114. It should be noted in this connection that, as borne out by the facts of many cases examined by the Court, "correspondence" can be interfered with not only at the time when it is being sent or received, but also subsequently, through accessing the medium - physical or electronic - where it has been stored (see Niemietz v. Germany, 16 December 1992, § 32, Series A no. 251-B; Wieser and Bicos Beteiligungen GmbH v. Austria, no. 74336/01, § 45, ECHR 2007-IV; Bernh Larsen Holding AS and Others v. Norway, no. 24117/08, § 106, 14 March 2013; Vinci Construction and GTM Génie Civil et Services v. France, nos. 63629/10 and 60567/10, § 63, 2 April 2015; M.N. and Others v. San Marino, cited above, §§ 54-55; Sérvulo & Associados - Sociedade de Advogados, RL and Others v. Portugal, no. 27013/10, § 76, 3 September 2015; Saber v. Norway, no. 459/18, § 48, 17 December 2020; Särgava v. Estonia, no. 698/19, § 85, 16 November 2021; and Naumenko and SIA Rix Shipping v. Latvia, no. 50805/14, § 45, 23 June 2022).
115. It is not far-fetched to surmise that (a) a covert operative infiltrated into an organisation could use his or her position to obtain such access in a manner that would not be possible for an outsider, and that (b) such an operative, being an Agency officer, would report his or her findings to the Agency far more readily, and in a more sustained and systematic way, than a member of the public or a whistleblower driven by a sense of civic duty or even by statutory duty.
116. The infiltration of an "agent on cover" into the association would therefore amount to interference with its right to respect for its "correspondence" within the meaning of Article 8 § 1 of the Convention.
117. An "agent on cover" infiltrated into the association would also be likely to have long-term access to its office or other premises. According to the Court's case-law, a legal person's registered office, branches and other business premises can be considered as that legal person's "home" within the meaning of Article 8 § 1 of the Convention (see Société Colas Est and Others v. France, no. 37971/97, § 41, ECHR 2002-III; Buck v. Germany, no. 41604/98, § 31, ECHR 2005-I; Sallinen and Others v. Finland, no. 50882/99, § 70, 27 September 2005; Heino v. Finland, no. 56720/09, § 33, 15 February 2011; Bernh Larsen Holding AS and Others, cited above, § 104; Saint-Paul Luxembourg S.A. v. Luxembourg, no. 26419/10, § 37, 18 April 2013; DELTA PEKÁRNY a.s. v. the Czech Republic, no. 97/11, § 77, 2 October 2014; Lindstrand Partners Advokatbyrå AB v. Sweden, no. 18700/09, § 83, 20 December 2016; and Ships Waste Oil Collector B.V. and Others, cited above, § 146; see also Naumenko and SIA Rix Shipping, cited above, § 46, and UAB Kesko Senukai Lithuania v. Lithuania, no. 19162/19, § 109, 4 April 2023).
118. The infiltration of an "agent on cover" into the association would therefore also amount to interference with its right to respect for its "home" within the meaning of Article 8 § 1 of the Convention.
119. In view of the conclusions set out in paragraphs 116 and 118 above, it would be superfluous to ascertain whether the use of an "agent on cover" with respect to the association would also amount to interference with its right to respect for its "private life", if any (in relation to individuals, see on the one hand, Lüdi, cited above, § 40, and, on the other, Verliere v. Switzerland (dec.), no. 41953/98, ECHR 2001-VII, and Vukota-Bojić v. Switzerland, no. 61838/10, § 59, 18 October 2016; in relation to legal persons, see Bernh Larsen Holding AS, cited above, § 107).
(ii) Can the applicant association claim to be a victim of interference with those rights on account of the mere existence of the regulations on "agents on cover"?
120. The previously diverging strands of case-law regarding when applicants could claim to be victims of interference with their rights under Article 8 of the Convention on account of the mere existence of domestic laws or practices permitting covert surveillance were harmonised, and the general principles on the point clarified, in Roman Zakharov (cited above, § 171). They were more recently restated in Centrum för rättvisa (cited above, § 167).
121. Those principles are equally relevant to situations, such as the one at hand, where the secrecy of the surveillance in question is achieved not through fully disguising from the target that monitoring is under way - as happens for instance with the covert interception of communications or the use of covert surveillance equipment such as hidden cameras or recording devices - but through systematic arrangements calculated to conceal simply that the target's otherwise overt interlocutor (an acquaintance, business contact, employee, colleague, service provider, client, fellow practitioner, and so on) is in fact an operative systematically using or manipulating his or her position or relationships to obtain information for use by the authorities. In such situations, the persons targeted or affected by such surveillance remain similarly unaware of it.
(β) Application of those principles
122. Under the terms of regulation 52(1) of the 2008 Regulations, "agents on cover" may be deployed if there is a "proven operational need", and, by regulation 53(1) and (2), they can carry out intelligence and counterintelligence work aimed at the protection of national security, and their specific tasks are to be set by the head of the Agency in each individual case (see paragraphs 11-12 above). By regulation 50, as amended in September 2018, "agents on cover" can be infiltrated into any private organisation (see paragraphs 28-29 above). It follows that, theoretically, any non-governmental organisation in Bulgaria can become the target of such measures, and thus possibly be affected by the regulations in issue.
‒ Availability of an effective remedy
123. The next question is whether there exists in Bulgaria an effective remedy that can alleviate suspicions among the general public that the Agency's capability to deploy "agents on cover" can be abused.
124. As repeatedly insisted upon at the domestic level and by the Government in their observations before the Court (see paragraphs 24, 32-33, 36, 39-40 and 111 above), "agents on cover" do not constitute "special means of surveillance" within the meaning of the 1997 Act and related legislation (see paragraph 74 above). It follows that the body supervising the use of "special means of surveillance" in Bulgaria - the National Bureau for the Oversight of Special Means of Surveillance - is under no duty to supervise the deployment of such agents or to inform the persons concerned that such agents have been used with respect to them (see Ekimdzhiev and Others, cited above, §§ 130-35). It also follows that the special remedy put in place in 2009 with respect to "special means of surveillance" - a claim for damages in respect of their unlawful use (ibid., §§ 136-44 and 265-72) - does not apply to "agents on cover". That remedy is, in any event, not open to legal persons such as the applicant association (ibid., § 273). Indeed, the Government did not seek to argue that those legal avenues could provide any redress with respect to the use of "agents on cover".
125. What the Government did suggest was that members of the applicant association could have sought access to personal data of theirs processed in the Agency's databases by way of a request lodged under section 36(4) of the 2007 Act (see paragraph 60 above), and then challenged before the administrative courts under section 36(9) any refusal by the Agency to afford access to such data (see paragraph 105 above) - and thus discovered information about any "agents on cover" used with respect to the association.
126. Leaving to one side the fact that this avenue was not open to the association itself (since it is a legal person), it does not appear that that course of action was in practice capable of providing information about the use of "agents on cover" by the Agency. According to section 36(7) of the 2007 Act, the Agency can refuse, wholly or in part, to disclose data sought under section 36(4) if doing so would endanger national security, the protection of information classified as constituting a "State secret" or "official secret", or the confidentiality of its sources of information or of the covert methods and techniques employed by it in gathering that information, or if such disclosure would otherwise hinder the Agency's statutory tasks (see paragraph 63 above). Moreover, under section 35a of the 2007 Act, the Agency may refuse to disclose information about "agents on cover" to protect the methods or techniques that it uses to gather intelligence (see paragraph 48 (a) above). All examples of requests lodged under section 36(4) and ensuing judicial review challenges under section 36(9) of which the Court is aware, spanning over the period 2012-24, show that the Agency has been systematically availing itself of the possibility to refuse to disclose information about any aspect of its operations and that the Bulgarian administrative courts have been consistently upholding those refusals (see paragraphs 66-71 above; also compare, mutatis mutandis, Pietrzak and Bychawska-Siniarska and Others, cited above, § 241). The Government have not cited any contrary examples.
127. It follows that the remedy under section 36(4) and (9) of the 2007 Act cannot sufficiently dispel the public's misgivings about the threat posed by the abusive deployment of "agents on cover" by the Agency. It also follows that the Government's non-exhaustion objection based on those provisions (which was joined to the merits - see paragraphs 105 and 107 above) must be dismissed.
128. Nor can those misgivings be dispelled by other possible remedies.
129. The Government did not argue - and there is no indication - that there have so far been any instances of someone being able to obtain information concerning, or redress in relation to, the use of an "agent on cover" by way of lodging a complaint with the Commission for Protection of Personal Data. It is true that section 37 of the 2007 Act empowers that Commission to supervise the processing of personal data by the Agency in the manner provided by the 2002 Act (see paragraph 72 above). At the same time, section 1(5) of the 2002 Act itself (as amended in March 2019) states that the 2002 Act does not apply to the processing of personal data for national security purposes unless such processing is expressly provided for elsewhere - the stated rationale being that the elaborate data protection regime instituted by EU law, especially since the adoption of the GDPR and the LED, and reflected in the 2002 Act - does not cover the processing of personal data for activities relating to the protection of national security (see paragraph 82 above). It is therefore unclear whether section 37 of the 2007 Act can be read to mean that the 2002 Act's strictures apply to the processing of such data by the Agency for operational purposes (or only for other purposes - such as, for instance, staff administration and public procurement), and that that Commission can exercise the investigatory and remedial powers that it has under the 2002 Act with respect to data obtained by the Agency in the course of its intelligence operations.
130. Nor is there any indication that - apart perhaps from a 2009 audit of the Agency in connection with preparations for the future implementation of the Schengen Information System - that Commission has ever checked how the Agency processes operational data - and, in particular, whether it duly follows the statutory rules and the regulations which govern that matter (see paragraphs 52-54 and 96 above; also compare Ekimdzhiev and Others, cited above, §§ 346 and 412; also contrast, mutatis mutandis, Centrum för rättvisa, cited above, § 351, and Big Brother Watch and Others v. the United Kingdom ([GC], nos. 58170/13 and 2 others, §§ 409-10, 25 May 2021). On the contrary, the (apparently) only case in which that Commission was invited to look into the matter indicates that it was of the view that data resulting from surveillance carried out by the Agency did not amount to personal data, and that such operations by the Agency were not for it to supervise (see paragraph 84 above).
131. The possibility of complaining to that Commission cannot therefore be seen as an effective remedy with respect to the use of "agents on cover" (compare, mutatis mutandis, Ekimdzhiev and Others, cited above, § 346, and Hüttl v. Hungary [Committee], no. 58032/16, §§ 15-18, 29 September 2022; also contrast Breyer v. Germany, no. 50001/12, §§ 105 and 107, 30 January 2020, and Ringler v. Austria (dec.) [Committee], no. 2309/10, §§ 72-79, 15 May 2020).
132. The same considerations apply to the other general data protection remedies under the 2002 Act (see paragraphs 97-99 above).
133. The general possibility of seeking judicial review of the decisions of the head of the Agency - to which the Government referred in their observations on the merits (see paragraph 137 (b) below) - cannot be seen as an effective remedy with respect to the use of "agents on cover" either. The persons targeted or affected (whether directly or collaterally) by the deployment of such agents are by definition unaware that such deployment has taken place. As the Court has consistently emphasised, there is little scope for recourse to the courts unless those concerned are advised of a measure taken without their knowledge and are thus able to challenge it (see Klass and Others v. Germany, 6 September 1978, § 57, Series A no. 28; Weber and Saravia v. Germany (dec.), no. 54934/00, § 135, ECHR 2006-XI; Roman Zakharov, cited above, § 234; Sommer v. Germany, no. 73607/13, § 62, 27 April 2017; Centrum för rättvisa, cited above, § 251; and Big Brother Watch and Others, cited above, § 337). The Government have not sought to argue that such a claim for judicial review can be brought blindly, without identifying the specific decision of the head of the Agency that is being challenged - which is a general requirement for claims for judicial review in Bulgaria (see paragraph 100 above; also contrast, mutatis mutandis, Big Brother Watch and Others, cited above, § 413).
134. Seeking to engage the personal liability of "agents on cover" for acts carried out in the course of their work - a possible remedy to which the Government also referred in their observations on the merits (see paragraph 137 (c) below) - cannot be seen as an effective remedy with respect to the use of such agents either. There is an air of unreality about the suggestion that it is possible to engage the personal liability of such agents for unlawful interferences with rights protected under Article 8 of the Convention during the course of their work in the absence of any lawful possibility for the persons affected by their deployment to learn about it. Moreover, according to the Court's case-law, suing a private person does not constitute a remedy in respect of acts of the State (see Pine Valley Developments Ltd and Others v. Ireland, 29 November 1991, § 48, Series A no. 222; Iatridis v. Greece [GC], no. 31107/96, § 47 in fine, ECHR 1999-II; and Zlínsat, spol. s r.o., v. Bulgaria, no. 57785/00, § 55 in fine, 15 June 2006).
135. For the above reasons, the mere existence of the regulations in issue – which have since September 2018 permitted the infiltration of "agents on cover" into private organisations - can be seen as interference with the applicant association's rights under Article 8 of the Convention, without it being necessary to ascertain whether the association is at risk of having such agents infiltrated into it owing to its specific situation. It is therefore justified to examine those regulations (along with any related laws and practices) in the abstract (see, mutatis mutandis, Centrum för rättvisa, cited above, §§ 175-76). Indeed, by pursuing to a conclusion its claim for judicial review of those regulations (see paragraphs 31-40 above), the association has exhausted the available domestic remedies in respect of its complaint on that point. It follows that the Government's objection that the association cannot claim to be a victim of interference with its Article 8 rights, which was - like their non-exhaustion objection - joined to the merits (see paragraphs 103 and 107 above), must be dismissed.
2. Justification for the interference
136. The applicant association submitted that the interference had been neither "in accordance with the law" nor "necessary in a democratic society", since the regulations, which lacked detail and were unclear, did not lay down any safeguards against the misuse of "agents on cover". No conditions restricted their use, and they could be resorted to whenever the Agency deemed that there was an operational need for so doing. Nor was their use subject to prior authorisation or subsequent supervision by a judge. That opened the way towards their arbitrary deployment. Moreover, no rules defined their work, and no time-limits or procedures constrained their deployment. It seemed as though the very concept "of "agents on cover" had been devised to circumvent the statutory limitations on deploying "agents under cover". It was impossible in practice to engage the liability of such "agents on cover" in respect of any unlawful acts, since their identities remained confidential.
137. The Government argued that the preconditions for the use of "agents on cover" under the regulations in issue indicated that such agents were to be used exceptionally and as a measure of last resort, and emphasised in that connection the need for States to safeguard their national security. They also pointed out that the tasks of "agents on cover" were specifically set in each case, and argued that that their deployment was not without supervision, since (a) the Agency's work was supervised by Parliament, the President of the Republic and the Government, (b) all decisions of the Agency's head could be subjected to judicial review, and (c) "agents on cover" bore civil and criminal liability in respect of any unlawful acts carried out in the course of their work. Moreover, such agents had to apply for the position in which they would be infiltrated just like any other person, and needed to have the requisite qualifications to fill any such position. That meant that the Agency was not able to uncontrollably infiltrate such agents into any legal entity. Nor could those agents use technical means to record anything. Their work had a merely informative character and did not entail active investigation.
138. The Government went on to argue that the relevant law was fully accessible, since the 2007 Act and the impugned regulations had been published in the State Gazette. Moreover, the preconditions for infiltrating an "agent on cover" laid down in those regulations - in particular, that the use of such agents was a means of last resort and that they could be deployed only if there was a "proven operational need" - and the way in which they were to be infiltrated ensured that their use would be proportionate to the specific aims which called for it. As regards specifically the term "national security", it had been defined by statute (see paragraph 77 above). In the light of all those factors, it could also be accepted that the alleged interference had been intended to safeguard national security and to prevent disorder and crime, that "agents on cover" would not be used if that was not "necessary in a democratic society", and that the proportionality of resorting to them would be ascertained in each individual case.
139. The absence of time-limits in respect of the deployment of "agents on cover" was not an issue, since those were difficult to fix in advance. Nor could it be required that the authorities notify a target person or entity that an "agent on cover" has been deployed against him, her or it, since that could frustrate the purpose of using an "agent on cover". Those concerned by such a measure could seek information about the use of such agents under section 36(4) of the 2007 Act (see paragraph 60 above), and in such event the Agency would decide, with reference to the criteria in section 35a (see paragraph 48 (a) above), whether to give such information.
140. Under the second paragraph of Article 8 of the Convention, an interference with the rights protected by that Article can be justified only if it is "in accordance with the law" and "necessary in a democratic society" to attain one or more of the legitimate aims set out in that paragraph. Such interference otherwise entails a breach of that Article.
(α) With regard to the level of safeguards
141. The general principles regarding when covert surveillance can be justified under Article 8 § 2 of the Convention were set out in detail in Roman Zakharov (cited above, §§ 227-34, 236, 243, 247, 250, 257-58, 275, 278 and 287-88). Many of those principles were more recently reiterated, although in relation to a somewhat different context - the bulk interception of communications - in Centrum för rättvisa (cited above, §§ 246-53) and Big Brother Watch and Others (cited above, §§ 332-39).
142. There is no need to repeat those principles in full here, except to emphasise that the overarching requirement is that any covert surveillance system must contain effective safeguards - especially review and supervision arrangements - which can protect against the inherent risk of arbitrariness and abuse, and which can keep the interference that such a system entails with the rights protected by Article 8 of the Convention to what is "necessary in a democratic society".
143. Those principles are equally relevant to situations, such as the one at hand - where, as noted in paragraph 121 above, the secrecy of the surveillance is achieved through arrangements calculated to conceal that the target's otherwise overt interlocutor is in effect an operative using or manipulating his or her position or relationships to obtain information for use by the authorities. The degree of intrusion resulting from the use of this surveillance technique is not necessarily any lesser in a given case than that entailed by the interception of communications - in particular since such operatives can likewise obtain access to the content of the target's communications. According to the Court's case-law, the decisive factor for assessing what level of safeguards is required in relation to a given surveillance technique is the degree of intrusion with the rights under Article 8 of the Convention that it entails rather than its technical definition (see R.E. v. the United Kingdom, no. 62498/11, §§ 126-30, 27 October 2015, with reference to Bykov v. Russia [GC], no. 4378/02, § 78, 10 March 2009, and Uzun v. Germany, no. 35623/05, § 66, ECHR 2010). That said, the specific requirements flowing from those principles may need to be adjusted to account for the differences between the intrusion entailed by the use of an "agent on cover" and the degree of intrusion entailed by other covert surveillance techniques such as the interception of communications.
(β) With regard to the manner of examination of those safeguards
144. In cases such as the present one - in which the applicant complains in the abstract about a system that allows covert surveillance rather than of specific instances of such surveillance - the relevant domestic laws must be scrutinised as they stand when the Court examines the application rather than as they stood when it was lodged (see Centrum för rättvisa, § 151, and Big Brother Watch and Others, § 270, both cited above). The other point of relevance to this case is that the assessment of whether the laws in issue offer effective safeguards against abuse must be based not only on those laws as they are on paper, but also on (a) the actual operation of the surveillance regime in issue, and (b) the existence or absence of evidence that it has been abused (see Centrum för rättvisa, § 274, and Big Brother Watch and Others, § 360, both cited above).
(ii) Application of those principles
145. The 2008 regulations on "agents on cover" and their September 2018 amendments have both been officially published and are therefore accessible (see paragraphs 6 and 26 above).
146. The relevant issue in relation to the grounds on which covert surveillance may be resorted to and the persons who can be placed under such surveillance is whether the law authorising such surveillance defines clearly enough (a) the nature of the offences or other grounds that may give rise to surveillance and (b) the categories of persons who may be placed under surveillance (see Ekimdzhiev and Others, cited above, § 298).
147. By regulation 52(1), an "agent on cover" may be deployed if there is a "proven operational need", and regulation 52(2) specifies that such a need exists if the Agency's statutory tasks cannot be discharged in another way (see paragraph 11 above). Read in conjunction with the statutory provisions defining the main tasks of the Agency - namely, to safeguard national security and carry out counterintelligence activities (see paragraph 42 above) – this means that "agents on cover" may only be deployed whenever necessary to attain those tasks. A simple reference to "national security" as the purpose for deploying such agents does not necessarily contravene Article 8 of the Convention; rather, what matters is whether any potential arbitrariness or abuse flowing from the inherently vague and indeterminate meaning and contours of the notion of "national security" can be checked (see Ekimdzhiev and Others, cited above, § 301). In the absence of (a) any effective independent scrutiny of the Agency's decision to deploy an "agent on cover" (the Court will revert to that matter in more detail in paragraphs 151-152, 156-159 and 163-164 below), and of (b) a requirement to provide clear and concrete reasons demonstrating the need to deploy such an agent in a specific case, a serious issue arises in this respect (contrast Ekimdzhiev and Others, cited above, § 301 in fine). It must further be noted in that connection that the tasks of the Agency, as set out in a number of statutes, extend across a wide range of domains - several of which do not inherently concern unlawful conduct by potential targets (see paragraph 43 above). That significantly broadens the potential scope for deploying "agents on cover", and correspondingly increases the risk of arbitrariness or abuse.
148. By regulation 50, as amended in September 2018, "agents on cover" may be infiltrated (a) into the State administration, into legal persons and into civil associations, and (b) as persons exercising a "liberal profession" (except as lawyers in private practice); moreover, the wording of regulation 51 (as amended in September 2018) makes it plain that the position into which the "agent on cover" may be infiltrated need not necessarily be a position in a public entity (see paragraphs 28-29 above). From this, it can be inferred that theoretically any individual or private organisation in Bulgaria could find him-, her- or itself under surveillance by such agents, a situation which constitutes a significant interference into individual privacy rights, including a possible chilling effect on civic participation. The same considerations apply here: it is not the breadth of the potential field of work of such agents that is problematic in itself, but rather the absence of any effective independent check on potential arbitrariness or abuse.
(γ) Duration of the deployment of "agents on cover"
149. The regulations in issue do not subject the deployment of an "agent on cover" to any time-limits. Such agents can thus, theoretically, be deployed for indefinite periods - for as long as the Agency remains of the view that there is a "proven operative need" for their use. This is in marked contrast with the use of "special means of surveillance", the use of which is subject to time-limits - even when they are employed for national security purposes (see Ekimdzhiev and Others, cited above, § 305).
150. The relevant factors falling under this rubric are (a) the status of the authority that can authorise covert surveillance, and, if applicable, (b) the way in which that authority reviews surveillance requests and authorises surveillance (see Ekimdzhiev and Others, cited above, § 306).
151. A reading of regulations 52(3) and 53(2) (see paragraphs 11 in fine and 12 above) suggests that the procedure for deploying an "agent on cover" starts with a proposal made by the head of the respective division or unit of the Agency that wishes to deploy such an agent. That proposal - which must justify the existence of a "proven operational need" to use such an agent - is put to the head of the Agency, who decides whether to deploy the agent, and sets his or her specific tasks. The regulations make no provision for the approval of that deployment by any sort of independent outsider or at least for its notification to such an outsider (compare, mutatis mutandis, Pietrzak and Bychawska-Siniarska and Others, cited above, § 274).
152. It is true that, as already noted, by regulation 52(1), an "agent on cover" may be deployed if there is a "proven operational need", and that regulation 52(2) specifies that such a need exists if the Agency's statutory tasks cannot be discharged in another way (see paragraph 11 above). The manner in which those regulations are formulated thus introduces a degree of proportionality in the deployment of "agents on cover". However, the regulations give no indication of the factors that the head of the Agency must consider when assessing those points. In particular, the regulations do not require the head of the Agency to take his or her decision with reference to considerations relating to the Article 8 rights of the persons who stand to be affected by the agent's deployment, or to have regard to the degree to which the tasks assigned to the agent may intrude on the Article 8 rights of the target or of other persons (who might be collaterally affected by the agent's work), in particular where the agent's deployment is liable to give access to medical, journalistic, or legally privileged material or communications, which enjoy heightened protection under Article 8, or otherwise to situations in which the persons concerned may reasonably expect an enhanced degree of confidentiality. Nor do the regulations require the head of the Agency to carry out a proper balancing exercise in that regard. There is therefore no guarantee that "agents on cover" would be deployed only when genuinely necessary and proportionate in each case (see, mutatis mutandis, Ekimdzhiev and Others, cited above, § 321).
153. There is, moreover, no explicit requirement for the assessment of any such matters to be properly recorded by the Agency, so as to make it possible for the deployment of an "agent in cover" to be effectively scrutinised later.
154. The regulations in issue state nothing about the storing, accessing, examining, using, communicating and destruction of data obtained as a result of the use of "agents on cover". It therefore seems that all those matters are governed by the general rules regulating how the Agency processes its operational data (see paragraphs 51-54 above). In the absence of any submissions by the parties on this point (see paragraphs 136-139 above), the Court is not prepared to delve further into this aspect of the case. It would simply note that, by contrast, relatively detailed provisions govern all those matters in relation to data obtained by using "special means of surveillance" – and that, still, various lacunae in those provisions led it to conclude that it was possible for such data to be misused for ends that have little to do with the statutory purpose for which they are collected (see Ekimdzhiev and Others, cited above, §§ 325-32).
155. The factors relevant for deciding whether the supervision is adequate are (a) the independence of the supervisory authorities, their competences, and their powers (to access surveillance material and to redress breaches - in particular by ordering the destruction of surveillance material), and (b) the possibilities for effective public scrutiny of those authorities' work (see Ekimdzhiev and Others, cited above, § 334).
156. The regulations themselves make no provision for any supervision of the deployment or work of "agents on cover" (compare, mutatis mutandis, Antunes Rocha v. Portugal, no. 64330/01, § 77, 31 May 2005); moreover, as noted in paragraph 124 above, such agents fall outside the purview of the National Bureau for the Oversight of Special Means of Surveillance.
157. The special parliamentary committee tasked with supervising the Agency's work - the same as that which was in issue in Ekimdzhiev and Others (cited above, § 125) - although capable of dealing with individual cases, cannot order remedial measures; if it spots irregularities, it can only bring them to the attention of the prosecuting or other competent authorities (see paragraph 55 above). Moreover, that committee's members are not required to have any legal qualifications or experience (see Ekimdzhiev and Others, cited above, § 414). Nor does it seem that the committee has in practice exercised detailed and regular control over the Agency's operations in general - let alone control specifically focusing on its use of "agents on cover" - or has ever got involved in the Agency's day-to-day work (compare Ekimdzhiev and Others, cited above, § 345, and, mutatis mutandis, Szabó and Vissy v. Hungary, no. 37138/14, § 82, 12 January 2016; also contrast Leander, cited above, §§ 40 and 65).
158. There is no indication that the Agency's head, deputy heads or officers have ever been called to the Bulgarian Parliament to report on the use by the Agency of "agents on cover" (see paragraph 56 above). Nor is there any indication that the point has been adverted to in reports by the Agency to the Government or the President of the Republic (see paragraphs 57-58 above). In any event, such general political control can hardly be considered independent (see, mutatis mutandis, Association for European Integration and Human Rights and Ekimdzhiev, § 87, and Szabó and Vissy, § 75, both cited above), or sufficient to prevent individual abuses.
159. Nor does it seem that the Agency's operations involving the use of "agents on cover" have ever been checked by the Commission for Protection of Personal Data - which under section 37 of the 2007 Act supervises the processing of personal data by the Agency (see paragraph 72 above). Indeed, as noted in paragraph 128 above, it is unclear whether the power that section 37 bestows upon that Commission relates to operational data gathered by the Agency.
160. In view of the above considerations, the system for supervising the use of "agents on cover" does not appear capable of providing effective guarantees against their arbitrary or abusive deployment by the Agency (see, mutatis mutandis, Ekimdzhiev and Others, cited above, § 347), or against the risk of misuse of power by the "agents on cover" themselves - which, as the practice of other States shows, can be seen as real in the absence of proper supervision (see the comparative-law information referred to in Veselov and Others v. Russia, nos. 23200/10 and 2 others, §§ 50 and 62, 2 October 2012).
161. The relevant factors under this rubric are (a) whether it is possible for the authorities to notify a target person or entity that an "agent on cover" has been deployed against him, her or it, and (b) whether such notification constitutes a prerequisite for resorting to any available remedies (see Ekimdzhiev and Others, cited above, § 348).
162. The regulations in issue, as amended in September 2018, make no provision for anyone to be notified - under any circumstances and at any point – of the use of an "agent on cover". Neither can any such notification be made by the National Bureau for the Oversight of Special Means of Surveillance (see paragraph 124 above). It does not appear that there is provision for such notification elsewhere in Bulgarian law. Nor does it seem possible for persons possibly affected by the use of such agents to obtain information about such use under the provisions governing access to personal data processed by the Agency (see paragraphs 125-127 above), or under the general data protection legislation (see paragraph 128 above). This absence of notification or information, although not necessarily problematic in itself (since the disclosure of the fact that an "agent on cover" has been deployed in a particular organisation would in many cases inevitably give clues about the identity of that agent, or even be effectively tantamount to disclosing his or her identity), in turn affects the possibilities for those persons to seek a remedy (see paragraphs 133-134 above).
163. As noted in paragraph 124 above, the special remedy put in place in 2009 with respect to "special means of surveillance" - a claim for damages for their unlawful use (see Ekimdzhiev and Others, cited above, §§ 136-44 and 265-72) - does not apply to "agents on cover". The data protection remedy under section 36(4) and (9) of the 2007 Act does not appear to be effective in relation to them either. The same goes for the possibilities of (a) complaining to the Commission for Protection of Personal Data, (b) resorting to the other general data protection remedies under the 2002 Act, (c) seeking judicial review of the decisions of the head of the Agency, and (d) engaging the personal liability of "agents on cover" (see paragraphs 125-134 above).
164. It follows that Bulgarian law does not provide an effective remedy with respect to the use of "agents on cover".
165. In sum, the regulations governing the use of "agents on cover" fall short of the minimum safeguards against arbitrariness and abuse required under Article 8 of the Convention in the following respects:
(a) the broadly-defined grounds on which such agents can be deployed and fields in which they can be deployed, coupled with the way in which that deployment is decided, are capable of leading to arbitrariness and abuse (see paragraph 146-148 above);
(b) no time-limits circumscribe the use of such agents (see paragraph 149 above);
(c) the procedure for deploying such agents does not appear capable of ensuring that they will be used only when "necessary in a democratic society" (see paragraph 151-153 above);
(d) no arrangements exist for effective supervision of the use of such agents, which can lead to arbitrariness and abuse, as well as to corruption or the misuse of power by the "agents on cover" themselves (see paragraphs 156-160 above); and
(e) there is no remedy in relation to the unlawful or unjustified use of such agents (see paragraphs 163-164 above).
166. It is true that there is no evidence that those shortcomings in the legal regime have had an actual impact on the use of "agents on cover" in Bulgaria. But since that use is by definition clandestine and no information is available about it in the public domain, no decisive weight can be attached to that lack of evidence of arbitrariness or abuse. Moreover, the regulations were amended relatively recently (in September 2018) to make it possible for "agents on cover" to be infiltrated into private organisations and "liberal professions".
167. It follows that the Bulgarian domestic provisions on "agents on cover" do not meet the quality-of-law requirement and are incapable of keeping the interference with rights protected under Article 8 of the Convention entailed by the use of such agents to what is "necessary in a democratic society".
168. There has therefore been a breach of Article 8 of the Convention.
II. APPLICATION OF ARTICLE 41 OF THE CONVENTION
169. Article 41 of the Convention provides:
"If the Court finds that there has been a violation of the Convention or the Protocols thereto, and if the internal law of the High Contracting Party concerned allows only partial reparation to be made, the Court shall, if necessary, afford just satisfaction to the injured party."
1. The association's claim and the Government's comments on it
170. The applicant association claimed 4,000 euros (EUR) in respect of the non-pecuniary damage that it had allegedly suffered as a result of the impugned regulations.
171. The Government contested the claim in full, noting that in similar previous cases no award had been made in respect of non-pecuniary damage. In the alternative, they submitted that the claim was exorbitant, since there was no evidence that those regulations had resulted in any actual interference with the association's rights under Article 8 of the Convention.
172. As attested by the adjective "just" and the phrase "if necessary" in Article 41 of the Convention, the Court enjoys discretion in the exercise of the power to afford such satisfaction to the injured party (see, as a recent authority, Molla Sali v. Greece (just satisfaction) [GC], no. 20452/14, § 32, 18 June 2020). In some cases, the public vindication of the wrong suffered by that party, in a judgment binding on the respondent State, can in itself amount to sufficient redress. This is especially so when, as here, (a) the finding of breach is based solely on the conclusion that a law, procedure or practice has fallen short of Convention standards (ibid., § 33, with reference to Varnava and Others v. Turkey [GC], nos. 16064/90 and 8 others, § 224, ECHR 2009), without a further finding that this shortcoming has affected the applicant in any tangible way, and (b) general measures would constitute the most appropriate form of redress (see paragraph 4 of the Practice Direction on Just Satisfaction Claims, as amended in June 2022).
173. In the present case, no evidence has been produced to show that the existence of the regulations on "agents on cover", as amended in September 2018, has caused the applicant association any tangible detriment. The association did not even specify the nature of the non-pecuniary damage that it had allegedly suffered on that account. Even if it is accepted that it has indeed suffered some damage of that sort on account of the mere existence of those regulations, the finding of a breach of Article 8 of the Convention affords it sufficient just satisfaction in that regard (see Ekimdzhiev and Others, cited above, § 426, with further references). It is, then, not necessary to award it any monetary compensation in respect of such damage.
174. It must at the same time be emphasised that under Article 46 of the Convention, a judgment in which the Court finds a violation of the Convention or its Protocols imposes on the respondent State an obligation to choose, subject to supervision by the Committee of Ministers, the general and/or, if appropriate, individual measures to be taken in its domestic legal order to end the violation and make all feasible reparation for its consequences in a way to restore as far as possible the situation which would have obtained if the violation had not taken place. Moreover, it follows from the Convention, and from its Article 1 in particular, that in ratifying it the Contracting States undertook to ensure that their domestic laws would be compatible with it (see Ekimdzhiev and Others, cited above, § 427).
175. The applicant association sought reimbursement of EUR 3,500 said to have been incurred during the proceedings for judicial review of the impugned regulations, and EUR 3,000 said to have been incurred for the services of the lawyer who had represented it before the Court. It produced no documents in support of those claims.
176. The Government pointed out that the claims were neither itemised nor supported by evidence, and invited the Court to dismiss them. In the alternative, they argued that the claim relating to the proceedings before the Court was exorbitant, since the volume of the submissions made on behalf of the association and of the case file did not warrant such a high level of costs.
177. According to the Court's case-law, applicants are entitled to the reimbursement of costs and expenses only in so far as it has been shown that these were actually and necessarily incurred and are reasonable as to quantum. Since the association produced no documents in support of its claim, there is no basis on which to find that it actually incurred the costs and expenses whose reimbursement it seeks (see also paragraphs 18 and 21 of the Practice Direction on Just Satisfaction Claims, as amended in June 2022). In those circumstances, and bearing in mind also the terms of Rule 60 §§ 2 and 3 of the Rules of Court, the Court makes no award under this head.
FOR THESE REASONS, THE COURT, UNANIMOUSLY,
1. Joins the Government's objections that the applicant association has not exhausted the available domestic remedies and that it cannot claim to be a victim of interference with its rights under Article 8 of the Convention to the merits, and dismisses them;
2. Declares the application admissible;
3. Holds that there has been a violation of Article 8 of the Convention;
4. Holds that the finding of a violation of Article 8 of the Convention amounts to sufficient just satisfaction in respect of any non-pecuniary damage suffered by the applicant association;
5. Dismisses the remainder of the applicant association's claim for just satisfaction.
Done in English, and notified in writing on 17 February 2026, pursuant to Rule 77 §§ 2 and 3 of the Rules of Court.
Milan Blaško Ioannis Ktistakis
Registrar President
[1] In 2013-15, when the Agency had - on top of its main task of safeguarding national security – also the task of investigating criminal offences relating to national security (see paragraph 42 in fine below), it could deploy "agents under cover" as well. Their use was governed by regulations 62a-62l, added in December 2013 and repealed in June 2015.
[2] Those also sometimes described as "simulated purchases" or "test purchases".
[3] Article 4(1) of the GDPR defines "personal data" as "any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person".
[4] The processing of personal data for law-enforcement purposes by the courts and by the prosecuting and investigating authorities (which by Article 117 § 2 of the 1991 Constitution of Bulgaria are also part of the judicial branch) is supervised by the Supreme Judicial Council's Inspectorate (section 78(2) of the 2002 Act).
[5] See footnote 3 above.
BAILII: