2. Bulk interception regimes

veillance has ceased cannot by itself constitute a violation, it is nevertheless desirable to inform them after the termination of the measures “as soon as notification can be carried out without jeopardising the purpose of the restriction” (Roman Zakharov v. Russia [GC], §§ 287-290; Cevat Özel v. Turkey, §§ 34-37). The question whether it is necessary to notify an individual that he or she has been subjected to interception measures is inextricably linked to the effectiveness of domestic remedies (Roman Zakharov v. Russia [GC], § 286). 633. With regard to secret anti-terrorist surveillance operations, adequate and effective guarantees against abuses of the State’s strategic monitoring powers should exist (Weber and Saravia v. Germany with further references therein): The Court accepts that it is a natural consequence of the forms taken by presentday terrorism that governments resort to cuttingedge technologies, including mass surveillance of communications, in order to preempt impending incidents. Nevertheless, legislation governing such operations must provide the necessary safeguards against abuse regarding the ordering and implementation of surveillance measures and any potential redress (Szabó and Vissy v. Hungary, §§ 64, 68 and 78-81). Although the Court accepts that there may be situations of extreme urgency in which the requirement of prior judicial authorisation would entail a risk of wasting precious time, in such cases any measures authorised in advance by a nonjudicial authority must be subject to an ex post facto judicial review (§ 81). 634. The case of Kennedy v. the United Kingdom concerned a former prisoner campaigning against miscarriages of justice and claiming to be the victim of surveillance measures. The Court pointed out that the power to order secret surveillance of citizens was not acceptable under Article 8 unless there were adequate and effective guarantees against abuse. 635. In the case of Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria, a nonprofit association and a lawyer who represented applicants in proceedings before the Strasbourg Court alleged that they could be subjected to surveillance measures at any point in time without any notification. The Court observed that the relevant domestic legislation did not afford sufficient guarantees against the risk of abuse inherent in any system of secret surveillance and that the interference with the applicants’ Article 8 rights was therefore not “in accordance with the law”.

636. The case of Association “21 December 1989” and Others v. Romania concerned an association protecting the interests of participants in and victims of antigovernment demonstrations. The Court found a violation of Article 8 (§§ 171-175; contrast Kennedy v. the United Kingdom, § 169, no violation).

2. Bulk interception regimes

637. In the cases of Centrum för rättvisa v. Sweden [GC] (§§ 254-278) and Big Brother Watch and Others v. the United Kingdom [GC] (§§ 340-364), the Court considered the safeguards necessary in bulk interception regimes (sometimes called “signals intelligence”) as compared to targeted interception regimes. Unlike most targeted interception, the purpose of which is generally to investigate a specific target or an identifiable criminal offence, bulk interception regimes are in generally used for foreign intelligence gathering and the identification of new threats from both known and unknown actors. This being the case, the requirement to define clearly in domestic law the categories of people liable to have their communications intercepted and the nature of the offences which might give rise to such an order is not readily applicable to a bulk interception regime: nor is the requirement of “reasonable suspicion”. Nevertheless, it is imperative that the domestic law should set out with sufficient clarity and detail the grounds upon which bulk interception might be authorised and the circumstances in which an individual’s communications might be intercepted. Furthermore, in the context of bulk interception, the importance of supervision and review is amplified, because of the inherent risk of abuse and the legitimate need for secrecy. Article 8 applies at each stage of the bulk interception process, and the degree of interference with privacy rights increased

as the process moves through the different stages. These stages include, notably: 1) interception and initial retention of communications and related communications data; 2) application of specific selectors to the retained communications/related communications data; 3) examination of selected communications/related communications data by analysts; and 4) subsequent retention of data and use of the “final product”, including the sharing of data with third parties. 638. The need for safeguards is at its highest at the end of the process, where information about a particular person is analysed or the content of the communications is examined by an analyst. Therefore, the process must be subject to “end-to-end safeguards”. In assessing whether the respondent State had acted within its narrow margin of appreciation, the Court must take account of a wider range of criteria than the Weber safeguards. In addressing jointly “in accordance with the law” and “necessity”, the Court must examine whether the domestic legal framework clearly defines: 1) the grounds on which bulk interception might be authorised; 2) the circumstances in which an individual’s communications might be intercepted; 3) the procedure to be followed for granting authorisation; 4) the procedures to be followed for selecting, examining and using intercept material; 5) the precautions to be taken when communicating the material to other parties; 6) the limits on the duration of interception, the storage of intercept material and the circumstances in which such material must be erased and destroyed; 7) the procedures and modalities for supervision by an independent authority of compliance with the above safeguards and its powers to address noncompliance; and 8) the procedures for independent ex post facto review of such compliance and the powers vested in the competent body in addressing instances of non-compliance.