Case Summary and Outcome

The European Court of Human Rights found that the signals intelligence regime in Sweden, which allowed for the bulk interception of certain online communications, was not in violation of the right to respect for correspondence. The case concerned a complaint brought by a Swedish non-profit foundation alleging that legislation permitting the bulk interception of electronic signals in Sweden for foreign intelligence purposes breached its privacy rights. The European Court of Human Rights examined the legislation for the regime in abstract because, among other things, the foundation was incapable of establishing whether it had been subject to secret surveillance measures. Although the Court found some shortcomings in the Swedish legislation, in particular its intelligence sharing regime and the lack of public reasons for decisions reached by one of its oversight bodies, it held that the Swedish system of bulk interception provided adequate and sufficient safeguards against arbitrariness and the risk of abuse. In doing so, the Court gave a wide margin of appreciation to states to adopt bulk interception regimes in light of the present-day threat of global terrorism and serious cross-border crime.

---

Facts

The case was taken by Centrum för rättvisa, which was a Swedish non-profit foundation that, among other things, brought human rights litigation on behalf of Swedish citizens. As part of this and other activities, the foundation frequently communicated with individuals, organizations and companies in Sweden and abroad by email, telephone and fax. Much of the shared information regarded particularly sensitive matters from a privacy perspective. Due to the nature of its work, Centrum för rättvisa believed that there was a risk that its communications through mobile telephones and mobile broadband had been or would be intercepted and examined by way of “signals intelligence”.

“Signals intelligence” referred to the intercepting, processing, analyzing and reporting of intelligence from electronic signals. A great majority of the traffic relevant for signals intelligence is cable-based. The intelligence collected this way could concern both the content of the communications and the associated communications data (e.g. location, sender, recipient etc.), Centrum för rättvisa did not bring any domestic proceedings challenging the Swedish signals intelligence regime, arguing that there was no effective remedy before the domestic courts for their complaints that the regime violated their human rights.

Under the Swedish law, foreign intelligence was conducted in support of foreign, defense and security policy and in order to identify external threats to the country. In Sweden, the collection of electronic signals was one form of foreign intelligence and was regulated by the Signals Intelligence Act. This legislation authorizes the National Defence Radio Establishment (FRA), a Government agency organized under the Ministry of the Defence, to conduct signals intelligence.

The Signals Intelligence Act stated that signals intelligence could only be conducted for eight purposes, these were namely to survey 1) external military threats to the country, 2) conditions for Swedish participation in international peacekeeping or humanitarian missions or threats to the safety of Swedish interests in the performance of such operations, 3) strategic circumstances concerning international terrorism or other serious cross-border crimes that may threaten essential national interests, 4) the development and proliferation of weapons of mass destruction, military equipment and other similar specified products, 5) serious external threats to society’s infrastructure, 6) foreign conflicts with consequences for international security, 7) foreign intelligence operations against Swedish interests, and 8) the actions or intentions of a foreign power that are of substantial importance for Swedish foreign, security or defense policy.

For all signals intelligence, the FRA had to apply for a permit from the Foreign Intelligence Court. The Foreign Intelligence Court was appointed by the Government and composed of two permanent judges and other members who were appointed on four-year terms. A signals intelligence permit could be granted for a specific period of time but could only be granted for a maximum period of six months. An extension, after examination, could be granted for a further six months. An emergency permit could be granted by the FRA itself, but this had to be followed by an immediate notification to and a subsequent rapid review by the Foreign Intelligence Court. The Foreign Intelligence Court’s activities were, in practice, conducted in complete secrecy. Signals intelligence was overseen by the Foreign Intelligence Inspectorate and the Data Protection Authority.

Relying on Article 8 (right to respect for private and family life, the home and the correspondence) of the European Convention on Human Rights, Centrum för rättvisa complained that the Swedish state practice and legislation concerning signals intelligence had violated and continued to violate its right to respect for private life and correspondence.

---

Decision Overview

The European Court of Human Rights (Court) began by considering whether Centrum för rättvisa could be considered a “victim” of an interference with the right to respect for private life under Article 8 of the European Convention on Human Rights (Convention).

The contention as to whether Centrum för rättvisa could claim to be a victim primarily lay in its inability to prove that secret surveillance measures had been applied to them specifically. The Court recalled that an applicant can claim to be the victim of a violation occasioned by the mere existence of secret surveillance measures, or legislation permitting such measures, if the following conditions are met: (i) the applicant can possibly be affected by the surveillance measures, either because he or she belongs to a group of persons targeted by it or because it directly affects all users of communication services, and (ii) the Court will consider whether remedies are available at domestic level, and where there are no domestic remedies available then an applicant can claim that the “menace of surveillance” in itself interferes with their rights. In this case, the Court considered that the contested legislation on signals intelligence instituted a system of secret surveillance that potentially affected all users of, for example, mobile telephone services and the internet, without them being notified about the surveillance. Moreover, no domestic remedy provided detailed grounds in response to a complainant who suspected that he or she had his/her communications intercepted. In light of this, the Court could examine the relevant legislation in abstracto. In short, the mere existence of the law on signals intelligence amounted, in itself, to an interference with Centrum för rättvisa’s rights under Article 8 of the Convention.

The Court then moved on to consider whether this interference was lawful, in pursuit of a legitimate aim, and necessary in a democratic society. For an interference to be “lawful”, the legal basis for the interference must meet the test of “foreseeability”. The Court noted that, due to the nature of secret surveillance, the test for “foreseeability” should not require that an individual be able to foresee when the authorities were likely to intercept communications so that he or she could adapt his or her conduct accordingly. However, the Court noted that where power vested in the executive is exercised in secret, the risk of arbitrariness is evident. It was, therefore, “essential to have clear, detailed rules on interception of telephone communications, especially as the technology available for use was continuously becoming more sophisticated.” [para. 101] The Court reasoned that the law must be sufficiently clear to give citizens an adequate indication as to the circumstances and conditions which give public authorities the power to resort to such measures. It also noted that, since secret surveillance is not open to scrutiny by a citizen concerned, the law must indicate the scope of any discretion granted to the executive or to a judge and the manner of its exercise with sufficient clarify to give the individual adequate protection against arbitrary interference.

The Court reiterated, in relation to secret surveillance regimes, States must put in place adequate and effective guarantees against abuse in order to ensure democracy is not undermined or even destroyed by such a regime. When assessing whether such guarantees were put in place, the Court would take into account all the circumstances of the case. The Court also noted that, unlike many other cases considering interferences with Article 8 of the Convention, the question of whether the surveillance regime was in “accordance with the law” would include an assessment of whether the law ensures that secret surveillance was applied only when “necessary in a democratic society”.

Turning to the present case, the Court highlighted that it was not disputed by the parties that the Swedish signal intelligence law had a basis in domestic law and that the measures in question had pursued legitimate aims in the interest of national security by supporting Swedish foreign, defense and security policy and identifying external threats to the country. The Court had then to examine whether the domestic law in question was accessible and contained adequate and effective safeguards and guarantees so that the interference with Article 8 could be considered “foreseeable” and “necessary in a democratic society”.

Before turning to examine these considerations, the Court stated that a bulk interception regime was not, in itself, a violation of Article 8 of the Convention. Instead, it fell within a States’ margin of appreciation in light of “the current threats facing many Contracting States (including the scourge of global terrorism and other serious crime, such as drug trafficking, human trafficking, sexual exploitation of children and cybercrime), advancements in technology which have made it easier for terrorists and criminals to evade detection on the internet, and the unpredictability of the routes via which electronic communications are transmitted”. [para. 112] Nevertheless, the Court recognized that, whether interception is in bulk or targeted, a surveillance regime must include the following minimum safeguards. These were considered in turn by the Court.

• Accessibility of domestic law

The Court had little difficulty in finding that that all legal provisions relevant to signals intelligence had been officially published and were accessible to the public.

• Scope of application of signals intelligence

In relation of the scope of application of signals intelligence, the Court reiterated that the requirement of “foreseeability” of the law did not go so far as to compel States to enact legal provisions listing in detail all conduct that may prompt a decision to subject an individual to secret surveillance on “national security” grounds. [para. 119] Nevertheless, the Court stated that the law must indicate the scope of any discretion conferred on the competent authorities and the manner of its exercise with sufficient clarity, having regard to the legitimate aim of the measure in question, to give the individual adequate protection against arbitrary interference. In the present case, the Court noted that the Signals Intelligence Act provided eight purposes for which signals intelligence could be conducted. Although generally framed, the Court noted that they were further elaborated upon in the preparatory work. The Court also found it relevant that signals intelligence conducted on fiber optic cables could only concern communications crossing the Swedish border in cables owned by a communications service provider. Communications between a sender and a receiver in Sweden could not be intercepted, regardless of whether the source was airborne or cable-based. The Court was satisfied that the law indicated the scope of mandating and performing signals intelligence conferred on the competent authorities and the manner of its exercise with sufficient clarity.

• Duration of secret surveillance measures

The Court first considered that it was not unreasonable to leave the overall duration of interception to the discretion of the relevant domestic authorities which have competence to issue and renew interception warrants, provided that adequate safeguards exist, such as a clear indication in the domestic law of the period after which an interception warrant will expire, the conditions under which a warrant can be renewed and the circumstances in which it must be cancelled. In this regard, the Signals Intelligence Act established that a permit may be granted for a maximum of six months and that may be extended, following a new examination, for six months at a time. The Court went on to hold that the law “gives clear indications of the period after which the permit will expire and of the conditions under which it can be renewed.” [para. 128] As for the circumstances under which interception must be discontinued, the legislation was not equally clear (e.g. there were no provisions obliging the FRA, the authorities mandated to issue tasking directives or the Foreign Intelligence Court to cancel a signals intelligence mission if the conditions for it had ceased to exist or the measures were no longer necessary). Nevertheless, the Court suggested the shortcomings on this safeguard were mitigated by the fact that permits were only valid for a maximum of six months and a renewal was only possible upon a review to ascertain whether the same conditions were still being met. Moreover, the FRA continuously reviewed whether the specific personal data it had intercepted were still needed for its signals intelligence activities. The Court was then satisfied that there were safeguards in place which adequately regulated the duration, renewal and cancellation of interception measures.

• Authorization of secret surveillance measures

Under Swedish law, signals intelligence conducted by the FRA had to be authorized in advance by a judicial body, the Foreign Intelligence Court. The president of the court was a permanent judge, whereas the vice president and other members were appointed by the Government on four-year terms. No state authorities could interfere with the court’s decisions, which were legally binding. The Court was mindful of the fact that, because of the nature of signals intelligence, prior-authorization hearings would not be fully public. However, there would still need to be adequate safeguards in place to compensate for the lack of transparency. In this case, the Court found that the presence of a privacy protection representative in such hearings amounted to adequate compensation in this regard. This representative could appeal against a decision by the Foreign Intelligence Court or report any perceived irregularities to the supervisory bodies. The Court further held that the judicial supervision performed by the Foreign Intelligence Court was of crucial importance in that it limited the FRA’s discretion by interpreting the scope of mandating and performing signals intelligence. Then, the Court went on by noting that the FRA itself may decide to grant a permit, if it is feared that the application of a permit from the Foreign Intelligence Court could cause delay or other inconveniences of essential importance for one of the specified purposes of the signals intelligence. The Court reiterated the need for safeguards to ensure that emergency measures are used sparingly and only in justified cases. As the legislation stated that such a decision must be followed by an immediate notification to and a subsequent rapid review by the Foreign Intelligence Court, where the permit could be changed or revoked, the Court found this procedure acceptable. [para. 140]

• Procedures to be followed for storing, accessing, examining, using and destroying the intercepted data

The Court first noted that personnel at the FRA processing personal data are security cleared and, if secrecy applies to the personal data, subject to confidentiality. The Court also noted that the FRA, and its staff, were under an obligation to abide by certain principles of data protection law. Furthermore, there were a number of provisions that regulated the situations when intercepted data had to be destroyed (e.g. in order to protect legal privilege, or when a temporary permit granted by the FRA has been revoked by the Foreign Intelligence Court). The Court also accepted that it was necessary for the FRA to store raw material before it is manually processed but highlighted that such data should be deleted as soon as it comes evident that it is no longer pertinent for a signals intelligence investigation. The Court held that, having examined the legislation on storing, accessing, examining, using and destroying intercepted data, it was satisfied that it provided adequate safeguards against abuse of treatment of personal data and thus served to protect individuals’ personal integrity. [para. 147]

• Conditions for communicating the intercepted data to other parties

The Court noted that intercepted data could be communicated to other states or international organizations when it was needed for the FRA’s activities within international defense and security cooperation, and as long as it was not prevented by secrecy. Further discretion was given to the Government, which could decide to communicate personal data to states or organizations in other cases when necessary for the activities of the FRA, thus presumably in cases where such communication would otherwise be prevented by rules of secrecy. The Court stated that “whereas national interests are taken into account, the legislation does not indicate that possible harm to the individual concerned must be considered. Furthermore, the legislation only in very broad terms mentions that the data may be communicated to “other states or international organisations”; there is no provision requiring the recipient to protect the data with the same or similar safeguards as those applicable under Swedish law.” The Court held that this lack of specification in the provisions regulating the communication of personal data to other states and international organizations was a cause for concern. However, it considered that the supervisory elements of the law sufficiently counterbalanced these regulatory shortcomings.

• Supervision of the implementation of secret surveillance measures

The Court found no reason to question the independence of the Foreign Intelligence Inspectorate in terms of how its members are appointed. The Court considered that the supervision of the Foreign Intelligence Inspectorate was of particular value in ensuring that the provisions applicable to the activities of the FRA were respected and that, generally, signals intelligence was performed in a manner which offered adequate safeguards against abuse. In short, the Foreign Intelligence Inspectorate had been given sufficient powers to carry out its tasks and the Court held that its supervision was efficient, not only in theory but also in practice. The Court was also satisfied that its activities were open to public scrutiny. As for personal data, the Court noted that further supervisory functions were provided by the Data Protection Authority (DPA). The Court found that the supervisory elements provided by the Foreign Intelligence Inspectorate and the Data Protection Authority fulfilled the requirements on supervision in general. Moreover, the Parliamentary Ombudsmen and the Chancellor of Justice had general supervisory responsibilities in regard to the FRA.

• Notification of secret surveillance measures

The Court first noted that, in its previous case law, it found that the absence of a requirement to notify the subject of interception of postal and telephone communications at any point in time or in any circumstances was incompatible with the Convention, this was because it deprived the subject of the interception an opportunity to seek redress for unlawful interferences with his or her rights under Article 8 of the Convention and rendered the remedies available under national law theoretical and illusory rather than practical and effective. However, the Court was mindful that Centrum för rättvisa was not a natural person and that, under domestic law, the FRA was obliged to inform a natural person if search terms directly related to him or her had been used. The Court decided to look at this consideration alongside the remedies that were available in Sweden.

• Available remedies

Under the Signals Intelligence Act, the Foreign Intelligence Inspectorate, at the request of an individual, would investigate whether his or her communications had been intercepted through signals intelligence. If so, the Inspectorate verified whether the interception and treatment of the information was in accordance with law. The Inspectorate had to notify the individual that an investigation had been carried out. The Inspectorate had the power to decide that the collection of intelligence should cease or that the intelligence should be destroyed. The Court was satisfied that the remedy offered by the Foreign Intelligence Inspectorate was not dependent on prior notification, but did criticize the fact that it did not give public reasons for its decisions. The Court also noted that, although the Inspectorate could decide on the discontinuation of intelligence collection or the destruction of intelligence, it could not order compensation to be paid. However, with regard to compensation per se, the Court was mindful that there was an effective remedy in Sweden since compensation from the State could be sought through the Chancellor of Justice or the domestic courts.

As to the remedies available directly through the FRA, the Court noted that there was no obligation on the FRA to give information if secrecy applied to it. While the FRA’s decisions may be appealed to the Administrative Court in Stockholm, the Court had to assume that, like with other aspects of the FRA’s activities, strict secrecy applied and, therefore, no information on personal data was given to requesting individuals. The FRA’s procedure to correct, block or destroy personal data was dependent on the individual’s knowledge that personal data had been registered and the nature of that data. Therefore, that remedy must be deemed to be ineffective in practice.

The Court went on to note that Swedish law provided for several other remedies of a general nature, in particular the possibility of addressing individual complaints to the Parliamentary Ombudsmen and the Chancellor of Justice. The Swedish remedies available for complaints relating to secret surveillance did not include recourse to a court (save for an appeal against the FRA’s decisions on disclosure and corrective measures, but the FRA had already been deemed an ineffective remedy). Furthermore, there did not appear to be a possibility for an individual to be informed of whether his or her communications had actually been intercepted or, generally, to be given reasoned decisions. There were several remedies by which an individual could initiate an examination of the lawfulness of measures taken during the operation of the signals intelligence system, notably through requests to the Foreign Intelligence Inspectorate, the Parliamentary Ombudsmen and the Chancellor of Justice. In the Court’s view, “the aggregate of remedies, although not providing a full and public response to the objections raised by a complainant, must be considered sufficient in the present context, which involves an abstract challenge to the signals intelligence regime itself and does not concern a complaint against a particular intelligence measure. In reaching this conclusion, the Court attaches importance to the earlier stages of supervision of the regime, including the detailed judicial examination by the Foreign Intelligence Court of the FRA’s requests for permits to conduct signals intelligence and the extensive and partly public supervision by several bodies, in particular the Foreign Intelligence Inspectorate.” [para. 178]

In light of the foregoing considerations, the Court found that the Swedish system of signals intelligence provided adequate and sufficient guarantees against arbitrariness and the risk of abuse. The relevant legislation met the “quality of law” requirement and the “interference” was deemed to be “necessary in a democratic society”. Furthermore, the structure and operation of the system was found to be proportionate to the aim sought to be achieved, namely protecting national security. There had accordingly been no violation of Article 8 of the Convention.

---