CEDH · CASELAW;CLIN;ENG — 28 mai 2024

.s3ABFC313 { font-size:10pt } .sD4B5322E { margin-top:12pt; margin-bottom:12pt; text-align:justify } .sBB9EE52A { font-family:Arial } .sA241FE93 { margin-top:0pt; margin-bottom:18pt; text-align:justify; page-break-after:avoid; border-bottom:0.75pt solid #000000; padding-bottom:1pt } .s2EF62ED2 { margin-top:0pt; margin-bottom:0pt; font-size:12pt } .s4DDA3AA3 { font-family:Arial; font-weight:bold; font-style:italic } .s29100277 { font-family:Arial; font-weight:bold } .s32563E28 { margin-top:0pt; margin-bottom:0pt } .s8F2B0B1B { margin-top:12pt; margin-bottom:12pt; page-break-after:avoid; font-size:12pt } .s65B66A85 { margin-top:12pt; margin-bottom:12pt } .s97EB40D9 { margin-top:12pt; margin-bottom:14pt; page-break-after:avoid } .sA36B60A1 { font-family:Arial; font-style:italic } .s5F48796F { margin-top:12pt; margin-bottom:0pt; text-align:justify } .s7ED160F0 { text-decoration:none } .s3DC36BA9 { font-family:Arial; text-decoration:underline; color:#0069d6 } .s8EB5F569 { font-family:Arial; font-size:6.67pt; vertical-align:super } .s8B6C6D43 { margin-top:0pt; margin-bottom:0pt; border-bottom:1pt solid #000000; padding-bottom:1pt } .sDF790F1E { margin-top:12pt; margin-bottom:0pt; text-align:center } Legal summary May 2024 Pietrzak and Bychawska-Siniarska and Others v. Poland - 72038/17 and 25237/18 Judgment 28.5.2024 [Section I] Article 8 Article 8-1 Respect for private life Inadequate safeguards against arbitrariness and abuse in legislation on measures for secret surveillance, retention of and access to communications data: violation Article 34 Victim Examination in abstracto of impugned legislation justified by secret nature and wide scope of surveillance measures and lack of effective domestic remedies to challenge them: victim status granted Facts – On 15   January 2016 the Polish Parliament enacted a law amending the Police Act and certain other legislative provisions which authorised a secret-surveillance regime and the retention of telecommunications, postal and digital communications data (“communications data”), for a twelve-month period from the date of connection, for possible future use by the relevant national authorities. On 10   June 2016 Parliament enacted a law on the prevention of terrorism (“the Anti-Terrorism Act”) authorising employees of the National Security Agency (“ABW”) to conduct secret surveillance of foreign nationals suspected of terrorist activities. Those laws were criticised at the domestic level. In its opinion CDL-AD (2016) 012 of 13   June 2016, the Venice Commission expressed reservations about the Law of 15   January 2016. The five applicants, a lawyer and four employees of non-governmental organisations, complained, first, about the regimes for secret surveillance and for the retention and use of communications data introduced under the two impugned laws, considering that they interfered with their right to respect for their private life. Secondly, they alleged that they had no effective remedy enabling them to establish whether they had personally been subjected to secret surveillance and, if necessary, to have the lawfulness of that surveillance reviewed by a court. Law – Article   8: 1.     The applicants’ victim status and the existence of an “interference” – Given the secret nature and wide scope of the measures provided for by the legislation challenged by the applicants, and the lack of effective review by which persons who believed that they had been subjected to surveillance could challenge this alleged surveillance, the Court found it appropriate to examine the legislation at issue in abstracto . Accordingly, it considered that the applicants could claim to be victims of a violation of the Convention, although they could not argue in support of their respective applications that they had been subjected to a specific secret-surveillance measure. For the same reasons, the Court found that the mere existence of the impugned legislation constituted in itself an interference with their rights under Article 8 of the Convention. 2.     Justification for the interference – The domestic legislation established two separate legal regimes for secret surveillance: the first concerned operational control 1 , and the second concerned the retention and use of communications data. (a)     Operational control – The Court considered that the operational-control regime as it existed in Poland did not provide for adequate and effective guarantees against arbitrariness and the risk of abuse which was inherent in any secret-surveillance regime. The scope both ratione materiae and ratione personae of the legislation on this surveillance was not delimited with sufficient precision, the overall duration of application of the surveillance was open to debate and the rules on factual justification for the surveillance were not sufficiently substantiated. While, at first sight, there was admittedly a judicial-review mechanism in place for the impugned surveillance regime, the Court was not convinced that the authorisation procedure, as applied in practice, was capable of ensuring that surveillance was used only where that measure was “necessary in a democratic society”. In that connection, the applicable legislation did not require a court deciding on a request for authorisation of surveillance to confirm whether there was a “reasonable suspicion” in respect of the individual targeted and, in particular, to investigate whether there was any evidence that this person was planning, carrying out or had carried out criminal acts or any other offence, such as acts endangering national security, that would warrant secret-surveillance measures,. The Court considered that the existing authorisation procedure should be supplemented by other post factum procedural review mechanisms; for example, where the surveillance had not led to criminal proceedings, a remedy available to persons who were concerned that they had been subjected to surveillance, with the possibility of seeking judicial review and a separate review by an independent body. As matters stood, the law did not appear to contain appropriate provisions in that regard; nor did it provide for an obligation to inform the person targeted by a surveillance measure, even after a certain period of time had elapsed and even where this would not compromise the aim of the measure. Lastly, the impugned legislation did not provide sufficient safeguards as concerned communications covered by legal professional privilege. All of these shortcomings led the Court to find that the national legislation did not provide sufficient safeguards against excessive recourse to surveillance and undue interference with individuals’ private life; the absence of such guarantees was not sufficiently counterbalanced by the existing mechanism for judicial review. The Court concluded that the national operational-control regime, taken as a whole, did not comply with the requirements of Article   8. Conclusion : violation (unanimously). (b)     Retention of communications data for potential use by the relevant national authorities – The data that information and communication technologies (“ICT”) service providers were required to retain encompassed information concerning, in particular, telephone calls made and received, numbers dialled, the length of calls, the geographical location of mobile devices, internet sites visited and connected to, and email addresses. Those data, to the extent that they were related to the sender or the recipient, painted an intimate picture of the person in question through the mapping of social networks, location tracking, internet browsing tracking and mapping of communication patterns, and insight into who a person interacted with. In those circumstances, the Court considered that the authorised bodies’ retention of the communications data in question entailed an intrusion into the applicants’ private sphere. In the Court’s view, the interference arising from the requirement on ICT service providers to retain their communications data was very serious. The measure could, with good reason, generate in the minds of the persons concerned a feeling of vulnerability and of being over-exposed to third-party scrutiny; it could also have an adverse effect on the effective enjoyment of their fundamental rights, including the right to respect for their private life and correspondence and the right to establish relationships with others. In that connection, the Court referred to the Grand Chamber judgment of the Court of Justice of the European Union (CJEU) in Digital Rights Ireland e.a . It was clear to the Court that the legislation complained of required the general and indiscriminate retention of telecommunications, postal and digital communications data of all users of communications services, and that it had an impact on persons whose data were retained although they were not, even indirectly, in a situation that was liable to give rise to criminal proceedings. The data thus retained for a twelve-month period were made available to the relevant police and intelligence services, which were able to access and use them for any purpose in the fulfilment of their respective statutory tasks. In that connection, although some safeguards against possible abuse existed in respect of the relevant State services’ access to communications data made available to them by ICT service providers, including a mechanism for retrospective judicial review, these were not sufficient to provide redress for the shortcomings noted in the regime governing the retention of communications data and could not, in consequence, bring the applicable regime into conformity with the requirements of Article   8. The Court referred in that connection to the judgment of the CJEU (Grand Chamber) in SpaceNet and Telekom Deutschland . The applicants also complained that the applicable legislation, in so far as it provided for access by the police and intelligence services to retained communications data in the manner described above, was incompatible with Article   8. The Court considered that, where a regime for retaining communications data did not satisfy the “quality of law” requirement or was at odds with the principle of proportionality, such that it was incompatible with Article   8, access to the data in question, their retention and their potential use by the authorities could not, for the same reason, be compatible with Article 8. In that connection, the Court referred to the judgment of the CJEU (Grand Chamber) in Commissioner of An Garda Síochána e.a. and stated that it saw no reason to depart from the findings of the highest EU court. In the light of the foregoing, the Court therefore considered that the national legislation, under which ICT service providers were required to retain communications data in a general and indiscriminate manner for possible future use by the relevant national authorities, was not sufficient to ensure that the interference with the applicants’ right to respect for their private life was limited to what was “necessary in a democratic society”. Conclusion : violation (unanimously). (c)     Secret-surveillance regime under the Anti-Terrorism Act – The scope ratione personae of the Anti-Terrorism Act, which was in principle limited to foreign nationals, was in practice much wider, in that it permitted ABW employees to monitor indirectly the communications of any person who had been in contact with persons targeted by surveillance, irrespective of whether he or she had personally been placed under surveillance. The Anti-Terrorism Act established a lex specialis regime in relation to the secret-surveillance provisions in the Police Act. It permitted ABW employees to carry out secret surveillance on a foreign national for an initial period of three months, with no prior judicial authorisation and without review by a body, independent of the ABW employees, which would be capable of curbing the latitude enjoyed by them in interpreting the general wording of the Anti-Terrorism Act and ensuring that there were sufficient grounds in each case to intercept a person’s communications. ABW employees conducted secret surveillance on the basis of a decision of the head of the ABW, under whose authority they fell, and that decision was subject to supervision by the Prosecutor General and the Minister for State Special Services. Judicial intervention was provided for only if secret-surveillance measures were subsequently extended on expiry of the initial three-month period. Thus, neither the imposition of a secret-surveillance measure nor its application in the initial three-month period was subject to any review by an independent body that did not include employees of the ABW conducting the surveillance. The Court had already indicated that the authorisation of secret-surveillance measures by a non-judicial body could be considered compatible with the Convention, provided that the body was sufficiently independent from the executive. Furthermore, it had already conceded that by the nature of contemporary terrorist threats there could be situations of emergency in which the mandatory application of judicial authorisation was not feasible, would be counterproductive for lack of special knowledge or would simply amount to wasting precious time. However, such measures had to be subject to post factum review, which was required, as a rule, in cases where the surveillance was authorised ex ante by a non-judicial authority. In the present case, the Court considered that the fact that the secret-surveillance measures were authorised by the head of the ABW – to whom the employees of the service conducting them were subordinate – and that any subsequent review of the application of those measures was carried out by a member of the executive with political responsibilities and by a member of the public prosecutor’s office who could not offer adequate guarantees of independence from the executive, was insufficient to provide the necessary safeguards against abuse. This was particularly so since persons subjected to surveillance were never informed of this fact and had no effective means of challenging its lawfulness. The Court concluded from the foregoing that the secret-surveillance provisions in the Anti-Terrorism Act also failed to satisfy the requirements of Article   8. Conclusion : violation (unanimously). Article   41: no claim in respect of damage. 1 “kontrolę operacyjną” – this term, which refers to secret surveillance, is translated in Article   19 of the official English translation of the Police Act as “operational control”. (See also Roman Zakharov v.   Russia [GC], 47143/06, 4   December 2015, Legal Summary ; Szabó and Vissy v.   Hungary , 37138/14, 12   January 2016, Legal Summary ; Big Brother Watch and Others v.   the United Kingdom [GC], 58170/13 and 2 others, 25   May 2021, Legal Summary ; Centrum för rättvisa v.   Sweden [GC], 35252/08, 25   May 2021, Legal Summary ; Ekimdzhiev and Others v.   Bulgaria , 70078/12, 11   January 2022, Legal Summary ; Digital Rights Ireland Ltd e.a. , judgment of 8   April 2014, C-293/12 and C-594/12 ; Commissioner of An Garda Síochána e.a. , judgment of 5   April 2022, C-140/20 ; SpaceNet and Telekom Deutschland , judgment of 20   September 2022, C-793/19 and C-794/19 )   © Council of Europe/European Court of Human Rights This summary by the Registry does not bind the Court. To access legal summaries in English or French click here . For non-official translations into other languages click here .