CEDH · CASELAW;JUDGMENTS;GRANDCHAMBER;ENG — 25 mai 2021

.s800EAC49 { font-size:12pt } .s32563E28 { margin-top:0pt; margin-bottom:0pt } .sBB9EE52A { font-family:Arial } .sFE10DC93 { margin-top:0pt; margin-bottom:0pt; text-align:center } .sE207830C { margin-top:54pt; margin-bottom:14pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s29100277 { font-family:Arial; font-weight:bold } .sA36B60A1 { font-family:Arial; font-style:italic } .s339D85E6 { margin-top:0pt; margin-bottom:14pt; text-align:center; page-break-inside:avoid; page-break-after:avoid } .s88D564B { margin-top:0pt; margin-bottom:0pt; text-align:justify; border:0.75pt solid #000000; padding:1pt 4pt } .s10950C61 { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt; text-align:justify } .s598389F8 { margin-top:0pt; margin-bottom:0pt; text-align:center; font-size:11pt } .s4ACA9207 { page-break-before:always; clear:both; mso-break-type:section-break } .s9793A85B { margin-top:0pt; margin-bottom:0pt; text-indent:14.2pt } .sB9D5CABB { width:28.35pt; display:inline-block } .s3AAE10DF { margin-top:14pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s3CA22BA { font-family:Arial; text-transform:uppercase } .s590A3EF4 { margin-top:12pt; margin-left:19.85pt; margin-bottom:0pt; text-indent:-19.85pt } .s5D5DC104 { width:5.51pt; text-indent:0pt; display:inline-block } .s61E420C2 { font-family:Arial; font-variant:small-caps } .s275CCCF2 { width:5.86pt; text-indent:0pt; display:inline-block } .s98FBE5B1 { width:3.85pt; text-indent:0pt; display:inline-block } .s10989983 { width:218.8pt; text-indent:0pt; display:inline-block } .s7AE7EF2B { width:227.82pt; text-indent:0pt; display:inline-block } .s97899703 { width:218.79pt; text-indent:0pt; display:inline-block } .sC989DEDA { width:234.51pt; text-indent:0pt; display:inline-block } .s6B505E72 { margin:0pt; padding-left:0pt } .sA7B018C0 { margin-left:18.77pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:6.18pt; font-family:Arial; text-transform:uppercase } .s743F3A55 { margin-right:0pt; margin-left:0pt; padding-left:0pt } .s8ABC7E28 { margin-left:3.65pt; margin-bottom:12pt; page-break-inside:avoid; page-break-after:avoid; padding-left:0.6pt; font-weight:bold; text-transform:none } .s715E7C6D { margin-top:14pt; margin-left:25.5pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s5638B3AF { margin-top:0pt; margin-left:35.45pt; margin-bottom:0pt; text-indent:-14.15pt; text-align:justify } .sB365280B { width:4.14pt; text-indent:0pt; display:inline-block } .s9D48DD53 { margin-top:6pt; margin-left:21.25pt; margin-bottom:6pt; text-indent:7.1pt; text-align:justify; font-size:10pt } .sA284A115 { width:11.79pt; text-indent:0pt; display:inline-block } .sCC58F8B9 { margin-top:14pt; margin-left:22.1pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:2.85pt; font-family:Arial; text-transform:uppercase } .sE485344B { margin-top:14pt; margin-left:28.6pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; padding-left:0.6pt; font-family:Arial; font-weight:bold } .sC6C7C49B { margin-left:7.35pt; margin-bottom:6pt; page-break-inside:avoid; page-break-after:avoid; font-weight:normal; font-style:italic } .s3A692EA6 { margin-top:14pt; margin-bottom:6pt; text-align:center; page-break-after:avoid; font-size:10pt } .sD0489F03 { margin-top:6pt; margin-left:21.25pt; margin-bottom:6pt; text-indent:7.1pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s7D274C8A { margin-top:6pt; margin-left:42.55pt; margin-bottom:6pt; text-indent:7.1pt; text-align:justify; font-size:10pt } .s91FE6579 { margin-top:6pt; margin-left:42.55pt; margin-bottom:6pt; text-indent:-14.2pt; text-align:justify; font-size:10pt } .s9F7AB5CD { width:7.05pt; text-indent:0pt; display:inline-block } .s4E5BC473 { margin-top:6pt; margin-left:42.55pt; margin-bottom:6pt; text-align:justify; font-size:10pt } .sF7610474 { margin-top:14pt; margin-left:36.55pt; margin-bottom:6pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-family:Arial; font-style:italic } .s83E05B04 { margin-top:14pt; margin-left:24.95pt; margin-bottom:12pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-family:Arial; text-transform:uppercase } .sF74FAE9B { font-family:Arial; font-size:9.5pt } .sC7F250FD { font-style:normal } .s2FAE9AA8 { color:#444444; background-color:#ffffff } .s2E819D4D { margin-top:14pt; margin-left:21.55pt; margin-bottom:6pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .sB2ED4664 { margin-top:14pt; margin-left:48.75pt; margin-bottom:6pt; text-indent:-17pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s30C8A987 { width:4.78pt; font:7pt 'Times New Roman'; display:inline-block } .s4E0353E8 { width:4.23pt; font:7pt 'Times New Roman'; display:inline-block } .sEE251087 { margin-top:14pt; margin-left:31.75pt; margin-bottom:6pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .sE4EB4F8C { margin-top:14pt; margin-left:59.55pt; margin-bottom:6pt; text-indent:-17.9pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s84CD1D0D { width:9.02pt; font:7pt 'Times New Roman'; display:inline-block } .s2DAE615E { width:6.8pt; font:7pt 'Times New Roman'; display:inline-block } .sD0682254 { margin-top:0pt; margin-left:48.75pt; margin-bottom:6pt; text-indent:-17pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s53AF40BF { margin-top:0pt; margin-left:87.9pt; margin-bottom:6pt; text-indent:-17pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s706500A1 { margin-top:0pt; margin-left:36pt; margin-bottom:0pt; text-indent:-18pt; text-align:justify } .sE5C1F6E3 { width:3.33pt; font:7pt 'Times New Roman'; display:inline-block } .sFB30C84 { width:4.01pt; font:7pt 'Times New Roman'; display:inline-block } .s980E2CFD { margin-top:0pt; margin-left:59.55pt; margin-bottom:6pt; text-indent:-17.9pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s83A830FF { width:4.57pt; font:7pt 'Times New Roman'; display:inline-block } .s2D97425B { margin-left:36pt; text-align:justify; font-family:Arial } .sFBC99493 { font-style:italic } .s9B1F39AA { width:4.02pt; font:7pt 'Times New Roman'; display:inline-block } .s695E2BCF { margin-top:0pt; margin-left:62.35pt; margin-bottom:6pt; text-indent:-19.8pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .s16F6432D { width:7.9pt; font:7pt 'Times New Roman'; display:inline-block } .sA1D3DA2E { margin-top:0pt; margin-bottom:0pt; text-align:justify } .sFABD3260 { margin-top:14pt; margin-left:62.35pt; margin-bottom:6pt; text-indent:-19.8pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid; font-size:10pt } .sFF8BF293 { width:8.05pt; font:7pt 'Times New Roman'; display:inline-block } .s3CAF9CA4 { width:8.72pt; font:7pt 'Times New Roman'; display:inline-block } .sEB3FA797 { width:8.43pt; font:7pt 'Times New Roman'; display:inline-block } .s8508A14D { width:8.94pt; font:7pt 'Times New Roman'; display:inline-block } .s14AC500A { width:3.73pt; font:7pt 'Times New Roman'; display:inline-block } .sA44B7922 { width:9pt; font:7pt 'Times New Roman'; display:inline-block } .sE9C9855C { width:7.91pt; font:7pt 'Times New Roman'; display:inline-block } .s40DF141B { width:8.35pt; font:7pt 'Times New Roman'; display:inline-block } .sDA78FB4A { width:10.45pt; font:7pt 'Times New Roman'; display:inline-block } .s74818F78 { margin-top:14pt; margin-bottom:3pt; text-align:justify; font-family:Arial; list-style-position:inside } .sE7B3A78A { width:1.99pt; font:7pt 'Times New Roman'; display:inline-block } .sD11CFAB7 { margin-top:14pt; margin-left:15.01pt; margin-bottom:3pt; text-align:justify; padding-left:1.99pt; font-family:Arial } .s51DFF5CF { margin-top:0pt; margin-left:34pt; margin-bottom:0pt; text-indent:-17pt; text-align:justify } .sE5BF05B1 { width:2.33pt; font:7pt 'Times New Roman'; display:inline-block } .s2D9C6089 { margin-top:12pt; margin-bottom:12pt; text-indent:14.2pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .s7CB9076 { margin-top:36pt; margin-bottom:0pt; page-break-inside:avoid; page-break-after:avoid } .sF920FE69 { font-family:Arial; color:#f8f8f8 } .s73646DED { width:189.23pt; display:inline-block } .s69DCC830 { margin-top:36pt; margin-bottom:0pt } .s3EC4E87E { width:175.93pt; display:inline-block } .s5C148630 { width:171.61pt; display:inline-block } .s3F59B822 { font-family:Arial; font-weight:bold; text-transform:uppercase } .s379BC09C { margin-top:36pt; margin-bottom:0pt; text-align:right } .s5E1364CA { margin-top:0pt; margin-bottom:12pt; text-align:center; page-break-inside:avoid; page-break-after:avoid; font-size:14pt } .s7ED160F0 { text-decoration:none } .s66E9FC38 { font-family:Arial; font-size:8pt; vertical-align:super; color:#000000 } .s3BF0B6C7 { margin-top:14pt; margin-left:25.5pt; margin-bottom:12pt; text-indent:-17pt; text-align:justify; page-break-inside:avoid; page-break-after:avoid } .sF6A12959 { width:33%; height:1px; text-align:left } .s85226119 { margin-top:0pt; margin-bottom:0pt; text-align:justify; font-size:10pt } .s653E6C45 { font-family:Arial; font-size:6.67pt; vertical-align:super; color:#0069d6 } .s3DC36BA9 { font-family:Arial; text-decoration:underline; color:#0069d6 }     GRAND CHAMBER CASE OF CENTRUM FÖR RÄTTVISA v. SWEDEN (Application no. 35252/08)     JUDGMENT   Art 8 • Private life • Convention compliance of secret surveillance regime including bulk interception of communications and intelligence sharing • Need to develop case-law in light of important differences between targeted interception and bulk interception • Adapted test for examining bulk interception regimes through global assessment • Focus on “end-to-end safeguards” to take into account the increasing degree of intrusion with privacy rights as the bulk interception process moves through different stages • Shortcomings through: absence of clear rule on destroying intercepted material not containing personal data; absence of a requirement to consider privacy of individuals when deciding whether to transmit intelligence material to foreign partners; dual role of Foreign Intelligence Inspectorate and absence of reasoned decisions in ex post facto control, not sufficiently compensated by safeguards   STRASBOURG 25 May 2021   This judgment is final but it may be subject to editorial revision. In the case of Centrum för rättvisa v. Sweden, The European Court of Human Rights, sitting as a Grand Chamber composed of:   Robert Spano, President,   Jon Fridrik Kjølbro,   Angelika Nußberger,   Paul Lemmens,   Yonko Grozev,   Vincent A. De Gaetano,   Paulo Pinto de Albuquerque,   Faris Vehabović,   Iulia Antoanella Motoc,   Carlo Ranzoni,   Mārtiņš Mits,   Gabriele Kucsko-Stadlmayer,   Marko Bošnjak,   Tim Eicke,   Darian Pavli,   Erik Wennerström,   Saadet Yüksel, judges, and Søren Prebensen, Deputy Grand Chamber Registrar, Having deliberated in private on 11 July, 4 and 6 September 2019 and on 17 February 2021, Delivers the following judgment, which was adopted on the last-mentioned date: PROCEDURE 1.     The case originated in an application (no. 35252/08) against the Kingdom of Sweden lodged with the Court under Article   34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by a Swedish foundation, Centrum för rättvisa (“the applicant”), on 14 July 2008. 2.     The applicant was represented by Mr F. Bergman and Ms A. Evans, lawyers practising in Stockholm. The Swedish Government (“the Government”) were represented by their Agent, Ms E. Hammarskjöld, Director General for Legal Affairs, Ministry for Foreign Affairs. 3.     The applicant alleged that the Swedish legislation and practice in the field of signals intelligence violated its rights under Article 8 of the Convention and that it did not have an effective remedy in this regard, contrary to Article 13 of the Convention. 4.     The application was allocated to the Third Section of the Court (Rule 52 § 1 of the Rules of Court). On 1 November 2011 (admissibility) and 14   October 2014 (admissibility and merits) the application was communicated to the respondent Government. On 19 June 2018 a Chamber of that Section, composed of Branko Lubarda, President, Helena Jäderblom, Helen Keller, Pere Pastor Vilanova, Alena Poláčková, Georgios A. Serghides, Jolien Schukking, judges, and Stephen Phillips, Section Registrar, gave judgment. The Chamber unanimously declared the application admissible and held that there had been no violation of Article 8 of the Convention and that there was no need to examine separately the complaint under Article 13. 5.     On 19 September 2018 the applicant requested the referral of the case to the Grand Chamber in accordance with Article 43 of the Convention. On 4 February 2019 the panel of the Grand Chamber granted that request. 6.     The composition of the Grand Chamber was determined according to the provisions of Article 26 §§ 4 and 5 of the Convention and Rule 24. The President of the Grand Chamber decided that in the interests of the proper administration of justice, the case should be assigned to the same Grand Chamber as the case of Big Brother Watch and Others v. the United Kingdom (nos. 58170/13 and 2 others) (Rules 24, 42 § 2 and 71). 7.     The applicant and the Government each filed observations (Rule   59   §   1) on the merits of the case. 8.     The President of the Grand Chamber granted leave to the Governments of Estonia, France, the Netherlands and Norway to intervene in the written procedure, in accordance with Article 36 § 2 of the Convention and Rule 44 § 3. 9.     A hearing took place in public in the Human Rights Building, Strasbourg, on 10 July 2019. There appeared before the Court: (a)     for the respondent Government Mrs   E. Hammarskjöld, Director General for Legal Affairs, Ministry for Foreign Affairs, Agent , Mrs   G. Isaksson , Deputy Director, Ministry for Foreign Affairs, Mrs   J. Sjöstrand , Senior Legal Adviser, Ministry for Foreign Affairs, Mr   J.Garton , Deputy Director-General, Ministry of Defence, Mr   M. Andersson , Senior Legal Adviser, Ministry of Defence Mr   H. Sellman , Deputy Director, Ministry of Justice, Ms   F. Krzyzanski , Legal Adviser, Ministry of Infrastructure, Ms   M. Dráb , Chief Legal Adviser, National Defence Radio Establishment, Mr   C. Hellsten , Senior Adviser, National Defence Radio Establishment, Advisers .       (b)     for the applicant Mr   F. Bergman ,   Counsel , Mrs   A. Evans ,   Counsel , Mr   A. Ottosson,   Counsel , Mrs   E. Palm ,   Adviser .   The Court heard addresses by Ms Evans, Mr Bergman and Ms   Hammarskjöld. THE FACTS 10. The applicant, Centrum för rättvisa, is a foundation established in 2002. It has its headquarters in Stockholm. 11.     The applicant represents clients in proceedings concerning rights and freedoms under the Convention or related proceedings under Swedish law. It is also involved in education and research projects and participates in the general public debate on issues concerning individuals’ rights and freedoms. 12.     The applicant communicates on a daily basis with individuals, organisations and companies in Sweden and abroad by email, telephone and fax. It asserts that a large part of that communication is particularly sensitive from a privacy perspective. Due to the nature of its function as a non-governmental organisation scrutinising the activities of State actors, it believes that there is a risk that its communications have been or will be intercepted and examined by way of signals intelligence. 13.     The applicant has not brought any domestic proceedings, contending that there is no effective remedy for its Convention complaints. RELEVANT LEGAL FRAMEWORK AND PRACTICE DOMESTIC LAW AND PRACTICE Generally on signals intelligence 14 .     Signals intelligence can be defined as intercepting, processing, analysing and reporting intelligence from electronic signals. These signals may be processed to text, images and sound. The intelligence collected through these procedures may concern both the content of a communication and its related communications data (the data describing, for instance, how, when and between which addresses the electronic communication is conducted). The intelligence may be intercepted over the airways – usually from radio links and satellites – and from cables. Whether a signal is transmitted over the airways or through cables is controlled by the communications service providers, that is, the telecom, internet, cable and other such companies which provide various forms of electronic transfer of information. A great majority of the traffic relevant for signals intelligence is cable-based. The term “communications bearers” (or “signal carriers”) refers to the medium used for transmitting one or more signals. Unless indicated below, the regulation of Swedish signals intelligence does not distinguish between the content of communications and their communications data or between airborne and cable-based traffic. 15.     Foreign intelligence is, according to the Foreign Intelligence Act ( Lagen om försvarsunderrättelseverksamhet ; 2000:130), conducted in support of Swedish foreign, defence and security policy, and in order to identify external threats to the country. The activities should also assist in Sweden’s participation in international security cooperation. Intelligence under the Act may only be conducted in relation to foreign circumstances (section 1(1)). This does not preclude that some of the foreign circumstances may have ramifications in Sweden, for example, when following the espionage operations of a foreign power targeting Sweden (preparatory works to amended legislation on foreign intelligence, prop.   2006/07:63, p. 43). 16.     The Government determines the direction of the activities; it also decides which authorities may issue more detailed directives and which authority is to conduct the intelligence activities (section 1(2) and 1(3)). The Government issues general tasking directives annually. Foreign intelligence may not be conducted for the purpose of solving tasks in the area of law enforcement or crime prevention, which come under the mandate of the Police Authority, the Security Police and other authorities and which are regulated by different legislation. However, authorities that conduct foreign intelligence may support authorities dealing with law enforcement or crime prevention (section 4). Examples of such support are cryptanalysis and technical help on information security (preparatory works to amended legislation on foreign intelligence, prop. 2006/07:63, p. 136). 17.     The collection of electronic signals is one form of foreign intelligence. It is regulated by the Signals Intelligence Act ( Lagen om signalspaning i försvarsunderrättelseverksamhet ; 2008:717), which entered into force on 1 January 2009. Several amendments were made to the Act on 1 December 2009, 1 January 2013, 1 January 2015 and 15 July 2016. Supplementary provisions are found in the Signals Intelligence Ordinance ( Förordningen om signalspaning i försvarsunderrättelseverksamhet ; 2008:923). The legislation authorises the National Defence Radio Establishment ( Försvarets radioanstalt ; henceforth “the FRA”) to conduct signals intelligence (section 2 of the Ordinance compared to section 1 of the Act). 18 .     During signals intelligence all cable-based cross-border communications are transferred to certain points of collection. No information is stored at these points and a limited amount of data traffic is transferred to the FRA by communications bearers (parliamentary committee report SOU 2016:45, p. 107). 19.     The FRA may conduct signals intelligence within the area of foreign intelligence only as a result of a detailed tasking directive issued by the Government, the Government Offices, the Armed Forces or, as from January 2013, the Security Police and the National Operative Department of the Police Authority ( Nationella operativa avdelningen i Polismyndigheten ; hereafter “NOA”) (sections 1(1) and 4(1) of the Act) in accordance with the issuer’s precise intelligence requirements. However, the direction of the FRA’s “development activities” may be determined solely by the Government (section 4(2)). A detailed tasking directive determines the direction of the intelligence activities and may concern a certain phenomenon or situation, but it may not solely target a specific natural person (section 4(3)). 20.     The mandate of the Security Police and the NOA to issue detailed tasking directives aims to improve these authorities’ ability to obtain data about foreign circumstances at a strategic level concerning international terrorism and other serious international crime that may threaten essential national interests. At the time of introduction of the new rules, the Government stated in the preparatory works (prop. 2011/12:179, p. 19) that the mandate is in accordance with the prohibition on conducting signals intelligence for the purpose of solving tasks in the area of law enforcement or crime prevention. 21.     According to the Foreign Intelligence Ordinance ( Förordningen om försvarsunderrättelseverksamhet ; 2000:131), a detailed tasking directive shall include information about (i) the issuing authority, (ii) the part of the Government’s annual tasking directive it concerns, (iii) the phenomenon or situation intended to be covered, and (iv) the need for intelligence on that phenomenon or situation (section 2a). B.     Scope of application of signals intelligence 22.     The purposes for which electronic signals may be collected as part of foreign intelligence are specified in the Signals Intelligence Act (section 1 (2)) which provides that signals intelligence may be conducted only to survey: 1.   external military threats to the country; 2.   conditions for Swedish participation in international peacekeeping or humanitarian missions or threats to the safety of Swedish interests in the performance of such operations; 3.   strategic circumstances concerning international terrorism or other serious cross-border crime that may threaten essential national interests; 4.   the development and proliferation of weapons of mass destruction, military equipment and other similar specified products; 5.   serious external threats to society’s infrastructure; 6.   foreign conflicts with consequences for international security; 7.   foreign intelligence operations against Swedish interests; and 8.   the actions or intentions of a foreign power that are of substantial importance for Swedish foreign, security or defence policy. 23 .     These eight purposes are further elaborated upon in the preparatory works to the legislation (prop. 2008/09:201, pp. 108-109): “The purposes for which permits to conduct signals intelligence may be granted are listed in eight points. The first point concerns external military threats to the country. Military threats include not only imminent threats, such as threats of invasion, but also phenomena that may in the long term develop into security threats. Consequently, the wording covers the surveying of military capabilities and capacities in our vicinity. The second point comprises both surveying necessary to provide an adequate basis for a decision whether to participate in international peacekeeping or humanitarian missions and surveying performed during ongoing missions concerning threats to Swedish personnel or other Swedish interests. The third point refers to strategic surveying of international terrorism or other serious cross-border crime, such as drug or human trafficking of such severity that it may threaten significant national interests. The task of signals intelligence in relation to such activities is to survey them from a foreign and security policy perspective; the intelligence needed to combat the criminal activity operatively is primarily the responsibility of the police. The fourth point addresses the need to use signals intelligence to follow, among other things, activities relevant to Sweden’s commitments in regard to non-proliferation and export control, even in cases where the activity does not constitute a crime or contravenes international conventions. The fifth point includes, among other things, serious IT-related threats emanating from abroad. That the threats should be of a serious nature means that they, for example, should be directed towards vital societal systems for energy and water supply, communication or monetary services. The sixth point refers to the surveying of such conflicts between and in other countries that may have consequences for international security. It may concern regular acts of war between States but also internal or cross-border conflicts between different ethnic, religious or political groups. The surveying of the conflicts includes examining their causes and consequences. The seventh point signifies that intelligence activities conducted against Swedish interests can be surveyed through signals intelligence. The eighth point provides the opportunity to conduct signals intelligence against foreign powers and their representatives in order to survey their intentions or actions that are of substantial importance to Swedish foreign, security or defence policy. Such activities may relate only to those who represent a foreign power. Through the condition “substantial importance” it is emphasised that it is not sufficient that the phenomenon is of general interest but that the intelligence should have a direct impact on Swedish actions or positions in various foreign, security or defence policy matters.   ...” 24 .     The FRA may collect electronic signals also in order to monitor changes in the international signals environment, technical advances and signals protection and to develop the technology needed for signals intelligence (section 1(3)). This is regarded as “development activities” and, according to the relevant preparatory works (prop. 2006/07:63, p. 72), they do not generate any intelligence reports. Signals intercepted in the context of the FRA’s development activities do not interest the authorities for the data they might contain but only for the possibility to analyse the systems and routes through which information is transmitted. The FRA may share experiences gained on technological issues with other authorities. Development activities usually do not focus on communications between individuals, although information on individuals’ identities may be intercepted. 25 .     Signals intelligence conducted on cables may only concern signals crossing the Swedish border in cables owned by a communications service provider (section 2). Communications between a sender and receiver within Sweden may not be intercepted, regardless of whether the source is airborne or cable-based. If such signals cannot be separated at the point of collection, the recording of or notes about them shall be destroyed as soon as it becomes clear that such signals have been collected (section 2a). 26 .     Interception of cable-based signals is automated and must only concern signals that have been identified through the use of selectors (or “search terms”). Such selectors are also used to identify signals over the airways, if the procedure is automated. The selectors must be formulated in such a way that the interference with personal integrity is limited as far as possible. Selectors directly relating to a specific natural person may only be used if this is of exceptional importance for the intelligence activities (section 3). 27.     The preparatory works to the Signals Intelligence Act (prop. 2006/07:63, p. 90) clarify that the exceptional importance requirement under section 3 is needed in view of the fact that the use of search terms that are attributable to a particular individual, such as personal names, telephone numbers, email or IP addresses, involves special risks from a privacy protection perspective. The use of such search terms should only be considered under special conditions and should be preceded by a thorough necessity assessment, notably, as to whether the information which can thereby be obtained is of such importance that it justifies the measure. As an example, the text refers to the following hypothetical situation: a national crisis caused by an IT attack against systems of crucial importance to society where immediate action needs to be taken to identify the individual actors. 28.     After the signals have been intercepted they are processed, which means that they are, for example, subjected to cryptanalysis or translation. Then the information is analysed and reported to the authority that gave the FRA the mission to collect the intelligence in question. 29 .     The process has been described by the respondent Government as comprising six stages, as follows: 1.   a choice is made of segments of the signals intelligence environment that are most relevant; 2.   selectors are applied automatically to signals in the chosen segments in order to intercept and gradually reduce what is collected; 3.   the data is further processed through automatic and manual means using, among others, cryptoanalysis, structuring and language translation; 4.   the processed information is analysed by an analyst in order to identify intelligence within; 5.   a report is written and disseminated to selected recipients of foreign intelligence; and 6.   feedback on the use and effects of the intelligence provided is requested and shared with those involved in the process. C.     Authorisation of signals intelligence 30 .     For all signals intelligence, including the development activities, the FRA must apply for a permit to the Foreign Intelligence Court ( Försvarsunderrättelsedomstolen ). The application shall contain the mission request that the FRA has received, with information on the relevant detailed tasking directive and the need for the intelligence sought. Also, the communications bearers to which the FRA requires access have to be specified, along with the selectors or categories of selectors that will be used. Finally, the application must state the duration for which the permit is requested (section   4a). 31.     A permit may only be granted if the mission is in accordance with the provisions of the Foreign Intelligence Act and the Signals Intelligence Act, if the purpose of the interception of signals cannot be met in a less interfering manner, if the mission can be expected to yield information whose value is clearly greater than the possible interference with personal integrity, if the selectors or categories of selectors are in accordance with the Signals Intelligence Act and if the application does not concern solely a specific natural person (section 5). 32.     If granted, the permit shall specify the mission for which signals intelligence may be conducted, the bearers to which the FRA will have access, the selectors or categories of selectors that may be used, the duration of the permit and other conditions necessary to limit the interference with personal integrity (section 5a). 33 .     The FRA itself may decide to grant a permit, if the application for a permit from the Foreign Intelligence Court might cause delay or other inconveniences of essential importance for one of the specified purposes of the signals intelligence. If the FRA grants a permit, it has to report to the court immediately and the court shall without delay decide in the matter. The court may revoke or amend the permit (section 5b). 34 .     The composition of the Foreign Intelligence Court and its activities are regulated by the Foreign Intelligence Court Act ( Lagen om Försvarsunderrättelsedomstol ; 2009:966). The court consists of one president, one or two vice-presidents and two to six other members. The president is a permanent judge, nominated by the Judges Proposals Board ( Domarnämnden ) and appointed by the Government. The vice-presidents, who must be legally trained and have previous experience as judges, and the other members, who are required to have special expertise of relevance for the court’s work, are appointed by the Government on four-year terms. The applications for signals intelligence permits are discussed during hearings, which may be held behind closed doors, if it is clear that information classified as secret would be exposed as a result of a public hearing. During the court’s examination, the FRA as well as a privacy protection representative ( integritetsskyddsombud ) are present. The representative, who does not represent any particular person but the interests of individuals in general, monitors integrity issues and has access to the case file and may make statements. Privacy protection representatives are appointed by the Government for a period of four years and must be or have been permanent judges or attorneys. The court may hold a hearing and decide on an application without the presence of a representative only if the case is of such urgency that a delay would severely compromise the purpose of the application. The court’s decisions are final. D.     The duration of signals intelligence 35.     A permit may be granted for a specific period of time, maximum six months. An extension may, after a renewed examination, be granted for six months at a time (Signals Intelligence Act, section 5a). E.     Procedures to be followed for storing, accessing, examining, using and destroying the intercepted data 36 .     The Foreign Intelligence Inspectorate ( Statens inspektion för försvarsunderrättelseverksamheten (SIUN); see further paragraphs 50-54 below) oversees access to the communications bearers. Communications service providers are obliged to transfer cable-based signals crossing the Swedish borders to “collaboration points” agreed upon with the Inspectorate. The Inspectorate, in turn, provides the FRA with access to bearers in so far as such access is covered by a signals intelligence permit and, in so doing, implements the permits issued by the Foreign Intelligence Court (Chapter 6, section 19a of the Electronic Communications Act ( Lagen om elektronisk kommunikation ; 2003:389)). The Council on Legislation ( Lagrådet ), the body giving opinions on request by the Government or a Parliamentary committee on certain draft bills, has expressed the view that an interference with private life and correspondence already arises at this point, because of the State obtaining access to the telecommunications (prop. 2006/07:63, p. 172). 37 .     According to the Signals Intelligence Act, intercepted data must be destroyed immediately by the FRA if it (i) concerns a specific natural person and lacks importance for the signals intelligence, (ii) is protected by constitutional provisions on secrecy for the protection of anonymous authors and media sources, (iii) contains information shared between a suspect and his or her legal counsel and is thus protected by attorney-client privilege, or (iv)   involves information given in a religious context of confession or individual counselling, unless there are exceptional reasons for examining the information (section 7). 38 .     If communications have been intercepted between a sender and receiver who are both in Sweden, despite the prohibition on such interception, they shall be destroyed as soon as the domestic nature of the communications has become evident (section 2a). 39 .     If a permit urgently granted by the FRA (see paragraph 21 above) is revoked or amended by the Foreign Intelligence Court, all intelligence collected which is thereby no longer authorised must be immediately destroyed (section 5b(3)). 40 .     The FRA Personal Data Processing Act ( Lagen om behandling av personuppgifter i Försvarets radioanstalts försvarsunderrättelse- och utvecklingsverksamhet ; 2007:259) contains provisions on the treatment of personal data within the area of signals intelligence. The Act entered into force on 1 July 2007, with amendments effective from 30 June 2009, 15   February 2010 and 1 March 2018. The purpose of the Act is to protect against violations of personal integrity (Chapter 1, section 2). The FRA shall ensure, inter alia , that personal data is collected only for certain expressly stated and justified purposes. Such purpose is either determined by the direction of the foreign intelligence activities through a detailed tasking directive or by what is necessary in order to follow changes in the signals environment, technical advances and signals protection. Also, the personal data treated has to be adequate and relevant in relation to the purpose of the treatment. No more personal data than what is necessary for that purpose may be processed. All reasonable efforts have to be made to correct, block and obliterate personal data that is incorrect or incomplete (Chapter 1, sections 6, 8 and 9). 41.     Personal data may not be processed solely because of what is known of a person’s race or ethnicity, political, religious or philosophical views, membership of a union, health or sexual life. If, however, personal data is treated for a different reason, this type of information may be used if it is absolutely necessary for the treatment. Information about a person’s physical appearance must always be formulated in an objective way with respect for human dignity. Intelligence searches may only use the above-mentioned personal indicators as selectors if this is absolutely necessary for the purpose of the search (Chapter 1, section 11). 42 .     Personnel at the FRA who process personal data go through an official security clearance procedure and are subject to confidentiality with regard to data to which secrecy applies. They could face criminal sanctions if tasks relating to the processing of personal data are mismanaged (Chapter   6, section 2). 43.     Personal data that has been subjected to automated processing is to be destroyed as soon as it is no longer needed (Chapter 6, section 1). 44 .     Further provisions on the treatment of personal data are laid down in the FRA Personal Data Processing Ordinance ( Förordningen om behandling av personuppgifter i Försvarets radioanstalts försvars ­ underrättelse- och utvecklingsverksamhet ; 2007:261). It provides, inter alia , that the FRA may keep databases for raw material containing personal data. Raw material is unprocessed information which has been collected through automated treatment. Personal data in such databases shall be destroyed within one year from when it was collected (section 2). F.     Conditions for communicating the intercepted data to other parties 45.     The intelligence collected is to be reported to the authorities concerned, as determined under the Foreign Intelligence Act (Signals Intelligence Act, section 8). 46.     The Government Offices, the Armed Forces, the Security Police, the NOA, the Inspectorate of Strategic Products ( Inspektionen för strategiska produkter ), the Defence Material Administration ( Försvarets materialverk ), the Defence Research Agency ( Totalförsvarets forskningsinstitut ), the Civil Contingencies Agency ( Myndigheten för samhällsskydd och beredskap ) and the Swedish Customs ( Tullverket ) may have direct access to completed intelligence reports to the extent the FRA so decides (section 9 of the FRA Personal Data Processing Ordinance). However, to date, no decisions permitting direct access have been taken by the FRA. 47.     The FRA may also grant the Security Police and the Armed Forces direct access to data which constitute analysis results in a data collection for analyses and which is needed for the authorities to be able to make strategic assessments of the terrorist threat against Sweden and Swedish interests (Chapter 1, section 15 of the FRA Personal Data Processing Act, and section 13a of the Ordinance). 48.     According to the preparatory works (prop 2017/18:36), the above-mentioned access is given within the framework of cooperation between the FRA, the Security Police and the Armed Forces in a working group called the National Centre for Assessment of Terrorist Threats ( Nationellt centrum för terrorhotbedömning ; “NCT”) where a number of analysts from the three authorities work together and write reports containing strategic assessments of terrorist threats. With the FRA’s permission and as long as the data is relevant for such terrorist threat assessments, the NCT analysts have direct access to “analysis results” contained in the FRA databases. The analysts do not, however, have direct access to the FRA’s databases to conduct their own free searches. Furthermore, while the information made available to the analysts through direct access may contain personal data, the assessments made by the NCT are of a strategic, general nature and are not, as such, directed at individual persons. 49 .     Personal data may be communicated to other States or international organisations only if this is not prevented by secrecy and if necessary for the FRA to perform its activities within international defence and security cooperation. The Government may adopt rules or decide in a specific case to allow such communication of personal data also in other cases, where necessary for the activities of the FRA (Chapter 1, section 17 of the FRA Personal Data Processing Act). The FRA may disclose personal data to a foreign authority or an international organisation if it is beneficial for the Swedish government ( statsledningen ) or Sweden’s comprehensive defence strategy ( totalförsvaret ); information so communicated must not harm Swedish interests (section 7 of the FRA Personal Data Processing Ordinance). G.     Supervision of the implementation of signals intelligence 50 .     The Foreign Intelligence Act (section 5) and the Signals Intelligence Act (section 10) provide that an authority is to oversee the foreign intelligence activities in Sweden and verify that the FRA’s activities are in compliance with the provisions of the Signals Intelligence Act. The supervisory authority – the Foreign Intelligence Inspectorate – is, among other things, tasked with monitoring the implementation of the Foreign Intelligence Act and the associated Ordinance and reviewing whether foreign intelligence activities are performed in compliance with the applicable directives (section 4 of the Foreign Intelligence Inspectorate Instructions Ordinance ( Förordningen med instruktion för Statens inspektion för försvarsunderrättelseverksamheten ; 2009:969)). It also reviews compliance with the Signals Intelligence Act by examining in particular the selectors used, the destruction of intelligence and the communication of reports; if an inspection reveals that a particular intelligence collection is incompatible with a permit, the Inspectorate may decide that the operation shall cease or that the intelligence shall be destroyed (section 10 of the Signals Intelligence Act). The FRA shall report to the Inspectorate the selectors which directly relate to a specific natural person (section 3 of the Signals Intelligence Ordinance). 51.     The Foreign Intelligence Inspectorate is led by a board whose members are appointed by the Government for terms of at least four years. The president and the vice-president shall be or have been permanent judges. Other members are selected from candidates proposed by the party groups in the Parliament (section 10 (3) of the Signals Intelligence Act). 52 .     Any opinions or suggestions for measures arising from the Inspectorate’s inspections shall be forwarded to the FRA, and if necessary also to the Government. The Inspectorate also submits annual reports on its inspections to the Government (section 5 of the Foreign Intelligence Inspectorate Instructions Ordinance), which are made available to the public. Furthermore, if the Inspectorate notices potential crimes, it shall report the matter to the Prosecution Authority ( Åklagarmyndigheten ), and, if deficiencies are discovered that may incur liability for damages for the State, a report shall be submitted to the Chancellor of Justice ( Justitiekanslern ). A report may also be submitted to the Data Protection Authority ( Datainspektionen ), which is the supervisory authority on the treatment of personal data by the FRA (section 15). 53 .     From the establishment of the Inspectorate in 2009 until 2017 the Inspectorate conducted 102 inspections in total. Those resulted in 15 opinions submitted to the FRA and one to the Government. No inspections have revealed reasons to cease an intelligence collection or to destroy the results. According to the Inspectorate’s annual reports, which contain brief descriptions of the inspections, those have included numerous detailed examinations of the selectors used, the destruction of intelligence, the communication of reports, the treatment of personal data and the overall compliance with the legislation, directives and permits relevant to the signals intelligence activities. For instance, between 2010 and 2014 the use of selectors was inspected on seventeen occasions, which led to one opinion and a proposal for changes to the FRA’s processing routines. During the same period the destruction of data related to signals intelligence was audited on nine   occasions. Those also resulted in one opinion, in 2011, inviting the FRA to amend its internal regulations, which it did the same year. During 2011 the Inspectorate also verified whether the FRA was conducting data collection for other countries in accordance with the law, which did not lead to any opinion being issued. An inspection in 2014 concerned a general review of the FRA’s cooperation with other States and international organisations in intelligence matters. It did not give rise to any opinion or suggestion to the FRA. In 2015 and 2016 an overall review to assess compliance with the limitations stated in permits issued by the Foreign Intelligence Court resulted in one observation. In 2016 and 2017 the Inspectorate carried out a detailed inspection of the treatment by the FRA of personal data. The inspection concerned the processing of sensitive personal data in connection with strategic circumstances relating to international terrorism and other serious cross-border crime threatening significant national interests. The inspection did not give rise to any opinion or suggestion. However, during that year, one opinion was submitted to the Government following an inspection of whether the FRA’s intelligence activities complied with the tasking directives given. During the years 2009-2017 the Inspectorate found reason to make a report to another authority – the Data Protection Authority – on one occasion, concerning the interpretation of a legal provision. In its annual reports, the Inspectorate has noted that it has been given access to all the information necessary for its inspections. 54 .     The supervisory activities of the Foreign Intelligence Inspectorate have been audited by the National Audit Office ( Riksrevisionen ), a body answerable to Parliament. In a report published in 2015 the Office noted that the FRA had routines in place for handling the Inspectorate’s opinions and that the supervision helped develop the activities of the FRA. Suggestions were dealt with in a serious manner and, when called for, gave rise to reforms. With the exception of one case when the FRA referred the matter to the Government, the FRA took the action decided by Inspectorate. At the same time the Office criticised the Inspectorate’s lack of documentation of inspections and the fact that there were no clearly specified goals for the inspections. 55.     Within the FRA there is a Privacy Protection Council tasked with continuously monitoring measures taken to ensure protection of personal integrity. The members are appointed by the Government. The Council reports its observations to the FRA management or, if the Council finds reasons for it, to the Inspectorate (section 11 of the Signals Intelligence Act). 56 .     Further provisions on supervision are found in the FRA Personal Data Processing Act. The FRA shall appoint one or several data protection officers and report the appointment to the Data Protection Authority (Chapter 4, section 1). The data protection officer is tasked with independently monitoring that the FRA treats personal data in a legal and correct manner and point out any deficiencies. If deficiencies are suspected and no correction is made, a report shall be submitted to the Data Protection Authority (Chapter 4, sectio