gaining information about topics determined by the Federal Government’s mandate to be significant for the State’s foreign and security policy. It could, however, also be used to target specific individuals. The admissibility and necessity of the orders to conduct such surveillance was controlled by an Independent Panel. According to the Constitutional Court’s judgment, interception was followed by a multi-stage, fully automated filtering and evaluation process. For this purpose, the Federal Intelligence Service used a six-digit number of search terms which were subject to control by an internal sub-unit responsible for ensuring that the link between the search terms employed and the purpose of the data request was explained in a reasonable and comprehensive manner. After the application of the automated filtering process, intercepted material was either deleted or stored and sent for evaluation by an analyst. 138. The sharing of intercept material with foreign intelligence services was accompanied by a cooperation agreement which had to include usage restrictions and assurances to ensure that data were handled and deleted in accordance with the rule of law. 139. The Constitutional Court held that the regime in question was not compliant with the Basic Law. While it acknowledged the overriding public interest in effective foreign intelligence gathering, it nevertheless considered, inter alia, that the regime was not restricted to sufficiently specific purposes; that it was not structured in a way that allowed for adequate oversight and control; and that various safeguards were lacking, particularly with respect to the protection of journalists, lawyers and other persons whose communications required special confidentiality protection. 140. Regarding the sharing of intelligence obtained through foreign surveillance, the court again found the safeguards to be lacking. In particular, it was not specified with sufficient clarity when weighty interests might justify data transfers. In addition, while the court did not consider it necessary for a recipient State to have comparable rules on the processing of personal data, it nevertheless considered that data could only be transferred abroad if there was an adequate level of data protection and there was no reason to fear that the information would be used to violate fundamental principles of the rule of law. More generally, in the context of intelligence sharing, the court considered that cooperation with foreign States should not be used to undermine domestic safeguards and if the Federal Intelligence Service wished to use search terms provided to it by a foreign intelligence service it should first confirm the existence of the necessary link between the search terms and the purpose of the data request and that the resulting data did not disclose a particular need for confidentiality (for example, because they concerned whistle-blowers or dissidents). Although the court did not exclude the possibility of the bulk transfer of data to foreign intelligence services, it found that this could not be a continuous process based on a single purpose. 141. Finally, the court found that the surveillance powers under review also lacked an extensive independent and continual oversight serving to ensure that the law was observed and compensating for the virtual absence of safeguards commonly guaranteed under the rule of law. The legislator had to provide for two different types of oversight, which had also to be reflected in the organisational framework: firstly, a body resembling a court, tasked with conducting oversight and deciding in a formal procedure providing ex ante or ex post legal protection; and secondly, an oversight that was administrative in nature and could, on its own initiative, randomly scrutinise the entire process of strategic surveillance as to its lawfulness. In the Constitutional Court´s view, certain key procedural steps would, in principle, require ex ante authorisation by a body resembling a court, namely: the formal determination of the various surveillance measures (exemptions in cases of urgency were not ruled out); the use of search terms, insofar as these directly targeted individuals who might pose a danger and were thus of direct interest to the Federal Intelligence Service; the use of search terms that directly targeted individuals whose communications required special confidentiality protection; and sharing the data of journalists, lawyers and other professions meriting special confidentiality protection with foreign intelligence services. The United States of America
142. The United States’ intelligence services operate the Upstream programme pursuant to section 702 of the Foreign Intelligence Surveillance Act (“FISA”). 143. The Attorney General and Director of National Intelligence make annual certifications authorising surveillance targeting non-U.S. persons reasonably believed to be located outside the U.S. They do not have to specify to the Foreign Intelligence Surveillance Court (“FISC”) the particular non-U.S. persons to be targeted, and there is no requirement to demonstrate probable cause to believe that an individual targeted is an agent of a foreign power. Instead, the section 702 certifications identify categories of information to be collected, which have to meet the statutory definition of foreign intelligence information. Authorised certifications have included information concerning international terrorism, and the acquisition of weapons of mass destruction. 144. Pursuant to the authorisation, the NSA, with the compelled assistance of service providers, copies and searches streams of Internet traffic as data flows across the Internet. Both telephone calls and Internet communications are collected. Prior to April 2017 the NSA acquired Internet transactions that were “to”, “from”, or “about” a tasked selector. A “to” or “from” communication was a communication for which the sender or a recipient was a user of a section 702 tasked selector. An “about” communication was one in which the tasked selector was referenced within the acquired Internet transaction, but the target was not necessarily a participant in the communication. Collection of “about” communications therefore involved searching the content of communications traversing the Internet. However, from April 2017 onwards the NSA have not been acquiring or collecting communications that are merely “about” a target. In addition the NSA stated that, as part of this curtailment, it would delete the vast majority of previously acquired Upstream Internet communications as soon as practicable. 145. Section 702 requires the Government to develop targeting and minimization procedures which are kept under review by the FISC. 146. Executive Order 12333, which was signed in 1981, authorises the collection, retention and dissemination of information obtained in the course of a lawful foreign intelligence, counterintelligence, international narcotics or international terrorism investigation. Surveillance of foreign nationals under Executive Order 12333 is not subject to domestic regulation under FISA. It is not known how much data are collected under Executive Order 12333, relative to those collected under section 702. THE LAW
PRELIMINARY ISSUE: DATE OF ASSESSMENT
147. Before the Chamber the applicant sought a ruling on the Convention compatibility of the relevant Swedish legislation as it applied during three distinct periods (see paragraph 82 of the Chamber judgment). The Chamber decided to focus on the Swedish legislation as it stood at the time of its examination of the case (see paragraphs 96-98 of the Chamber judgment). 148. Before the Grand Chamber, the applicant did not reiterate its request concerning the three periods but relied in its submissions on, inter alia, developments from 2018 and 2019 post-dating the Chamber’s examination of the case. 149. The Government considered that, having regard to the Court’s case law according to which “the content and scope of the “case” referred to the Grand Chamber are ... delimited by the Chamber’s decision on admissibility”, the Grand Chamber’s review should be limited to the Swedish legislation as it stood at the time of the Chamber’s examination. 150. The Grand Chamber agrees with the Chamber that it cannot be the Court’s task, when reviewing the relevant law in abstracto, as in the present case, to examine compatibility with the Convention before and after every single legislative amendment. 151. The temporal scope of the Grand Chamber’s examination is therefore limited to the Swedish law and practice as it stood in May 2018, at the time of the Chamber examination. ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION
152. The applicant complained that the relevant legislation and practice in Sweden on bulk interception of communications, also referred to as signals intelligence, were in violation of its right to respect for private life and correspondence protected by Article 8 of the Convention. The Government contested that argument. 153. Article 8 of the Convention reads as follows:
“1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.”
The Government’s preliminary objection on victim status
1. The Chamber judgment
154. Applying the criteria set out in Roman Zakharov v. Russia ([GC], no. 47143/06, ECHR 2015), and Kennedy v. the United Kingdom (no. 26839/05, 18 May 2010), the Chamber considered that the contested legislation on signals intelligence instituted a system of secret surveillance that potentially affected all users and that no domestic remedy provided detailed grounds in response to a complainant who suspects that he or she has had his or her communications intercepted. In these circumstances, the Chamber considered an examination of the relevant legislation in abstracto to be justified and concluded that the applicant could claim to be the victim of a violation of the Convention, even though it was unable to allege that it had been subjected to a concrete measure of interception. For the same reasons the Chamber concluded that the mere existence of the contested legislation amounted in itself to an interference with the applicant’s rights under Article 8. 2. The parties’ submissions before the Grand Chamber
(a)   The Government
155. The Government stated that the applicant did not belong to a “group of persons or entities targeted by the legislation” on signals intelligence within foreign intelligence. 156. In the Government’s view, furthermore, the contested legislation did not directly affect all users of mobile telephone services and the internet since it was restricted to foreign intelligence, and thereby foreign circumstances. 157. Referring to the six stages of signals intelligence activities as described by them (see paragraph 29 above), the Government claimed that the applicant’s telephone and internet communications were unlikely to be affected for the following reasons: the majority of purely domestic communications would not pass the hand-over points in cross-border cables; even if that happened, the selectors used to identify relevant signals are designed with great precision as regards targeted foreign phenomena and the selectors are subject to approval by the Foreign Intelligence Court; as a result of the above, the applicant’s communications are unlikely to be sifted out in the above automatic processing; any data passing through the communications bearers that has not been selected disappears without any possibility to be reproduced and examined by the FRA; even if the applicant’s data or communications reached the third stage in the bulk interception process, there will be then further refining through automatic and manual means and the risk of the applicant’s communication being retained for further scrutiny beyond that stage is virtually non-existent. 158. In the Government’s view, there is no interference with Article 8 rights until the stage when an analytical examination of selected signals is possible. 159. The Government were also of the view that Swedish law affords effective remedies for a person who suspects that he or she was subjected to signals interception measures, including the possibility to file a request with the Foreign Intelligence Inspectorate and, as a result, obtain a notification whether or not any improper data collection has taken place. In the Government’s view, the Chamber’s insistence that there should be, in addition to the above, “detailed grounds” given in response, was not based on earlier case-law and unduly expanded the relevant requirements. 160. On this basis the Government considered that the applicant might only claim to be a victim of a violation occasioned by the mere existence of impugned legislation if it was able to show that, due to its “personal” situation, it was potentially at risk of being subjected to signals intelligence measures. That was far from being so. Quite to the contrary, the applicant’s telephone and internet communications were unlikely to be intercepted and sifted and, in any event, the risk that they would be retained for further scrutiny beyond the automatic processing stage was virtually non-existent. 161. The Government thus requested the Grand Chamber to declare the application inadmissible for lack of victim status or to find that there was no interference with the applicant’s Article 8 rights. 162. As to other admissibility issues, the Government stated that they did not have objections regarding the exhaustion of domestic remedies. (b)   The applicant
163. The applicant considered that the relevant two conditions for claiming victim status in applications concerning the very existence of a legal regime for secret surveillance, as enunciated in Roman Zakharov (cited above), were satisfied in the present case. 164. In particular, the Signals Intelligence Act permits the interception of any communications travelling along the cables that cross the Swedish border, or that are transmitted via the airways, and therefore, according to the applicant, directly affects all users of such communication services. Even though only communications relating to foreign circumstances are allowed to be intercepted, virtually all users of communications services may engage in cross-border communications, either deliberately by contacting a foreign recipient or inadvertently through communicating via a server located abroad. Also, the Signals Intelligence Act permits interception for development purposes unrelated to foreign circumstances. 165. The applicant also submitted that there is no effective remedy at the national level for the applicant or for anyone suspecting that they may have been subject to bulk interception by the Swedish authorities. Therefore, the applicant must be able to have its case examined by the Court and can claim that the very existence of the impugned regime amounts to an interference with its Article 8 rights. 3. The Court’s assessment
166. As the Court noted in Kennedy and Roman Zakharov (both cited above), in cases concerning secret measures, there are special reasons justifying the Court’s departure from its general approach, according to which individuals cannot challenge before it a domestic law in abstracto. The principal reason is to ensure that the secrecy of surveillance measures should not result in them being effectively unchallengeable and outside the supervision of the national judicial authorities and the Court (see Roman Zakharov, cited above, § 169). 167. It is now settled case-law that several criteria apply in assessing whether an applicant may claim to be the victim of a violation of his or her Convention rights allegedly occasioned by the mere existence of secret surveillance measures, or legislation permitting secret surveillance measures. Those criteria were formulated as follows in Roman Zakharov (cited above, § 171):
“Firstly, the Court will take into account the scope of the legislation permitting secret surveillance measures by examining whether the applicant can possibly be affected by it, either because he belongs to a group of persons targeted by the contested legislation or because the legislation directly affects all users of communication services by instituting a system where any person can have his communications intercepted. Secondly, the Court will take into account the availability of remedies at the national level and will adjust the degree of scrutiny depending on the effectiveness of such remedies. ...[W]here the domestic system does not afford an effective remedy to the person who suspects that he was subjected to secret surveillance, widespread suspicion and concern among the general public that secret surveillance powers are being abused cannot be said to be unjustified... In such circumstances the threat of surveillance can be claimed in itself to restrict free communication through the postal and telecommunication services, thereby constituting for all users or potential users a direct interference with the right guaranteed by Article 8. There is therefore a greater need for scrutiny by the Court, and an exception to the rule denying individuals the right to challenge a law in abstracto is justified. In such cases the individual does not need to demonstrate the existence of any risk that secret surveillance measures were applied to him. By contrast, if the national system provides for effective remedies, a widespread suspicion of abuse is more difficult to justify. In such cases, the individual may claim to be a victim of a violation occasioned by the mere existence of secret measures or of legislation permitting secret measures only if he is able to show that, due to his personal situation, he is potentially at risk of being subjected to such measures.”
168. Applying those criteria to the present case, the Court agrees with the Government that the applicant does not belong to a group of persons or entities targeted by the Swedish signal intelligence legislation and measures. Indeed, the applicant has not made such a claim. 169. It must be seen, therefore, whether, as alleged by the applicant, the impugned legislation institutes a system of secret surveillance that potentially affects all persons communicating over the telephone or using the internet. 170. In this regard, it is clear that communications or communications data of any person or entity in Sweden may happen to be transmitted via intercepted communications bearers and may thus be subject to at least the initial stages of automatic processing by the FRA under the contested legislation. 171. The Government’s arguments that signals intelligence is restricted to foreign threats and circumstances and that therefore there is virtually no risk of the applicant’s communications being retained for further scrutiny beyond the automatic processing stage in bulk interception are relevant in the assessment of the intensity and proportionality of the interference with Article 8 rights, including the safeguards built into the impugned signals interception regime, but are not decisive with regard to the applicant’s victim status under Article 34 of the Convention. Any other approach risks rendering the access to the Convention complaints’ procedure conditional on proving that one’s communications are of interest for agencies tasked with foreign intelligence – an almost impossible task, having regard to the secrecy inherent in foreign intelligence activities. 172. In these circumstances, the Court must have regard to the remedies available in Sweden to persons who suspect that they were subjected to measures under the Signals Intelligence Act in order to assess whether, as maintained by the applicant, the threat of surveillance can be claimed in itself to restrict free communication, thereby constituting for all users or potential users a direct interference with the right guaranteed by Article 8. 173. In this regard, the Court observes that, in practice, persons affected by bulk interception activities do not receive notification. On the other hand, in reaction to a request by anyone, regardless of nationality and residence, the Foreign Intelligence Inspectorate must investigate if the person’s communications have been intercepted through signals intelligence and, if so, verify whether the interception and treatment of the information have been in accordance with law. The Inspectorate has the power to decide that the signals intelligence operation shall cease or that the intelligence shall be destroyed. Any person may also seek the involvement of the Parliamentary Ombudsmen and the Chancellor of Justice in a number of circumstances. 174. The applicant alleged, however, that the only information that might be given by the Inspectorate, without any reasons for the conclusions reached and in the form of a final decision not amenable to appeal, was that there had been an unlawful action. No other remedy could result in the complainant obtaining additional information on the circumstances of a possible interception and use of his or her communications or related data or about the nature of the unlawful action, if it occurred. 175. In the context of the issue of victim status, without prejudice to the conclusions to be drawn in respect of the substantive requirements of Article 8 § 2 and Article 13 in the present case, the Court notes that the domestic remedies available in Sweden to persons who suspect that they are affected by bulk interception measures are subject to a number of limitations. In the Court’s view, even if these limitations are to be considered inevitable or justified, the practical result is that the availability of remedies cannot sufficiently dispel the public’s fears related to the threat of secret surveillance. 176. It follows that it is not necessary to examine whether the applicant, due to its personal situation, is potentially at risk of seeing its communications or related data intercepted and analysed. 177. On the basis of the above considerations the Court finds that an examination of the relevant legislation in abstracto is justified. The Government’s objection that the applicant may not claim to be the victim of a violation of his or her Convention rights allegedly occasioned by the mere existence of Swedish bulk interception legislation and activities is therefore rejected. Merits The Chamber judgment

178. The Chamber found that the surveillance system clearly had a basis in domestic law and was justified by national security interests. Indeed, given the present-day threats of global terrorism and serious cross-border crime, as well as the increased sophistication of communications technology, the Court held that Sweden had considerable power of discretion (“a wide margin of appreciation”) to decide on setting up such a system of bulk interception. The State’s discretion in actually operating such an interception system was narrower, however, and the Court had to be satisfied that there were adequate and effective guarantees against abuse. It assessed the minimum safeguards to avoid abuse of power, as developed in its case-law and, in particular, in Roman Zakharov (cited above; see paragraphs 99-115 of the Chamber judgment). 179. Overall, while the Chamber found some areas where there was scope for improvement of the system, notably the regulation of the communication of personal data to other States and international organisations and the practice of not giving public reasons following a review of individual complaints (see paragraphs 150, 173 and 177 of the Chamber judgment), it considered that the system revealed no significant shortcomings in its structure and operation. In this context, it noted that the regulatory framework had been reviewed several times with a view to enhancing protection of privacy and that it had in effect developed in such a way that it minimised the risk of interference with privacy and compensated for the lack of openness of the system (see paragraphs 180 and 181 of the Chamber judgment). 180. More specifically, the scope of the interception and the treatment of intercepted data were clearly defined in law; the duration of the measures were clearly regulated (any permit was valid for a maximum of six months and renewal required a new review); the authorisation procedure was detailed and entrusted to a judicial body, the Foreign Intelligence Court; there were several independent bodies, in particular the Foreign Intelligence Inspectorate and the Data Protection Authority, tasked with the supervision and review of the system; and, on request, the Inspectorate had to investigate individual complaints of intercepted communications, as did the Parliamentary Ombudsmen and the Chancellor of Justice (see paragraphs 116-47 and 153-78 of the Chamber judgment). 181. The Chamber therefore found that the Swedish system of signals intelligence provided adequate and sufficient guarantees against arbitrariness and the risk of abuse. The relevant legislation met the “quality of law” requirement and the interference could be considered as being “necessary in a democratic society”. Furthermore, the structure and operation of the system were proportionate to the aim sought to be achieved. The Chamber pointed out, however, that its examination had been made in abstracto and did not preclude a review of the State’s liability under the Convention where, for example, the applicant has been made aware of an actual interception (see paragraphs 179-81 of the Chamber judgment). The parties’ submissions
(a) The applicant
(i)      The applicant’s view on the standard to be applied
182. According to the applicant, bulk interception regimes are inherently incompatible with the Convention. In Klass and Others v. Germany (6  September 1978, § 51, Series A no. 28) and Association “21 December 1989” and Others v. Romania (nos. 33810/07 and 18817/08, §§ 174-75, 24  May 2011), the Court had considered “exploratory” or “general surveillance” as problematic. As regards untargeted interception, solely regimes far more confined in scope than the Swedish regime had been found to be compatible with the Convention. Seeing that FRA could gain access to virtually all cable-based communisations crossing the Swedish border, the amount of intimate, private and privileged data that could be surveyed under the Swedish signals intelligence regime was far greater. Therefore, the applicant considered that only targeted and smaller-scale untargeted interception regimes could fall within the State’s margin of appreciation. Any other approach risked leading to inconsistent case-law having regard to the Court’s approach to other Convention issues, such as blanket retention of fingerprints and DNA profiles, dealt with in S. and Marper v. the United Kingdom ([GC], nos. 30562/04 and 30566/04, § 115, ECHR 2008). 183. If the Court considered that bulk interception activities may be justified under the Convention, the applicant submitted that robust minimum safeguards were imperative. The factors outlined in Roman Zakharov (cited above, § 238) could serve as an initial framework, but untargeted surveillance entailed elevated privacy risks and required these standards to be adapted. 184. In particular, the main elements of the regime should be set out in sufficient detail in statute law. That would ensure that it is the representative of the people who strike the balance between the competing interests. 185. As regards prior authorisation, while it accepted that the body entrusted with this task in Sweden is a judicial one, the applicant invited the Court to move one step further in its case-law and hold that prior authorisation must always be judicial. 186. In addition, in the applicant’s view, the authorising body should be capable of verifying the existence of a reasonable suspicion in relation to any person singled out or targeted. The applicant found unconvincing the Chamber’s departure, in the present case and in Big Brother Watch and Others v. the United Kingdom, nos. 58170/13 and 2 others, 13 September 2018, from this allegedly established requirement. The use of personalised selectors to single out and collect data on an individual, albeit in the bulk interception context, should be subject to the same threshold as applied to targeted interception. Otherwise, such selectors can be used as a work-around method for targeting individuals. 187. If there are no predefined targets, on the other hand, the authorising body should be capable of verifying that personal data is used in selectors only to the extent that it is material to a narrowly specified foreign intelligence objective. The latter is necessary because the use of selectors relating to specific individuals exposes them to distinct privacy risks, including about intimate matters and opinions. 188. In the applicant’s view, furthermore, the authorising judicial body should be provided with an indication of how the data will be analysed and used (for example, via pattern-based or subject-based analysis, and whether profiles of individuals will be compiled). 189. As regards supervision at the stages of carrying out the surveillance activities and after they have been terminated, the applicant accepted that the Swedish oversight bodies meet the requirement of sufficient independence from the executive. 190. However, the oversight body must be vested with sufficient powers to issue legally binding decisions, including stopping and remedying breaches and seeking the liability of those responsible for such breaches. It should have access to classified documents and its functioning should be open to public scrutiny. The supervision powers should concern both content and communications data and should be exercised at the stages when collected communications are subject to automated computer analysis, where a human analyst works on them and where information is communicated to national authorities, foreign Governments or international organisations. Storage of data at each stage should also be supervised. 191. In the applicant’s view, in addition, individuals must dispose of effective remedies which may take three forms: post-fact notification of the subject of surveillance, a possibility to request information about the surveillance or the existence of a body that can examine complaints without requiring the individual to submit evidence. 192. As regards transmitting intercepted material to foreign actors, the applicant underlined that Contracting States do not have unfettered discretion as they cannot outsource data processing and analysis in such a manner as to avoid responsibility under the Convention. The applicant considered that the minimum standards must include accessible legal provisions, clear legal conditions for sharing, including a duty to take reasonable steps to ensure that the receiving party protects the data with similar safeguards as those applicable at home and sufficient supervisory and remedial mechanisms. (ii)     The applicant’s analysis of the impugned Swedish regime
193. Applying these standards to the impugned Swedish regime, the applicant stated that the general scope of application of the FRA’s powers is sufficiently constrained with the exception of the wide discretion it enjoys regarding its development activities. However, the applicant expressed concern that since 1 January 2013 the Security Police and the National Operative Department of the Police Authority (the “NOA”) had been empowered to issue tasking directives for signals intelligence, and that as of 1 March 2018, the Security Police might be granted direct access to the FRA’s databases with analysis material. The risk of signals intelligence being used outside the scope of foreign intelligence activities must be sufficiently contained by clear legal provisions and effective supervision. 194. The applicant also alleged that while warrants under the Swedish Signals Intelligence Act have a clear expiry date, there is no requirement that a warrant must be cancelled if collection of communication under the warrant ceases to be necessary. 195. The applicant further considered that the scope of judicial review by the authorising body in Sweden, the Foreign Intelligence Court, was too narrow to be effective. In particular, the existence of a reasonable suspicion in relation to a person who is singled out is not verified and the “exceptional importance” criterion, justifying selectors relating directly to an individual, only refers to selectors employed in the automated collection of data, not to the stage when the collected data is further searched. Also, the Foreign Intelligence Court is not required to review the intended subsequent use of the collected data and, indeed, the warrant request does not specify how the data will be analysed – for example, via subject-based data mining or through compilation of profiles of individuals. 196. As regards storing, accessing, examining, using and destroying intercepted data, the applicant identified two major flaws in the Swedish system: lack of legal obligation for the FRA to keep detailed records of the interception, use and communication of data, for which it had been repeatedly criticised by the Swedish Data Protection Authority, and lack of rules specifically adapted to bulk interception as opposed to general rules on data processing. The applicant was further concerned that as of 1 March 2018 the Security Police may be granted direct access to FRA’s databases with analysis material. 197. The applicant also alleged that legal persons did not enjoy adequate protection since the FRA Data Processing Act only applies to intercept material containing personal data. This allegedly resulted in a situation where material not containing personal data may be kept forever and used for purposes incompatible with the original purpose of collection. 198. The applicant criticised the following features of the existing supervision system. First, while the Inspectorate may decide that an operation shall cease or that the collected intelligence must be destroyed if it finds incompatibility with a warrant granted by the Foreign Intelligence Court, it does not have the power to issue binding decisions where the warrant is deemed unlawful. The Inspectorate cannot grant compensation or seek the liability of those responsible for breaches. Second, neither the Data Protection Authority, nor the Chancellor of Justice or the Ombudsmen may issue legally binding decisions. The Data Protection Authority may only apply to the Administrative Court in Stockholm to have illegally processed data destroyed. Furthermore, none of the complaints that have been submitted to the Chancellor and the Ombudsmen in relation to the FRA’s activities has been successful. Those bodies are not specialised in the FRA’s activities and do not possess the knowledge and capacity to supervise them effectively. 199. The applicant made the following submissions as regards the remedies available under the impugned Swedish regime. First, in its view the notification provided for under section 11(a) of the Signals Intelligence Act only concerns natural persons, not organisations, and may be disapplied if required for reasons of secrecy, which has happened invariably in practice. This remedy was therefore “theoretical and illusory”. The possibility to request the FRA to inform an individual whether personal data concerning him or her had been processed was also subject to the secrecy rule and the Administrative Court that examines ensuing appeals would not have access to secret documents and would be unable to review the FRA’s assessment on whether secrecy applies. This remedy too is unavailable to legal persons as the applicant. Second, the applicant referred to powers of the IPT in the United Kingdom to hear complaints of unlawful interception without the need for the complainant to prove that they had been subject to surveillance. The IPT, an independent judicial body, had access to secret documents, could take binding decisions and award compensation. Its decisions were published. The applicant submitted that a similar remedy was lacking in Sweden. Third, as regards the possibility under Swedish law to ask the Inspectorate to investigate whether an individual’s communications have been intercepted, the applicant noted that the Inspectorate did not inform the individual concerned of its findings and only sent standardised replies that no unlawful surveillance had taken pace. The applicant reiterated their view that the Inspectorate had no power to control compliance with the law and the Constitution and could not order the payment of compensation. Fourth, the applicant considered that seeking compensation from the Chancellor of Justice was not an effective remedy because: (i) the individual bears the burden to prove that there had been unlawful surveillance; (ii) compensation without erasing the unlawfully processed data could not be regarded as an effective remedy; (iii) to date the Chancellor, who enjoys discretion as to which complaints to review, had dismissed all complaints concerning the FRA’s activities; (iv) the Government had not shown the effectiveness of this remedy, seeing that it is unclear what action must be undertaken by the Chancellor upon receipt of a report from the Inspectorate informing about actions of the FRA that may give rise to a claim of damages: in particular, if the Chancellor were to provide the individual with an opportunity to claim damages, that would require advising him or her of the unlawful conduct of the FRA which could be precluded by secrecy. Fifth, in the absence of notification or access to documents it is virtually impossible for an individual to discharge the burden of proof in a civil action for damages. Sixth, the Ombudsmen could not order any redress and no examples of the effectiveness of this remedy have been shown. Seventh, the procedure according to which the FRA could correct or destroy unlawfully processed personal data was dependent on the individual’s knowledge that data had been processed and was ineffective due to the secrecy requirement. Also, the Administrative Court has never received applications form the Data Protection Authority seeking the erasure of unlawfully processed data. Finally, the possibility to seek prosecution was also dependent on the individual knowing of relevant wrongdoing and thus ineffective. 200. On the issue of transfers of intercepted data to foreign third parties, the applicant submitted that the deficiencies in the Swedish legal regime and practice were glaring. The legal limitations on such transfers consisted of nothing more than a vague and broadly defined obligation to act in the national interest. There was no requirement that possible harm to the individual is to be taken into account or that the recipient is to be required to protect the data with similar safeguards as those applicable in Sweden. 201. The applicant disagreed with the finding of the Chamber that the above shortcomings were counterbalanced by the supervisory mechanisms of the Swedish system. It considered that this supervision was inadequate and in any event did not cover the transfer of intercepted data to foreign parties. The FRA was merely required to inform the Inspectorate of the principles governing its cooperation with foreign parties, identify the countries or international organisations to which data was transferred and provide general details of operations. As the Inspectorate monitors the FRA’s activities for compliance with existing legal requirements and the law allows excessive discretion to the FRA in this area, even the most stringent policing by the Inspectorate could do little to provide safeguards against abuse. In the applicant’s view, the arrangements described above cannot constitute a practice compatible with the Convention as they allow to simply outsource otherwise unlawful activities without appropriate limits safeguarding fundamental rights. (b) The Government
202. The Government submitted that the purpose of signals intelligence was to obtain information and identify phenomena of relevance for foreign intelligence. Foreign intelligence was essential for Sweden’s national security and also relevant with regard to Sweden’s positive obligations under the Convention to protect the lives and safety of the public. 203. In the Government’s view, owing to the fact that the Court’s case-law setting out minimum safeguards for secret surveillance measures concerns, with the exception of the present case and Big Brother Watch, criminal investigations, some of the minimum safeguards required by the Court presuppose a link to a certain individual or to a certain place. This is very different from signals intelligence, which cannot be used to investigate criminal offences and one of the duties of the Foreign Intelligence Court is to ensure that it is not so used. Signals intelligence as part of foreign intelligence may in many cases target specific individuals’ communications but the individuals are most often not of interest per se: they are only carriers of information. 204. It was necessary, therefore, to adapt the relevant requirements, including by reformulating some of the criteria set out in the Court’s case-law as follows: introducing the criterion “the circumstances in which the measures may be used” instead of “the nature of the offences” and “categories of persons targeted”. Also, account must be taken of the fact that national security threats are by their nature variable and difficult to define in advance. 205. The Government strongly disagreed with the applicant who had claimed, on the basis of Roman Zakharov (cited above) and Szabó and Vissy v. Hungary (no. 37138/14, 12 January 2016), that the existence of a reasonable suspicion was required at least when selectors linked to a specific individual were used. In the Government’s view no such requirement could be deducted from the above-cited case-law. The Government supported the Chamber’s reasoning in paragraph 317 in Big Brother Watch, where the Court held that the requirements of “reasonable suspicion” and “subsequent notification” are incompatible with bulk interception regimes. 206. The Government further asserted that bulk interception in Sweden was regulated by a comprehensive legal regime that was based on published legal provisions and provided for significant safeguards, including independent supervision, covering both surveillance activities related to communications data and to the content of communications. The law clearly delimited the scope of the surveillance activities, the mandate given to the competent authorities in this regard and the manner of its exercise. 207. As regards the FRA’s development activities, the Government emphasised that they are rigorously regulated and subject to all substantive and procedural requirements applicable to signals intelligence in general. In development activities, which are crucial to permit the FRA to adjust its tools, systems and methods to an ever-changing signals environment and technical developments, it is the flow of traffic and the systems through which information is transmitted that are of interest. To maintain the FRA’s capabilities, it would be far too restrictive if development activities were only allowed for the eight purposes that circumscribe signals intelligence. 208. There was, furthermore, a prior authorisation procedure before the Foreign Intelligence Court, whose president is a permanent judge and the other members are appointed by the Government on four-year terms. In the exceptional cases of urgency when the FRA may itself grant a signals intelligence permit, that court must be immediately notified and it may modify or revoke the permit, with the consequence that collected data must be destroyed. If the permit granted by the FRA, not by the court, contains access to certain communications bearers, such access can only be realised by the Swedish Foreign Intelligence Inspectorate which will have the possibility to estimate the relevant legal aspects. 209. The Foreign Intelligence Court holds public hearings except when required by secrecy considerations. The Government submitted that the latter limitation on transparency was justified and was compensated by safeguards, such as the presence of a privacy protection representative at the court’s private hearings. The representative defends the public interest, is given full access to case documents and can make statements. He or she is a permanent judge or a former permanent judge or a member of the Swedish Bar Association. 210. The Government emphasised that the FRA must seek a permit in respect of each mission and must specify the assignment, the bearers to which access is sought and the selectors or at least the categories of selectors to be used. The court examines not only the formal lawfulness but also the proportionality to the expected interference. The permit must specify all parameters, including the conditions needed to limit such interference. 211. As regards safeguards on the duration of the interception, Swedish law limited it to six months, subject to extension following full review by the Foreign Intelligence Court. Also, interception is discontinued if a tasking directive is revoked or expires, if interception is not in accordance with the permit and if it is no longer needed. 212. Adequate safeguards also exist in respect of the procedures for storing, accessing, examining, using and destroying intercepted data. These safeguards include limiting processing to what is adequate and relevant to its purpose, vetting of staff and their duty of confidentiality and sanctions in case of mismanagement of data. Also, intelligence must be destroyed immediately in a number of circumstances, including, inter alia, where it concerns constitutionally protected media sources or legal professional privilege in relations between a criminal suspect and his lawyer. Moreover, if the intercepted communications prove to be entirely domestic, the intercepted data must also be destroyed. 213. As regards the conditions for communicating the intercepted data to other parties, the FRA has a regulated obligation to report to the Swedish authorities concerned but ensures that personal data is only reported if it is of relevance for the purposes for which foreign intelligence may be conducted. Compliance with this requirement is monitored by the Foreign Intelligence Inspectorate. 214. The Government emphasised that despite the provision allowing the FRA to give direct access to its completed intelligence reports to the Government Offices, the Armed Forces, the Security Police and three other bodies, no decisions permitting such access have yet been taken by the FRA. The Government clarified in addition that, since 1 March 2018, under section 15 of the FRA Personal Data Protection Act, the Security Police and the Armed Forces may be granted direct access to data that constitutes the analysis results in a data compilation for analyses, so as to allow these two authorities to be able to make strategic assessments of terrorist threats. This changes nothing with regard to the prohibition to use signals intelligence within foreign intelligence for the purposes of investigating criminal offences. 215. Finally, with regard to communication of personal data to other States and to international organisations, the Government disagreed with the Chamber which had found shortcomings in the relevant legal regime (see paragraph 150 of the Chamber judgment). They submitted, inter alia, that the FRA must report to the Ministry of Defence before it establishes and maintains cooperation with other states and international organisations and inform the ministry about important issues that occur in the process of such cooperation. Furthermore, the FRA must inform the Swedish Foreign Intelligence Inspectorate of the principles that apply to its relevant cooperation and provide details of the countries and organisations with which such cooperation takes place. When cooperation is established, the FRA must inform the Inspectorate of the scope of the cooperation and, where deemed warranted, of the results, experience and continued direction of the cooperation. 216. The Government also pointed to the fact that in international cooperation data is exclusively communicated to parties that are themselves engaged in foreign intelligence, which meant that it is in the recipient’s interest to protect the data received. The trust between the parties is based on a mutual interest in maintaining the security of the data. Also, the FRA’s general guidelines stipulate that international cooperation is conditional on the receiving State respecting Swedish legislation. Foreign partners receive information and training on the relevant content of Swedish legislation. As the Inspectorate has a clear mandate to control the FRA’s international cooperation, any change to its internal guidelines would not go unnoticed. There are therefore clear safeguards against circumventing Swedish law. 217. In the Government’s view, Sweden’s system of supervision on signals intelligence offered important safeguards. The Foreign Intelligence Inspectorate is independent, has access to all relevant documents, examines the selectors used and has the power to decide that data collection must cease or the data collected be destroyed if the terms of the relevant permit have not been complied with. The Inspectorate also ensures that the FRA is only provided access to communications bearers insofar as such access is covered by a permit. The Inspectorate submits annual public reports and is subject to audit by the National Audit Office and supervision by the Parliamentary Ombudsmen and the Chancellor of Justice. As regards personal data, the Swedish Data Protection Authority has general supervisory functions. In the Government’s view, this kind of supervision by independent non-judicial bodies is adequate and in conformity with the Court’s case-law. 218. The Government submitted that between 2009 and 2018 the Inspectorate had conducted 113 audits of the FRA resulting in 18 opinions. At least seventeen of these audits served, inter alia, to control that the FRA was using selectors in a way compatible with the permit issued by the Foreign Intelligence Court and at least nine audits included issues of data destruction. A number of audits also concerned the FRA’s handling of personal data. Only very few observations or opinions ensued from the audits. During the same time period, the Inspectorate carried out 141 controls at the request of an individual on whether his or her communications had been the subject of unlawful signals intelligence. None of those showed improper signals collection. There were also several thematic reviews of the FRA’s activities, such as on compliance with the limits imposed by the permits. 219. The Government also submitted that there are several remedies by which an individual may initiate an examination of the lawfulness of measures taken during the operation of the signals intelligence system. These include a request to the Inspectorate which may result in notification whether anything improper had taken place, a request to the FRA on whether personal data concerning him or her has been processed, applications to the Parliamentary Ombudsmen, the Chancellor of Justice and the Data Protection Authority, an action for damages and reporting a matter for prosecution. Some of these remedies are not dependent on prior notification being made to an individual. While systematic notification was impossible, it is significant that the FRA is obliged to inform a natural person if selectors directly related to him or her have been used, except where secrecy applies. 220. The Government also stated that no distinction is made in Swedish law on bulk interception between content and communications data, all safeguards applying equally to both. In practice, using communications data to discover unknown threats requires putting together various pieces of such data to establish a picture from which conclusions can be drawn. This requires that the selectors used for intercepting communications data are less specific than those used for the content of communications and that data is available for examination by an analyst over a period of time. No other differences exist. 221. In conclusion, the Government submitted that the impugned regime on signals intelligence within foreign intelligence reveals no significant shortcomings in its structure and operation. The risk of interference with privacy is minimised and sufficient guarantees against arbitrariness are in place. The regime as a whole is lawful and proportionate to the legitimate aim of protecting national security. Third intervening parties
(a)   The Government of the Republic of Estonia
222. The Estonian Government considered that the criteria for the assessment of the Convention compatibility of secret surveillance regimes, as developed in the Court’s case-law, needed adaptation to reflect the specific nature of bulk interception of communications as a foreign intelligence activity. The differences between such an activity and surveillance in the criminal investigation context must be taken into account. Foreign intelligence aims at detecting threats to national security and is therefore broader in its scope. Also, it is a long-term activity that requires a higher level of secrecy over a very long period of time. 223. On this basis, the Estonian Government, referring to the criteria for assessment used in Roman Zakharov (cited above, § 231), agreed with the Chamber that the “nature of the offences” and “reasonable suspicion” criteria were not appropriate and stated that, instead of the “categories of people” criterion, domestic law should indicate “the fields in which bulk interception of cross-border communications may be used to gather intelligence”. As to notification of affected persons, in the view of the intervening Estonian Government no such obligation should be imposed because of the importance of secrecy in foreign intelligence. (b)   The Government of the French Republic
224. The French Government, emphasising the importance of bulk interception activities for the identification of unknown threats, considered that the criteria for assessing their Convention compatibility, as developed in Weber and Saravia v. Germany ((dec.), no. 54934/00, ECHR 2006‑XI) and Roman Zakharov (cited above), were relevant in the present case. However, in their view, there should be no “reasonable suspicion” requirement, having regard to the specific nature of bulk interception operations, which are different from the secret surveillance of a specific individual. 225. The French Government further considered that States enjoy a wide margin of appreciation in operating bulk interception regimes and that the assessment whether the applicable guarantees against abuse were sufficient must always be made in concreto, having regard to the relevant legislation seen as a whole. The Chamber in the present case had done exactly that, noting that despite the fact that some improvements were desirable, the Swedish system as a whole did not disclose significant shortcomings. However, in the case of Big Brother Watch and Others (cited above), the Chamber had applied a stricter scrutiny and unjustifiably found violations of Articles 8 and 10 of the Convention. The French Government advocated against the latter approach. In particular, they considered that a bulk interception regime that did not include judicial pre-authorisation was compatible with Article 8 as long as there was a mechanism for a posteriori supervision by an independent body. 226. The French Government also expressed the view, supported by references to case-law, that the interception and processing of communications data interfered with privacy rights in a less significant manner than the interception and processing of the content of communications and that, therefore, should not be subject to the same guarantees for the protection of the right to private life. 227. As regards intelligence sharing, the French Government stressed the importance of secrecy and the fact that the procedures and guarantees applied can vary from one State to another. They further elaborated on several relevant criteria, in particular, in the context of receiving and using intercepted data from foreign partners. (c)   The Government of the Kingdom of the Netherlands
228. The Government of the Kingdom of the Netherlands submitted that bulk interception was necessary to identify hitherto unknown threats to national security. In order to protect national security, intelligence services needed the tools to investigate emerging threats in a timely and effective manner. For this they needed the powers necessary to enable them to detect and/or prevent not only terrorist activities (such as planning of attacks, recruitment, propaganda and funding), but also intrusive State or non-State actors’ cyber activities aimed at disrupting democracy (for example, by influencing national elections or obstructing investigations by national and international organisations). An example of this was the attempted hacking of the investigation of the use of chemical weapons in Syria by the Organisation for the Prohibition of Chemical Weapons in The Hague. Moreover, the increasing dependency of vital sectors on digital infrastructures meant that such sectors, including water management, energy, telecoms, transport, logistics, harbours and airports, were increasingly vulnerable to cyber-attacks. The consequences of disruption in such sectors would have a deep impact on society, far beyond the substantial monetary damage. 229. A complicating factor in all of this was the development of new means of digital communication and the exponential increase of data that was transmitted and stored globally. In many instances the nature and origin of a particular threat was unknown and the use of targeted interception was not feasible. However, while bulk interception was not as tightly defined as targeted interception, it was never completely untargeted. Rather, it was applied for specific aims. 230. In the intervening Government’s view, there was no need for additional or updated minimum requirement; the minimum safeguards; those previously identified by the Court were sufficiently robust and “future proof”. The additional requirements proposed by the applicant – in particular, the requirement to demonstrate “reasonable suspicion” – would unacceptably reduce the effectiveness of the intelligence services without providing any meaningful additional protection of individuals’ fundamental rights. 231. Furthermore, according to the intervening Government, it was still relevant to distinguish between content and communications data, as the content of communications was likely to be more sensitive than communications data. The intervening Government also agreed with the Chamber that it was wrong automatically to assume that bulk interception constituted a greater intrusion into the private life of an individual than targeted interception, since once targeted interception takes place it was likely that all, or nearly all, of the intercepted communications would be analysed. This was not true of bulk interception, where restrictions on the examination and use of data determined the intrusiveness of the interception on the individuals’ fundamental rights. 232. Finally, the intervening Government submitted that any requirement to explain or substantiate selectors or search criteria in the authorisation would seriously restrict the effectiveness of bulk interception in view of the high degree of uncertainty regarding the source of a threat. Ex post oversight provided sufficient safeguards. (d)   The Government of the Kingdom of Norway
233. The Norwegian Government submitted that, with regard to the decision of States to introduce and operate some form of bulk interception regime for national security purposes, the margin of appreciation had to be wide. This was because intelligence services had to keep pace with the rapid advances in information and communications technology. Hostile actors changed their devices and digital identities at a pace which made it difficult to track them over time. It was also difficult to discover and counteract hostile cyber operations in a timely manner without tools capable of discovering anomalies and relevant signatures. It was therefore without doubt that modern capacities like bulk interception were needed in order to find unknown threats operating in the digital domain and to enable the services to discover and follow relevant intelligence threats. 234. As a consequence, the Court’s oversight should be based on an overall assessment of whether the procedural safeguards against abuse which are in place are sufficient and adequate. It should therefore avoid enumerated and absolute requirements. It should also not apply criteria that would undermine indirectly the wide margin of appreciation afforded to States in deciding to operate a bulk interception regime for national security reasons. A “reasonable suspicion” or “subsequent notification” requirement would have this effect. 235. Finally, the Norwegian Government encouraged the Court to refrain from importing concepts and criteria from the CJEU. First of all, at the relevant time nineteen Council of Europe Contracting States were not members of the European Union. Secondly, while the Convention and the Charter of Fundamental Rights had many features in common, there were also differences, most notably Article 8 of the Charter which contained a right to the protection of personal data. The CJEU also formulated “proportionality” differently, using a “strict necessity” method which did not compare to that used by the Court.

Outcome for Article 8: violation