214. If the Agency had gathered intelligence on Mr Kanev and the Committee (including by recruiting members or staff of the Committee as informers) that could have also yielded data about Mr Kanev's and the Committee's "correspondence" within the meaning of Article 8 § 1 of the Convention (see, mutatis mutandis, Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria, no. 62540/00, § 60, 28 June 2007, and Ekimdzhiev and Others v. Bulgaria, no. 70078/12, § 263, 11 January 2022). As construed in the Court's case-law, that term covers all sorts of private communications, whatever their content or the form that they might take - oral communications, letters, telephone conversations or electronic exchanges (see Michaud v. France, no. 12323/11, § 90, ECHR 2012; M.N. and Others v. San Marino, no. 28005/12, § 52, 7 July 2015; and Klaus Müller v. Germany, no. 24173/18, § 37, 19 November 2020). In particular, it covers calls made from or received on office telephones (see Halford v. the United Kingdom, 25 June 1997, § 44, Reports of Judgments and Decisions 1997‑III; Kopp v. Switzerland, 25 March 1998, § 50, Reports 1998-II; Amann, cited above, § 44; Liblik and Others v. Estonia, nos. 173/15 and 5 others, § 110, 28 May 2019; and Algirdas Butkevičius v. Lithuania, no. 70489/17, § 63, 14 June 2022), as well as work emails (see Copland v. the United Kingdom, no. 62617/00, § 41, ECHR 2007-I). The term also extends to the communications of legal persons (see Ships Waste Oil Collector B.V. and Others v. the Netherlands [GC], nos. 2799/16 and 3 others, § 146, 1 April 2025).
215. It should be noted in this connection that, as borne out by the facts of many cases examined by the Court, "correspondence" can be interfered with not only at the time when it is being sent or received, but also subsequently, through accessing the medium - physical or electronic - where it has been stored (see Niemietz v. Germany, 16 December 1992, § 32, Series A no. 251-B; Wieser and Bicos Beteiligungen GmbH v. Austria, no. 74336/01, § 45, ECHR 2007-IV; Bernh Larsen Holding AS and Others v. Norway, no. 24117/08, § 106, 14 March 2013; Vinci Construction and GTM Génie Civil et Services v. France, nos. 63629/10 and 60567/10, § 63, 2 April 2015; M.N. and Others v. San Marino, cited above, §§ 54-55; Sérvulo & Associados - Sociedade de Advogados, RL and Others v. Portugal, no. 27013/10, § 76, 3 September 2015; Saber v. Norway, no. 459/18, § 48, 17 December 2020; Särgava v. Estonia, no. 698/19, § 85, 16 November 2021; and Naumenko and SIA Rix Shipping v. Latvia, no. 50805/14, § 45, 23 June 2022).
216. However, Mr Kanev and the Committee did not know whether the Agency had gathered intelligence on them, including intelligence coming from any informers which the Agency might have recruited from among members or staff of the Committee. The very purpose of the request which Mr Kanev addressed to the Agency - on his own behalf and on behalf of the Committee - was to obtain information on the point (see paragraphs 6 and 8 above).
217. It is true that the request was not framed as a conventional one for access to personal data held by the Agency. Nor did it expressly ask for access to particular data entries, their rectification or erasure. Its immediate object was narrower: to obtain confirmation whether the applicants had been subjected to intelligence-gathering measures or whether the Agency held information to that effect. Even so, such a request is closely connected to the protection afforded by Article 8 of the Convention, since confirmation whether an authority entrusted with safeguarding national security has gathered intelligence on a person may constitute a necessary preliminary step for the exercise of any further rights or remedies in relation to covert data processing affecting that person's "private life" or "correspondence".
218. It would be inconsistent with the object and purpose of Article 8 of the Convention to hold that if in response to such a request the relevant authority gives an evasive or non-committal answer, or refuses to disclose whether it has gathered intelligence on the person concerned or is processing data relating to him or her, that Article finds no application unless it is positively established that such data are in fact being processed. Doing so would also run counter to the settled position that the Convention must be interpreted in a way that renders the rights it guarantees practical and effective (see Artico v. Italy, 13 May 1980, § 33, Series A no. 37; Soering v. the United Kingdom, 7 July 1989, § 87, Series A no. 161; and Demir and Baykara v. Turkey [GC], no. 34503/97, § 66, ECHR 2008). It would also enable the authorities to evade scrutiny in this field simply by refusing to confirm or deny whether covert measures affecting rights protected by Article 8 have been used (see, mutatis mutandis, Klass and Others v. Germany, 6 September 1978, § 36 in fine, Series A no. 28; Kennedy v. the United Kingdom, no. 26839/05, § 124, 18 May 2010; and Roman Zakharov v. Russia [GC], no. 47143/06, § 169, ECHR 2015). Indeed, the former Commission and the Court have both had occasion to hold, consistently with that rationale, that a refusal to advise someone of the full extent of the information about him or her that is being held by a public authority amounts, in its own right, to interference with that person's rights under Article 8 (see Schaller Volpi v. Switzerland, no. 25147/94, Commission decision of 28 February 1996, Decisions and Reports (DR) 84-B, p. 106, at pp. 109-10, and Segerstedt-Wiberg and Others, cited above, § 99; see also, mutatis mutandis, Antunes Rocha v. Portugal, no. 64330/01, §§ 64-65, 31 May 2005).
219. It follows that the Agency's refusal to disclose whether it had gathered intelligence on Mr Kanev or the Committee engaged Article 8 of the Convention. The Government's objection that the complaint is incompatible ratione materiae with the provisions of the Convention must accordingly be dismissed.
2. Exhaustion of domestic remedies
220. The Government submitted that the applicants had not exhausted domestic remedies. Their objection comprised three lines of argument:
(a) The applicants had not sought access to personal data relating to themselves but to information about intelligence-gathering operations with respect to them. As the Supreme Administrative Court had explained when upholding the Agency's refusal to disclose such information, that kind of information did not constitute personal data.
(b) Mr Kanev's legal challenge against the rule prescribing that information of the kind the applicants were seeking constituted an "official secret" was still ongoing (see paragraphs 32-39 above). If it resulted in the annulment of that rule, the applicants would be able to seek that information anew.
(c) The claim for judicial review of the Agency's second refusal to disclose the information sought by the applicants was likewise still ongoing (see paragraphs 42-44 above).
221. The applicants replied that by pursuing to conclusion the claim for judicial review of the Agency's first refusal to disclose the information that they had sought (see paragraphs 12-27 above), they had already exhausted domestic remedies. The proceedings for judicial review of the Agency's second refusal to disclose that information (see paragraphs 42-44 above) were immaterial for the admissibility of their application to the Court; they had brought those proceedings simply to probe once again the Agency's stance. For its part, the legal challenge against the Agency's rule deeming that information of the kind that the applicants were seeking constituted an "official secret" could not lead to the disclosure of that information, which the Agency had later described as a "State secret".
(i) First branch of the non-exhaustion objection
222. With reference to the first branch of the non-exhaustion objection raised by the Government, the Court notes that the applicants followed the procedural route indicated by the Agency itself. After the Agency stated that the part of the June 2021 request concerning intelligence-gathering methods or techniques and the recruitment of informers touched on the existence of data in its databases and fell to be pursued under section 36(4) of the 2007 Act, Mr Kanev reformulated the request accordingly and then sought judicial review of the ensuing refusal under section 36(9) of that Act (see paragraphs 7-12 and 67-72 above). Even if that request was not framed as a conventional one for access to personal data, it cannot be said that the applicants failed to make proper use of the remedy which, according to the Agency itself, was applicable in the circumstances of the case.
(ii) Second branch of the non-exhaustion objection
223. The second branch of the objection does not stand up to scrutiny either. Mr Kanev asked the Supreme Administrative Court to stay the proceedings in which he was seeking judicial review of the Agency's refusal to disclose information pending the conclusion of his separate legal challenge against the rule that information of the kind that he was seeking was an "official secret". However, the panel of the court dealing with the former case refused to stay the proceedings, holding that the resolution of the legal challenge against the rule could not affect the lawfulness of the Agency's refusal to disclose the information sought by Mr Kanev, since the Agency itself had not cited that rule when refusing his request (see paragraphs 22 and 27 above). It is therefore unclear how a favourable outcome of the legal challenge against the rule (see paragraph 32 above) could enable the applicants to overturn the Agency's decision in their particular case. In any event, those proceedings ended with a final dismissal of that legal challenge (see paragraph 39 above). That second branch of the objection has therefore lost its relevance, if any (see, mutatis mutandis, Molla Sali v. Greece [GC], no. 20452/14, § 90, 19 December 2018; Zoltán Varga v. Slovakia, nos. 58361/12 and 2 others, § 112, 20 July 2021; and Panayotopoulos and Others v. Greece, no. 44758/20, § 90, 21 January 2025).
(iii) Third branch of the non-exhaustion objection
224. Nor can the third branch of the objection be sustained. As is evident from the terms of the applicants' complaint under Article 8 of the Convention (raised in September 2022, when they lodged the present application), it concerns the Agency's refusal to disclose information in July 2021 (see this judgment's preamble and paragraphs 9 and 209 above). Mr Kanev's renewed request to the Agency - made and refused in June 2023 (see paragraphs 40-41 above), about nine months after the applicants lodged the present application - and the proceedings in which Mr Kanev sought judicial review of that refusal (see paragraphs 42-44 above), are therefore of no relevance for the question of whether domestic remedies have been exhausted in relation to that complaint. The only remedies whose exhaustion is required under Article 35 § 1 of the Convention are those which relate to the breaches alleged (see, among many other authorities, Van Oosterwijck v. Belgium, 6 November 1980, § 27, Series A no. 40; De Jong, Baljet and Van den Brink v. the Netherlands, 22 May 1984, § 39, Series A no. 77; and Paksas v. Lithuania [GC], no. 34932/04, § 75, ECHR 2011).
225. It is true that the ongoing retention of data amounts to a continuous situation (see Hilton v. the United Kingdom, no. 12015/86, Commission decision of 6 July 1988, DR 57, p. 108, at p. 114; M.M. v. the United Kingdom, no. 24029/07, §§ 160 and 172, 13 November 2012; and Borislav Tonchev v. Bulgaria, no. 40519/15, § 88, 16 April 2024). However, holding that the applicants need to engage in further attempts to obtain the information that they first sought from the Agency in June 2021, and to then challenge domestically further refusals by the Agency to disclose such information, might permanently bar them from complaining in that respect to the Court - since such renewed information requests can in theory be made an indefinite number of times (see, mutatis mutandis, Guzzardi v. Italy, 6 November 1980, § 80, Series A no. 39; Nenov v. Bulgaria, no. 33738/02, § 38, 16 July 2009; Naydenov v. Bulgaria, no. 17353/03, § 58 in fine, 26 November 2009; United Macedonian Organisation Ilinden and Others v. Bulgaria (no. 2), no. 34960/04, § 27, 18 October 2011; and United Macedonian Organisation Ilinden-PIRIN and Others v. Bulgaria (no. 2), nos. 41561/07 and 20972/08, § 70, 18 October 2011). Moreover, the possibility of asking a public authority to reconsider a decision that it has already taken is normally not an effective remedy (see Roseiro Bento v. Portugal (dec.), no. 29288/02, ECHR 2004-XII; United Macedonian Organisation Ilinden and Others (no. 2), cited above, § 27 in fine; United Macedonian Organisation Ilinden-PIRIN and Others (no. 2), cited above, § 70 in fine; and Vasil Vasilev v. Bulgaria, no. 7610/15, § 112 in fine, 16 November 2021).
226. In any event - and perhaps most importantly in the present case - the proceedings for judicial review of the Agency's second refusal to disclose the information in June 2023 ended in July 2024, and, in the event, their outcome provided no redress to the applicants - they led simply to a reiteration of the Agency's two earlier refusals to disclose the information sought by them (see paragraphs 45-50 above). That third branch of the objection has therefore likewise lost its relevance, if any (see, mutatis mutandis, Molla Sali, § 90; Zoltán Varga, § 112; and Panayotopoulos and Others, § 90, all cited above).
227. It follows that the Government's objection that domestic remedies have not been exhausted must be dismissed as well.
3. The Court's conclusion on the admissibility of the complaint
228. It was already established that this complaint is not incompatible ratione materiae with the provisions of the Convention and that the applicants have exhausted domestic remedies with respect to it (see paragraphs 212-219 and 222-227 above). The complaint is not manifestly ill-founded or inadmissible on other grounds either. It must therefore be declared admissible.
1. Existence of an interference with rights protected under Article 8 of the Convention
229. The applicants contended that it remained unclear whether the Agency had gathered intelligence on them; it had neither confirmed nor denied that - either at domestic level or in its reply in connection with the proceedings before the Court. There was, nonetheless, a strong suspicion that it had in fact done so. It had been fully possible for the Agency to answer that question, even in relation to members or staff of the Committee. The possibility of obtaining information about the use of "special means of surveillance" though the National Bureau was ineffective, since the Bureau had to in turn get that information from the Agency, and the Agency deemed such information to be classified. The 2007 Act did not lay down sufficient safeguards, which meant that anyone could have their data collected and stored by the Agency (which had broad powers and operated in secret). Since no one could check whether the Agency had indeed collected and stored his or her data, it was reasonable to surmise that the applicants had also been of interest to it.
230. The Government observed that the Agency had not confirmed that it had gathered or stored data relating to the applicants, and that there was no indication that it had in fact done so (apart from data relating to access-to-information requests by the applicants and related judicial review proceedings). The applicants' misgivings on that point were abstract and baseless, being founded just on statements made by the Minister of Internal Affairs relating to politicians and participants in the 2020-21 anti-government protests. The applicants fell in neither of those categories, and their supposition that they might have been of interest to the Agency was vague and far-fetched. The reasons that the Agency had given to refuse Mr Kanev's request and those that the courts had then given to dismiss his claim for judicial review of that refusal contained nothing that could suggest otherwise. There had, then, been no interference with the applicants' Article 8 rights. Moreover, as attested by the National Bureau's response (see paragraph 31 above), no "special means of surveillance" had been employed with respect to Mr Kanev throughout the period in question. No such means could be used with respect to the Committee, since under Bulgarian law such means could be deployed only with respect to individuals, not legal persons. There was therefore no evidence that data about the applicants had been obtained by the Agency in the course of its operations.
231. The Government further argued that the Agency's refusal to disclose the information sought by the applicants had not interfered with their Article 8 rights either, since the applicants' request had concerned no personal data of theirs.
232. In the particular circumstances of the present case, the Agency's refusal to disclose whether it had gathered intelligence on Mr Kanev or the Committee amounted, in its own right, to an interference with their rights under Article 8. The applicants' request concerned the possible use of covert intelligence-gathering measures capable of affecting their "private life" and "correspondence", and the Agency's response was in substance one of refusal to confirm or deny whether such measures had been applied. Such a refusal may itself constitute an interference within the meaning of Article 8 (see Segerstedt-Wiberg and Others, cited above, § 99, and, mutatis mutandis, Centrum för rättvisa v. Sweden [GC], no. 35252/08, §§ 244-45, 25 May 2021, and Big Brother Watch and Others v. the United Kingdom [GC], nos. 58170/13 and 2 others, §§ 330-31, 25 May 2021).
2. Justification for the interference
233. Under the second paragraph of Article 8 of the Convention, such interference can be justified only if it was "in accordance with the law" and "necessary in a democratic society" to attain one or more of the legitimate aims set out in that paragraph. It otherwise entails a breach of that Article.
234. The applicants reiterated that the 2007 Act did not lay down effective safeguards against the arbitrary use of "special means of surveillance", which had enabled the Agency to operate in an unforeseeable manner. By refusing to disclose whether it had gathered intelligence on the applicants, the Agency had made it impossible for them to check the nature, scope and duration of any such interference with their rights. Contrary to what the Government claimed, the Agency had declined to answer that question. It was true that States had a wide margin of appreciation in that sphere, but they were still required to have in place effective guarantees against abuse. The interference could not be justified with reference to national security, since the applicants had not sought information about any techniques or methods used for surveillance, or details about that; Mr Kanev's request had been formulated quite generally. Moreover, in Bulgaria the concept of national security had a long history of misuse. The interference had therefore not been "necessary in a democratic society".
235. The Government submitted that any interference with the applicants' Article 8 rights had been "in accordance with the law", since the Agency's refusal to disclose information about any intelligence-gathering in relation to them had been based on the provisions of the 2007 Act, which were clear and accessible. The interference had sought to safeguard national security, since any publicity could render the Agency's methods and techniques ineffective. In view of the nature of the information sought by the applicants, the refusal to disclose it had also been proportionate and had fallen within the authorities' margin of appreciation, which was wide in that sphere.
(i) Was the interference "in accordance with the law"?
236. There can be no doubt about the necessity, for the purpose of protecting national security, for the Contracting States to have laws granting their competent authorities the power to collect and store in databases not accessible to the public information about persons (see Leander, cited above, § 59). However, the phrase "in accordance with the law" does not just mean that an interference with rights under Article 8 of the Convention must have a basis in domestic law, but also refers to the quality of that law - requiring it to be accessible, foreseeable and compatible with the rule of law (see Kopp, § 55; Amann, §§ 50 and 56; Rotaru, § 52; and Segerstedt-Wiberg and Others, § 76, all cited above). In the sphere under consideration, this entails, in particular, the availability of effective safeguards against arbitrariness and abuse. This is because (a) a surveillance system not open to scrutiny by the persons concerned or the public at large (because it is being operated by the authorities in secret) presents obvious risks in that respect, and because (b) a surveillance system designed to safeguard national security may undermine or even destroy democracy on the pretence of defending it (see Leander, § 60; Amann, § 56; Rotaru, §§ 55 and 59; Antunes Rocha, § 76; and Segerstedt-Wiberg and Others, § 76, all cited above).
237. Naturally, in this sphere, as in others, the requisite safeguards will depend on the nature and extent of the interference (see, among other authorities, P.G. and J.H. v. the United Kingdom, no. 44787/98, § 46, ECHR 2001-IX; C.G. and Others v. Bulgaria, no. 1365/07, § 45, 24 April 2008; El Haski v. Belgium, no. 649/08, § 107, 25 September 2012; and Giuliano Germano v. Italy, no. 10794/12, § 94, 22 June 2023). The context within which the interference is taking place is also a material consideration (see I.R. and G.T. v. the United Kingdom (dec.), nos. 14876/12 and 63339/12, § 61 in fine, 28 January 2014; Saeed v. Denmark (dec.), no. 53/12, § 35, 24 June 2014; and Mirzoyan v. the Czech Republic, nos. 15117/21 and 15689/21, § 81 in fine, 16 May 2024).
238. For interferences of the kind at issue in the present case, the impossibility for the applicants to (a) access data relating to them that is being processed by an authority entrusted with safeguarding national security, and even to (b) obtain a clear response to their enquiry about whether such processing has taken place, cannot in itself raise concerns under Article 8 of the Convention - since it is the very absence of such information that can ensure the efficacy of that authority's work (see Leander, § 66; Segerstedt-Wiberg and Others, § 102; and Dalea, all cited above; see also, mutatis mutandis, Antunes Rocha, cited above, § 64). This applies even more to information that could make it possible to discover the identities of people who have collaborated with the Agency - since that might not only put their safety at risk but also discourage future collaboration with the Agency.
239. It is not the Court's role to devise comprehensive rules in this sphere. However, since it cannot shirk its responsibility to ascertain whether the interference was "in accordance with the law", it must elucidate the nature and scope of the obligations which this phrase implies in that sphere - thus fulfilling its task under Articles and 19 and 32 § 1 of the Convention to ensure the observance of the engagements undertaken by the Contracting States in it, and to interpret the Convention - in particular, the rights and freedoms set out in its Section I (see Humpert and Others v. Germany [GC], nos. 59433/18 and 3 others, § 69, 14 December 2023).
240. In the present case, which revolved at domestic level around the application of Bulgaria's special data protection regime in the domain of intelligence-gathering for national security purposes, possibly also through covert surveillance, it is appropriate to approach the question of what sort of safeguards can ensure effective protection against arbitrariness and abuse by considering:
(a) the solutions (as they have emerged in EU data protection law, in the treaties resulting from the work of the Council of Europe in that sphere (which Bulgaria has ratified) and in the domestic laws of various Contracting States – see paragraphs 156, 158-159, 162-172, 187-188, 194 in fine, 201 and 205-207 above) devised in data protection law in relation to situations of the kind arising here. Indeed, when assessing data processing under Article 8 of the Convention, the Court often takes into account the principles contained in that law (see L.B. v. Hungary [GC], no. 36345/16, § 123, 9 March 2023, and Ships Waste Oil Collector B.V. and Others, cited above, § 155 in fine); and
(b) the solutions flowing from the Court's own case-law in respect of functionally analogous scenarios, which involve the same sort of considerations as those that arise in the present case - notably that of the bulk interception of communications.
241. In the area of bulk interception of communications, national security considerations can likewise as a matter of course preclude the possibility of notifying the persons concerned that data relating to them has been acquired and is being held. In the light of that, the Court has held that the absence of such notification can be counterbalanced by effective supervision and by a complaints mechanism which does not depend on such notification and permits anyone who suspects that his or her communications have been intercepted to bring proceedings before an authority which: (i) while not necessarily judicial, is independent of the executive; (ii) ensures fair proceedings, offering, in so far as possible, an adversarial process; and (iii) can give reasoned and legally binding decisions with regard to, inter alia, the destruction of unlawfully obtained or stored intercept material (see Centrum för rättvisa, §§ 271-73, and Big Brother Watch and Others, §§ 357-59, both cited above). On that basis, the Court has accepted as satisfactory:
(a) independent supervision authorities which: (i) enjoy access to all relevant material; (ii) are empowered to review the interception, analysis, use and destruction of such material by the intelligence services and to direct that any collected data be destroyed; (iii) can examine the necessity and proportionality of the interference with Convention rights that may be occasioned by the bulk interception of communications; and (iv) regularly exercise those powers in practice (see Centrum för rättvisa, §§ 345-53, and Big Brother Watch and Others, §§ 406-12, both cited above); and
(b) ex-post-facto-review mechanisms which: (i) can be triggered without the persons concerned having to demonstrate that they may have been affected by a bulk interception operation; (ii) are independent, in particular vis-à-vis the intelligence-gathering activities that they are called upon to review; (iii) can obtain and scrutinise all relevant material; (iv) can duly consider whether the relevant operations of the intelligence services comply with the Convention; and (v) can respond to complaints by way of legally binding decisions which can, inter alia, direct that intercept material is to be destroyed and contain publicly available reasons, or at least reasons accessible to special security-cleared counsel (see Centrum för rättvisa, §§ 354-64, and Big Brother Watch and Others, §§ 413-14, both cited above).
242. The above-mentioned solutions, which largely overlap, suggest that whenever it is legitimate and proportionate to curtail or do away with transparency in the processing of data by a public authority because that could frustrate or even defeat the purpose of that processing or another valid interest (as is frequently the case with data processing by the security and intelligence services), the only feasible way to prevent arbitrariness or abuse in relation to that processing - and thus ensure that it is "in accordance with the law" - is to have in place an indirect-access mechanism or a supervision mechanism, or a combination of such mechanisms, capable of making up for the impossibility for the persons concerned to seek redress directly and in full knowledge of the facts. That mechanism must ensure sufficiently robust independent scrutiny of the relevant data processing; its proper functioning depends on the effective investigative, corrective and remedial powers of the independent authority carrying out that scrutiny. More specifically, that authority must: (a) be sufficiently independent; (b) ensure fair proceedings, offering, in so far as possible, an adversarial process; (c) be capable of obtaining and scrutinising all relevant material; (d) be capable of duly considering whether the relevant data processing is Convention-compliant; and (e) be capable of giving reasoned and legally binding decisions with regard to the processing of the relevant data. The mechanism must, of course, also operate effectively in practice.
243. That was also the broad logic underlying the Court's analysis in Leander (cited above, §§ 61-66), Segerstedt-Wiberg and Others (cited above, §§ 102-03) and Dalea (cited above).
(β) Application of those principles
244. The Agency's refusal to disclose whether it had gathered intelligence on Mr Kanev or the Committee - including intelligence obtained by recruiting members or staff of the Committee as informers - was based on the relevant provisions of the 2007 Act and was upheld by the Bulgarian courts (see paragraphs 7, 9-11, 19 and 23-27 above). It can therefore be accepted that the interference was lawful in terms of Bulgarian law.
245. The question remains, then, whether the interference met the other requirements arising from the phrase "in accordance with the law", as outlined in paragraphs 236-243 above - in particular, whether it was surrounded by effective safeguards against arbitrariness and abuse.
246. The assessment of this question necessarily entails a degree of abstraction (see Kruslin v. France, 24 April 1990, §§ 31-32, Series A no. 176‑A, and Huvig v. France, 24 April 1990, §§ 30-31, Series A no. 176‑B). It indeed requires an examination of the entire system put in place by the respondent State - since a shortcoming in one respect might be offset by a safeguard present elsewhere (see I.R. and G.T. v. the United Kingdom, § 60, and Saeed, § 35 in fine, both cited above).
247. The potential safeguards in relation to the processing by the Agency of operational data relating to the applicants are: (a) the proceedings for judicial review of its refusal to disclose whether it was processing such data; (b) possible supervision of data processing by the Agency by the Commission for the Protection of Personal Data; (c) the supervision of some parts of the Agency's work by the National Bureau; (d) the supervision of the Agency's work by a special parliamentary committee and by the Parliament as a whole; and (e) the supervision of the Agency's work by the government and the President of the Republic.
248. The proceedings for judicial review of the Agency's refusal to disclose whether it had gathered intelligence on the applicants, or held information to that effect in its databases - which the applicants brought under section 36(9) of the 2007 Act, following the Agency's decision pursuant their request under section 36(4) (see paragraphs 12 and 67-72 above) - cannot be viewed as an effective safeguard.
249. Firstly, the courts that dealt with those proceedings did not see the material (if there was indeed any) to which the Agency's decision related (contrast Brinks v. the Netherlands (dec.), no. 9940/04, 5 April 2005, and Das Universelle Leben Aller Kulturen Weltweit e.V. v. Germany (dec.), no. 60369/11, § 24, 17 November 2015). On the contrary, they declined to compel the Agency to produce such material - even for their own inspection – on the basis that it was not needed in order to examine the lawfulness of the Agency's decision (see paragraphs 14 (b), 17 and 24 above). That deficiency is all the more significant in a case such as the present one, where the very question in issue was whether the Agency had gathered intelligence on the applicants or was holding information capable of engaging their rights under Article 8.
250. It is true that under section 39a, respectively section 39(3)(3), of the Protection of Classified Information Act 2002, litigants and their lawyers have the right to access classified information relating to a case in which they are involved without undergoing security screening if that is necessary for the defence of their constitutional rights (see paragraphs 114 in fine and 115 above). However, the discussions in the Legal Affairs Committee of the Parliament during the formulation of the final wording of section 39a and the few reported cases relating to the application of sections 39(3)(3) and 39a by the administrative courts suggest that those provisions can only be relied on when the classified information has already been produced by the Agency (see paragraphs 117-121 above). As noted in the previous paragraph, that was not the situation here. Nor is there any indication that arguments based on sections 39(3)(3) and 39a would have enabled the applicants, by indirect procedural means, to secure disclosure of material which the Agency had refused even to confirm existed. It should also be noted in this connection that the Supreme Administrative Court held that since the whole case revolved precisely around the question whether the information sought by the applicants was to be disclosed, it was not appropriate to obtain that result through evidential requests made in the proceedings themselves (see paragraph 24 above).
251. Secondly, the courts that dealt with those proceedings did not examine whether the disclosure of such information could in fact harm or endanger any public interest - in particular, national security. They deferred fully to the Agency's assessment of that point - even though they remained entirely unaware of the specific reasons that had led the Agency to form the view that it could not disclose such information, and indeed of whether any individual assessment had been carried out in the applicants' case (see paragraphs 19 and 25 above). The Supreme Administrative Court adhered to the same position in the proceedings for judicial review of the Agency's second refusal in June 2023, holding that the Agency was under no duty to give any reasons on points of fact (see paragraphs 43 and 47 above). It thus appears that the domestic courts did not undertake any scrutiny capable of testing whether the Agency's refusal to confirm or deny intelligence-gathering with respect to the applicants was justified in the particular circumstances of the case.
252. Thirdly, in so far as the second applicant is concerned, the effectiveness of that avenue was further reduced by the fact that section 36 of the 2007 Act concerns personal data, whereas the Committee is a legal person. Although the Committee could rely on Article 8 in respect of its "correspondence", it does not appear that proceedings under section 36 were capable of affording it equivalent redress in relation to a refusal to disclose whether it had been subjected to intelligence-gathering measures or whether information to that effect was being held by the Agency (compare Ekimdzhiev and Others, cited above, § 354).
‒ Supervision by the Commission for the Protection of Personal Data
253. Nor does it appear that an effective safeguard could be afforded by Bulgaria's main data protection supervisory authority - the Commission for the Protection of Personal Data.
254. Supervisory bodies of that sort can furnish an effective safeguard with respect to data processing by the authorities for law-enforcement and intelligence purposes (see Breyer v. Germany, no. 50001/12, §§ 105 and 107, 30 January 2020, and Ringler v. Austria (dec.) [Committee], no. 2309/10, §§ 72-79, 15 May 2020). But they can only do so if they can directly access those data and any related information, so as to be able to check whether they are being processed in a manner that is consistent with the relevant data protection principles. In a recent case against Hungary, an investigation by such a supervisory body in which it could not access directly data processed by the national security services was not considered to be an effective safeguard because the absence of direct access had prevented proper scrutiny by it (see Hüttl v. Hungary [Committee], no. 58032/16, §§ 15-18, 29 September 2022).
255. In Bulgaria, the role of that Commission with respect to data processing by the Agency for operational purposes does not appear to be clearly defined. It is true that section 37 of the 2007 Act, as originally enacted, empowers that Commission to supervise the processing of personal data by the Agency in the manner provided by the 2002 Act (see paragraph 77 above). At the same time, section 1(5) of the 2002 Act itself (as amended in March 2019) states that that Act does not apply to the processing of personal data for national security purposes unless that is expressly prescribed elsewhere - the stated rationale being that the elaborate data protection regime instituted by EU law, especially since the adoption of the GDPR and the LED, and reflected in the 2002 Act, does not cover the processing of personal data for activities relating to the protection of national security (see paragraph 88 above). It is therefore unclear whether section 37 of the 2007 Act can be read to mean that the 2002 Act's strictures apply to the processing of such data by the Agency for operational purposes (or that the 2002 Act applies only to data processing by the Agency for other purposes - such as staff administration and public procurement), and that that Commission can exercise the investigatory and remedial powers that it has under the 2002 Act with respect to data obtained by the Agency in the course of its operations.
256. Nor is there any indication that - apart perhaps from a 2009 audit of the Agency in connection with preparations for the future implementation of the Schengen Information System - that Commission has ever checked how the Agency processes operational data, and in particular, whether it duly follows the statutory rules and the regulations which govern that matter (see paragraphs 62-65 and 102 above; also compare Ekimdzhiev and Others, cited above, §§ 346 and 412; also contrast, mutatis mutandis, Centrum för rättvisa, § 351, and Big Brother Watch and Others, §§ 409-10, both cited above). On the contrary, the (apparently) only case in which that Commission was invited to look into the matter in question indicates that it was of the view that data resulting from surveillance carried out by the Agency did not amount to personal data, and that such operations by the Agency were not for it to supervise (see paragraph 90 above).
257. A further limitation flows from the fact that the Commission for the Protection of Personal Data may scrutinise only the processing of data relating to individuals - not data relating to legal persons such as the Committee (see paragraph 87 above; also compare Ekimdzhiev and Others, cited above, § 331).
‒ Supervision by the National Bureau
258. The first thing which should be noted about the National Bureau is that it may supervise only the use of "special means of surveillance" - not all sorts of intelligence gathering and related data processing by the Agency (see paragraph 82 (d) above). That limit on the Bureau's role was illustrated by the facts of the present case, in which the Agency responded itself to the part of Mr Kanev's request relating generally to intelligence-gathering methods or techniques, and referred him to the Bureau only so far as his request concerned "special means of surveillance" (see paragraphs 6-11 above). Supervision by the Bureau is therefore not a safeguard with respect to the overall manner in which the Agency processes operational data. Nor is the Bureau required to check whether "special means of surveillance" have been used with respect to legal persons such as the Committee (see Ekimdzhiev and Others, cited above, § 349).
259. Moreover, the Bureau's effectiveness - even in relation to the processing of data about individuals obtained as a result of the use of "special means of surveillance" - is undermined by several shortcomings already identified in Ekimdzhiev and Others (cited above, §§ 339-44) that have apparently not been rectified since that judgment became final in April 2022 (see paragraph 208 above):
(a) the absence of a guarantee that all Bureau members are sufficiently independent vis-à-vis the authorities that they must supervise - in particular, the Agency (ibid., §§ 339-41);
(b) misgivings about the qualifications of some Bureau members (ibid., § 342);
(c) the Bureau's inability to secure unfettered access to all relevant material held by, in particular, the Agency (ibid., § 343); and
(d) the Bureau's lack of any power to order remedial measures, such as the destruction of surveillance material (ibid., § 344).
260. Indeed, it seems that all the Bureau did in the present case by way of investigation was to write to the Agency to enquire whether it had deployed "special means of surveillance" in relation to Mr Kanev and then review the Agency's reply (see paragraph 31 above; also contrast Big Brother Watch and Others, cited above, §§ 408 and 410).
‒ Supervision by a special parliamentary committee and the Parliament as a whole
261. The special parliamentary committee tasked with supervising the Agency's work - the same committee that was in issue in Ekimdzhiev and Others (cited above, § 125) - is empowered to deal with individual cases, but it cannot order remedial measures; if it detects irregularities, it can only bring them to the attention of the prosecuting or other relevant authorities (see paragraph 78 above). Moreover, that committee's members are not required to have any legal qualifications or experience (see Ekimdzhiev and Others, cited above, § 414). Nor does it seem that it has in practice exercised detailed and regular control over the Agency's data processing operations or involved itself in the Agency's day-to-day work (compare Ekimdzhiev and Others, cited above, § 345, and, mutatis mutandis, Szabó and Vissy v. Hungary, no. 37138/14, § 82, 12 January 2016; also contrast Leander, cited above, §§ 40 and 65).
262. There is no indication that the Agency's head, deputy heads or officers have ever been called to the Bulgarian Parliament to report specifically on whether the Agency has acted lawfully when processing data obtained as a result of its operations (see paragraph 79 above). In any event, such general parliamentary supervision can hardly be viewed as sufficient to prevent individual abuses.
‒ Supervision by the government and the President of the Republic
263. There is no indication that the Agency has discussed specifically (in reports to the government or the President of the Republic) the way in which it processes data obtained as a result of its operations (see paragraphs 80-81 above). In any event, such general political oversight can hardly be considered independent (see, mutatis mutandis, Association for European Integration and Human Rights and Ekimdzhiev, § 87, and Szabó and Vissy, § 75, both cited above), or sufficient to prevent individual abuses.
264. The above analysis leads to the conclusion that the applicants did not enjoy the minimum degree of protection against arbitrary and unlawful processing by the Agency of data about them. The interference with their rights under Article 8 of the Convention was therefore not in accordance with a "law" meeting the requirements of the second paragraph of that Article.
(ii) Purpose and necessity of the interference
265. In the light of the above conclusion, it is not necessary to rule on the question of whether the interference pursued a legitimate aim and was "necessary in a democratic society" to attain that aim (see Kopp, § 76; Amann, §§ 63 and 81; Rotaru, § 62; Antunes Rocha, § 79; and Zoltán Varga, § 172, all cited above).
266. It follows that there has been a breach of Article 8 of the Convention.
II. ALLEGED PROCESSING OF DATA ABOUT THE APPLICANTS' POLITICAL OPINIONS, AFFILIATIONS AND ACTIVITIES
267. The applicants complained that the Agency had unjustifiably collected data on their political opinions, affiliations and activities. They relied on Articles 10 and 11 of the Convention, which read, so far as relevant:
Article 10 (freedom of expression)
"1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. ...
2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary."
Article 11 (freedom of assembly and association)
"1. Everyone has the right to freedom of peaceful assembly and to freedom of association with others ...
2. No restrictions shall be placed on the exercise of these rights other than such as are prescribed by law and are necessary in a democratic society in the interests of national security or public safety, for the prevention of disorder or crime, for the protection of health or morals or for the protection of the rights and freedoms of others. ..."
268. The Government contended that the Agency had collected no data on the political opinions, affiliations or activities of the applicants. It was, moreover, unclear how that could, in any event, have affected their exercising their rights under Articles 10 or 11 of the Convention. There had, then, been no interference with those rights. In the alternative, they argued that any such interference had been lawful and justified, since the Agency's decision to withhold information on the point had been based on clear and accessible rules that were meant to safeguard national security, and proportionate - in particular, in view of its minimal or even non-existent impact on the applicants.
269. The applicants conceded that they could not know for certain whether the Agency had gathered and was holding intelligence on them. They had, however, a strong suspicion that this was so, and in their view any such data would inevitably relate to their political opinions, affiliations and activities. The Agency's refusal to disclose whether this was so had therefore also amounted to interference with their rights under Articles 10 and 11 of the Convention. That interference had been unlawful and unjustified for the same reasons as the interference with their Article 8 rights.
270. The Court has had occasion to hold that the storage of data relating to political opinions, affiliations and activities which is unjustified under Article 8 § 2 of the Convention inevitably also constitutes an unjustified interference with the rights protected under Articles 10 and 11 of the Convention (see Segerstedt-Wiberg and Others, cited above, § 107). It has also held that data revealing political opinions - such as information about participation in peaceful protests - attract a heightened level of protection (see Catt v. the United Kingdom, no. 43514/15, §§ 112 and 123, 24 January 2019, and Glukhin v. Russia, no. 11519/20, § 76, 4 July 2023).
271. In this case, however, it remains unknown what data about the applicants, if any, have been collected by the Agency. It is therefore a matter of speculation whether any such data relate to their political opinions, affiliations or activities (contrast Segerstedt-Wiberg and Others, § 107, and Catt, §§ 122-23, both cited above). Since the availability of effective safeguards in relation to the processing of those data was examined comprehensively under Article 8 § 2 (see paragraphs 248-264 above), there is no need to do so also from the perspective of Articles 10 and 11. Indeed, the parties advanced no arguments in respect of that issue in addition to those that they advanced under Article 8 § 2 (see paragraphs 268-269 above).
272. The admissibility and merits of this complaint do not therefore require separate examination.
III. ALLEGED BREACH OF THE RIGHT TO RECEIVE INFORMATION
273. The applicants complained that the Agency had unjustifiably withheld the information sought by them. They again relied on Article 10 of the Convention, the relevant part of which has been set out in paragraph 267 above.
274. The Government submitted that that this complaint was likewise incompatible ratione materiae with the provisions of the Convention, since it was unclear how the information sought by the applicants - which touched on the Agency's methods and the identities of its informers - could relate to the exercise of their right to freedom of expression under Article 10 of the Convention.
275. The Government went on to argue that there had been no interference with the applicants' right to receive information. Firstly, they had not spelled out the purpose of their request to the Agency, and the information sought by them had been far from instrumental in respect of their freedom of expression – assuming their idea had been to provoke a public debate on access to data obtained through covert surveillance. Secondly, the information they had sought had concerned the Agency's methods rather than data about them. The authorities had correctly assessed that that information was to be withheld because its disclosure could harm national security. That disclosure would not have been in the public interest - irrespective of the applicants' role as public watchdogs.
276. In the alternative, the Government argued that any such interference had been lawful and undertaken in pursuit of a legitimate aim, for the same reasons as the alleged interference with the applicants' Article 8 rights (see paragraph 235 above). The interference had also been proportionate, since it had been justifiable for the kind of information being sought by the applicants to remain secret. Mr Kanev had been told by the National Bureau that no "special means of surveillance" had been used against him, and no such means could have been used with respect to the Committee.
277. The applicants replied that the Government was mischaracterising the nature of the information that they had sought.
278. According to them, the Agency's refusal to disclose that information had interfered with their right to receive information. The disclosure of that information - which had not concerned the Agency's methods as such - would have ensured transparency on a matter of interest to society as a whole, and would have enhanced trust in the security services following revelations of abuse by an official well familiar with their work. The applicants' role as public watchdogs was also of importance. The purpose of their request to the Agency had been self-evident and sufficiently clear from the request itself. They had later explained in detail the background to the request in their submissions in the judicial review proceedings.
279. The applicants went on to argue that the Agency's refusal to disclose the information had not been "necessary in a democratic society". The 2007 Act did not contain effective safeguards against misuse of the Agency's broad powers and data processing capabilities. The suspicion that "special means of surveillance" were being misused was widespread in Bulgaria and could not be allayed by the existing notification mechanism.
280. The Agency's refusal to disclose whether it had gathered intelligence on the applicants was reviewed in detail under Article 8 of the Convention (see paragraphs 212-219, 232-233 and 236-266 above). There is, then, no need to examine the admissibility or merits of their related complaint under Article 10 of the Convention, which - as can be seen from the way in which it was formulated and from the applicants' submissions in relation to it (see paragraphs 273 and 279 above) - amounts to a restatement of the complaint under Article 8 of the Convention, and gives rise to no separate issue over and above that arising under Article 8 of the Convention (see, mutatis mutandis, Silver and Others v. the United Kingdom, 25 March 1983, § 107, Series A no. 61, and Big Brother Watch and Others, cited above, § 516).
IV. ALLEGED VIOLATION OF ARTICLE 13 OF THE CONVENTION
281. The applicants also complained that they had not had an effective remedy in respect of the impossibility of obtaining from the Agency information about whether it was processing data relating to them. They relied on Article 13 of the Convention, which reads:
"Everyone whose rights and freedoms as set forth in [the] Convention are violated shall have an effective remedy before a national authority notwithstanding that the violation has been committed by persons acting in an official capacity."
282. The Government pointed out that the applicants had been able to seek judicial review of the Agency's refusal to disclose the information that they had sought. However, as had transpired during those proceedings, that information had not amounted to personal data, which had meant that they had to rectify their request to the Agency. They had failed to do so, instead simply reiterating the request two years later - apparently well aware that it would be met with the same response. It was still open to them to reformulate their request. The fact that the judicial review proceedings had not yielded the outcome sought by them did not mean that such proceedings did not constitute an effective remedy.
283. The applicants submitted that the three sets of judicial review proceedings that they had brought had not furnished them with an effective remedy in respect of the Agency's refusal to disclose the information sought by them - mainly because the courts had not required the Agency to articulate the national security risks that could result from such disclosure. The only judgment compelling the Agency to provide such justification had been the one given by the Sofia City Administrative Court in early 2024, but it had been varied on that point by the Supreme Administrative Court on the basis of the rule set out in section 36(8) of the 2007 Act that the Agency had no obligation to give reasons concerning points of fact when refusing requests for access to personal data (see paragraphs 43, 47 and 71 above).
284. The question of whether the proceedings for judicial review in respect of the Agency's refusal to disclose whether it had processed data relating to the applicants could furnish an effective safeguard against an arbitrary or disproportionate decision by the Agency on that point was reviewed in detail under Article 8 § 2 of the Convention (see paragraphs 248-252 above). The content of the applicants' submissions in relation to Article 13 of the Convention (see paragraph 283 above) demonstrates that they raised no further issue in relation to those proceedings.
285. There is, then, no need to examine the admissibility or merits of their complaint under Article 13 of the Convention (see, mutatis mutandis, Yonchev v. Bulgaria, no. 12504/09, §§ 32-33, 7 December 2017; Negru v. the Republic of Moldova, no. 7336/11, § 37, 27 June 2023; and Kaczmarek, cited above, § 101).
V. APPLICATION OF ARTICLE 41 OF THE CONVENTION
286. Article 41 of the Convention reads:
"If the Court finds that there has been a violation of the Convention or the Protocols thereto, and if the internal law of the High Contracting Party concerned allows only partial reparation to be made, the Court shall, if necessary, afford just satisfaction to the injured party."
1. The applicants' claim and the Government's comments on it
287. The two applicants claimed 1,000 euros (EUR) each in respect of the non-pecuniary damage that they had allegedly suffered as a result of the breaches alleged in the present case.
288. The Government contested the claim, pointing out that the applicants had not asserted that they had suffered any adverse consequences as a result of the alleged breaches. In their view, a finding of a violation would amount to sufficient just satisfaction in respect of any breach found in the present case.
289. As attested by the adjective "just" and the phrase "if necessary" in Article 41 of the Convention, the Court enjoys discretion in the exercise of the power to afford such satisfaction to the injured party (see, as a recent authority, Molla Sali v. Greece (just satisfaction) [GC], no. 20452/14, § 32, 18 June 2020). In some cases, the public vindication of the wrong suffered by that party, in a judgment binding on the respondent State, can in itself amount to sufficient redress. This is especially so when, as here, (a) the finding of breach is based solely on the conclusion that a law, procedure or practice has fallen short of Convention standards (ibid., § 33, with reference to Varnava and Others v. Turkey [GC], nos. 16064/90 and 8 others, § 224, ECHR 2009), without a further finding that this shortcoming has affected the applicants in any tangible way, and (b) general measures would constitute the most appropriate form of redress (see paragraph 4 of the Practice Direction on Just Satisfaction Claims, as amended in June 2022).
290. In the present case, no evidence has been produced to show that the refusal to inform the applicants of whether the Agency was processing data relating to them has caused them any tangible detriment. The applicants did not even specify the nature of the non-pecuniary damage that they had allegedly suffered on that account; since the first applicant is an individual and the second applicant a legal person, the nature of any such damage caused to them is, respectively, likely to be different. Even if it is accepted that they have both suffered some non-pecuniary damage on account of the absence of effective safeguards in relation to the potential processing by the Agency of data relating to their "private life" and "correspondence", the finding of a breach of Article 8 of the Convention provides them sufficient just satisfaction in that regard (see, mutatis mutandis, Amann, cited above, § 94). It is, then, not necessary to award them any monetary compensation in respect of that.
291. It must at the same time be emphasised that under Article 46 of the Convention a judgment in which the Court finds a violation of the Convention or its Protocols imposes on the respondent State an obligation to choose (subject to supervision by the Committee of Ministers) the general and/or, if appropriate, individual measures to be taken in its domestic legal order to end the violation and make all feasible reparation for its consequences in a way to restore as far as possible the situation that would have obtained if the violation had not taken place. Moreover, it follows from the Convention, and from its Article 1 in particular, that in ratifying it the Contracting States undertook to ensure that their domestic laws would be compatible with it (see Ekimdzhiev and Others, cited above, § 427).
1. The applicants' claim and the Government's comments on it
(a) The claim and the documents produced in support of it
292. The Committee sought reimbursement of a total of EUR 7,161.80 in respect of costs and expenses. It broke down its claim as follows:
(a) EUR 31.72 in respect of postage;
(b) EUR 230.08 in respect of court fees and costs paid to the Agency in the proceedings for judicial review of its first refusal to disclose the information sought by Mr Kanev (see paragraphs 12-27 above) and in the proceedings for judicial review of the Agency's official-secrets rule (see paragraphs 32-39 above); and
(c) EUR 6,900 in respect of fees for a total of sixty-nine hours of legal work on the case, at the hourly rate of EUR 100.
293. In support of its claim, the Committee produced:
(b) (i) two bank orders for the payment of a total of 140 Bulgarian levs (BGN - equivalent to EUR 71.58) in court fees for the proceedings for judicial review of the Agency's first refusal to disclose information (BGN 70 paid in respect of Mr Kanev and BGN 70 paid in respect of the Committee itself); (ii) three bank orders for the payment of a total of BGN 110 (equivalent to EUR 56.24) in court fees for the proceedings for judicial review of the Agency's official-secrets rule; and (iii) one bank order for the payment of BGN 200 (equivalent to EUR 102.26) to the Agency in respect of its own costs in the former proceedings;
(c) a time sheet for the work of its lawyer, Ms A. Kachaunova, on the proceedings for judicial review of the Agency's first refusal to disclose the information sought by Mr Kanev, the proceedings for judicial review of the Agency's official-secrets rule, and the proceedings before the Court; and
(d) a contract for legal services between Mr Kanev as a client and the Committee as a provider, in relation to the case before the Court.
294. The Government pointed out that there was no indication that two of the shipments in respect of which the Committee was claiming postage had concerned the present case. Furthermore, two of the five bank payment orders produced by the Committee were identical; one of them was therefore to be discounted, which meant that the proven amount of the sums paid in court fees and costs in the domestic proceedings was reduced the equivalent of EUR 194.29. Lastly, the legal services contract - which was between Mr Kanev and the Committee - concerned only Mr Kanev's representation before the Court. Nor did that contract duly define the hourly rate for the legal services under it, or prove that Ms A. Kachaunova had been retained to represent the applicants domestically or before the Court. There was, moreover, no evidence that they had paid her any sums in respect of such work. She was not an employee of the Committee but a practicing lawyer, and was therefore only entitled to professional fees for her services, in accordance the provisions of the Bar Act 2004.
295. It is settled that (a) applicants are entitled to the reimbursement of costs and expenses only if they were actually and necessarily incurred and are reasonable as to quantum, and that (b) costs or expenses incurred to prevent the breach of the Convention or obtain redress for it through the domestic legal order are also recoverable under Article 41 of the Convention (see, among many other authorities, Myumyun v. Bulgaria, no. 67258/13, § 85, 3 November 2015; see also paragraphs 15 and 18-19 of the Practice Direction on Just Satisfaction Claims (as amended in June 2022).
296. The claim in respect of postage (see paragraphs 292 (a) and 293 (a) above) is to be allowed in full. The documents in the case file - and in particular, the correspondence sent to the Court by the applicants - show that all three postal shipments in respect of which the Committee claimed postage related to the present case. That postage, which came in total to BGN 62.04 (equivalent to EUR 31.72) is therefore to be awarded to the Committee in full.
297. The claim in respect of the court fees and costs paid in the proceedings for judicial review of the Agency's first refusal to disclose information - which came to BGN 340 (equivalent to EUR 173.84) (see paragraphs 292 (b) and 293 (b)(i) and (iii) above) - is to be allowed in full too. Those proceedings were an attempt by the applicants to - depending on how the matter is seen - prevent or obtain redress for the breach of Article 8 of the Convention. Contrary to what the Government contended, there is no duplication in two of the five bank payment orders produced by the Committee: one concerned a fee paid in respect of Mr Kanev and the other a fee paid in respect of the Committee itself (see paragraph 293 (b)(i) above); they were both claimants in those proceedings (see paragraph 12 above).
298. The claim in respect of the court fees paid in the proceedings for judicial review of the Agency's official-secrets rule (see paragraphs 292 (b) and 293 (b)(ii) above) must, by contrast, be dismissed. As noted in paragraph 223 above, the outcome of those proceedings did not affect the present case. Moreover, the claimant in those proceedings was solely Mr Kanev (see paragraph 32 above), whereas the claim for costs and expenses under examination was made solely on behalf of the Committee (see paragraph 292 above).
299. The claim in respect of lawyers' fees (see paragraph 292 (c) above) must be dismissed as well. The Committee has produced no evidence that it has paid or is under a legal obligation to pay such fees to the lawyer who represented it domestically and before the Court, Ms Kachaunova - whether in its capacity as applicant or in its capacity as provider of legal services to Mr Kanev, in accordance with the contract between them (see paragraph 293 (d) above). The time sheet drawn up by Ms Kachaunova recording how many hours she has spent in work on the case does not in itself constitute proof of that. There is, then, no basis on which to accept that the lawyers' fees claimed by the Committee have been actually incurred by it (see Merabishvili v. Georgia [GC], no. 72508/13, § 372, 28 November 2017). Ms Kachaunova cannot seek just satisfaction on her own behalf, since a representative is not an "injured party" within the meaning of Article 41 of the Convention (see Korporativna Targovska Banka AD v. Bulgaria, nos. 46564/15 and 68140/16, § 223, 30 August 2022, with further references).
300. For all of the above reasons, the Committee is to be awarded a total of EUR 205.56, plus any tax that may be chargeable to it.
1. Declares, by a majority, the complaint under Article 8 of the Convention admissible;
2. Holds, by five votes to two, that there has been a violation of Article 8 of the Convention;
3. Holds, unanimously, that there is no need to examine the admissibility or merits of the complaints (a) under Articles 10 and 11 of the Convention that the Agency had collected data about the applicants' political opinions, affiliations and activities, (b) under Article 10 of the Convention that the Agency refused to give information to the applicants, and (c) under Article 13 of the Convention;
4. Holds, by five votes to two, that the finding of a violation of Article 8 of the Convention amounts to sufficient just satisfaction in respect of any non-pecuniary damage suffered by the applicants;
5. Holds, by five votes to two,
(a) that the respondent State is to pay the Bulgarian Helsinki Committee, within three months from the date on which this judgment becomes final, in accordance with Article 44 § 2 of the Convention, EUR 205.56 (two hundred and five euros and fifty-six cents) in respect of costs and expenses;
(b) that from the expiry of those three months until settlement simple interest shall be payable on the above amount at a rate equal to the marginal lending rate of the European Central Bank during the default period, plus three percentage points;
6. Dismisses, unanimously, the remainder of the claim for just satisfaction.
Done in English, and notified in writing on 28 April 2026, pursuant to Rule 77 §§ 2 and 3 of the Rules of Court.
Milan Blaško Ioannis Ktistakis
Registrar President
In accordance with Article 45 § 2 of the Convention and Rule 74 § 2 of the Rules of Court, the separate opinion of judges Pavli and Ní Raifeartaigh is annexed to this judgment.
JOINT DISSENTING OPINION OF
JUDGES PAVLI AND NÍ RAIFEARTAIGH
1. We have voted against the admissibility of the present applications, which we consider to be either manifestly ill-founded (in the case of Mr Kanev) or otherwise inadmissible (in the case of the Bulgarian Helsinki Committee – "BHC"). The information request which falls within the scope of the present case was the amended request filed on behalf of the applicants with Bulgaria's State Agency for National Security ("the Agency") at the end of June 2021 (see paragraph 8 of the judgment). Our main disagreement with the majority is that we do not consider this request to have been properly and clearly formulated as a request for access to personal data held by the Agency; on the contrary, it was phrased as a request for information about the use of intelligence methods. In our view, this has significant implications for the admissibility of the applications.
2. By way of context, we wish to point out, at the most general level, that data protection legal regimes and the laws governing the oversight of intelligence agencies have rather different origins and purposes. As the comparative surveys cited in the judgment itself make clear, intelligence operations tend not to be subject to data protection laws, at either national or supranational level, and data protection authorities have little or no oversight over them (see, especially, paragraphs 205-207 of the judgment). In so far as some data protection regimes do apply to intelligence services, this tends to be in relation to the personal data of their own personnel, rather than to third-party data collected through core intelligence functions. However, the safeguards related to surveillance or use of covert sources by security services tend to be sui generis, and have typically developed in ad hoc and incremental ways, reflecting the history, political system, institutional arrangements and other traits specific to each democracy. They come in many different shapes and colours. The Court has a well-developed case-law in this regard and has allowed the States a wide margin in terms of how they structure such safeguards in the national security and surveillance context, provided they meet the minimum standards developed under Article 8 of the Convention (see the case-law cited in paragraphs 241 and 243 of the judgment). Furthermore, these standards have themselves been developed by the Court with careful consideration for the special features of national security regimes. It may be noted that this case-law primarily locates remedies in respect of potential State abuse of intelligence methods in general measures such as clear legislation, independent supervision and other checks and balances in the system as a whole; there is not, for obvious reasons, any general individual right to know whether one has been the subject of a particular intelligence operation.
3. The domestic legal framework in the present case reflected this distinction both in terms of which bodies were entrusted with functions relating to personal data protection and intelligence oversight respectively, and the legal regimes governing those bodies. We consider that the manner in which the first applicant formulated the request which is the subject of the present case created confusion as to what he was actually seeking and renders his case inadmissible, for the following reasons.
The second applicant's request
4. Turning first to the request filed by the first applicant on behalf of the BHC, we note that the amended request to the Agency - in contrast to the original request filed earlier the same month (see paragraph 6 of the judgment) – did not include any references to the use of "special means of surveillance", which relate essentially to covert interception of communications. (The first applicant's separate request to this effect filed with the National Bureau for the Oversight of Special Means of Surveillance – see paragraph 28 of the judgment - falls outside the scope of the present case.) As a legal entity, the BHC cannot claim an Article 8 interference with its "personal data", but only its correspondence. As the amended request filed with the Agency in late June 2021 made no specific reference to the interception of its communications - and there being no actual indications before us that there might in fact have been such interceptions - we do not consider that the BHC can claim to be a victim of an interference with its Article 8 rights under the circumstances. The fact that legal entities are not entitled under national law to use the complaint procedure before the National Bureau does not change this conclusion. Nor do we consider that the mere theoretical possibility that BHC members might have been (lawfully) recruited as Agency informers under national law is sufficient to grant it victim status in the circumstances.
The first applicant's request
5. Turning now to Mr Kanev's request on his own behalf, we consider it important to highlight the precise terms of his information request. He asked whether the Agency's databases contained information on
(a) "any intelligence-gathering methods [that] had been used with respect to him" (see paragraph 8 of the judgment); or
(b) any BHC members who had been recruited as Agency informers.
6. Three points may be made about this request. First, it did not directly ask whether the Agency held personal data in respect of the applicant. Instead, it asked about the use of intelligence-gathering methods and the recruitment of informers (albeit in respect of him/the BHC and not those in use by the Agency in general). Secondly, such intelligence-gathering methods are among the most sensitive aspects of any intelligence operations; as such, they tend to be granted the highest level of protection in classified information systems, for legitimate reasons. The same applies to the use of covert informers, for the protection of their safety and operating methods. Thirdly, the applicant's request made no reference to any possible illegality in the gathering of intelligence. The statements made by the Minister of Internal Affairs concerned possible abuses through the mass interception of communications (see paragraph 5 of the judgment), and we accept that this might have raised justified concerns among national civil society about potentially abusive deployment of other methods and techniques. Such concerns were not, however, spelled out in the request, and the Court must pay attention to the specific request actually made by the applicants which became the subject of analysis in the domestic judicial review proceedings.
7. Despite the absence of any explicit request as to whether the Agency held data in respect of the first applicant, the majority take the view that the request should nonetheless be treated, in substance or implicitly, as a personal data request. They do so on two grounds, both of which we view as problematic. The first ground is that they consider that the initial confirmation by the Agency might have "constitute[d] a necessary preliminary step for the exercise of any further rights or remedies" (see paragraph 217 of the judgment). In other words, they consider that the request actually made can be interpreted as a data request because it might have been a precursor to a data request. We are unable to share this conclusion and consider it unduly generous to the applicant. While it may be acceptable or understandable in the regular data protection context to simply ask for such confirmations as a first step in the procedure, this is not so straightforward in the national security environment (a point to which we return below). If the applicant wished to find out if the Agency held data in respect of him, there was no reason he could not have asked that question in plain terms. It not only was unclear but also brought him straight into the highly sensitive territory of secret methods and techniques.
8. The second ground offered by the majority for treating his request as a data request is the assumption that, if actually used, any intelligence-gathering methods would necessarily have resulted in the creation of Agency records containing personal data about the first applicant (see paragraphs 213-214 of the judgment). While this is possible, it is not necessarily or logically so. It is possible for a person to be subjected to surveillance measures without this resulting in any written records or other personal data being stored by an intelligence agency; this would be the case, for example, where human agents conduct surveillance of a group of people in a public place (say, at a protest), but without this resulting in the creation of any individualised records containing personal data. Again, we are unable to understand why the first applicant did not simply formulate the request as one concerning data held about him, if that is what he wanted to know.
9. The national Supreme Administrative Court held that the request did not properly seek access to any personal data held by the Agency, but had in effect concerned its intelligence-gathering methods (see paragraph 25 of the judgment). We cannot fault the national courts for not being as generous as the Chamber majority in "reinterpreting" the applicant's request as a data protection request.
10. We return to the point that the applicant's request did not contain any reference to unlawful use of surveillance techniques. We consider this to be a significant omission, because concerns or suspicions about being placed under unlawful surveillance clearly strengthen an applicant's Article 8 claims to be informed of the nature and scope of such illegality. Conversely, there is no unconditional Article 8 right to be informed of the fact of surveillance per se, in the absence of any confirmed illegality. If surveillance is found to have been carried out lawfully, following a process that meets the Convention criteria for ex post facto review, the Court has accepted that the person may simply be informed that there has been no illegal surveillance, on a "neither confirm, nor deny" basis (see Kennedy v. the United Kingdom, no. 26839/05, §§ 95 and 167, 18 May 2010). (This is, incidentally, the same kind of response that the applicant received from the Oversight Bureau in the present case.)
11. The applicants have therefore invited the Court to find flaws in the overall domestic system of safeguards concerning intelligence methods in circumstances where the domestic litigation centred around a request which (i) was made to an intelligence agency not governed primarily by data protection law; (ii) at best, was ambiguous as to what information it was seeking, and at worst, simply asked for information about the use of intelligence methods; and (iii) did not differentiate between lawful and unlawful intelligence gathering despite this factor having significant implications in terms of Article 8 protection.
12. In view of the above considerations about the flawed nature of the first applicant's amended request to the Agency, we consider that, even assuming that there has been an interference with his Article 8 rights - which is debatable –, the claim of a violation of that provision is manifestly ill-founded in the circumstances.
13. That being the case, it is not necessary for us to delve into the merits, but we do wish to make the observation that, having regard to the distinction between data protection regimes and legal frameworks governing State intelligence functions (as described in paragraph 2 above), we have concerns that the judgment blurs the line between the two situations and unnecessarily reinvents the Court's methodological wheel for dealing with intelligence oversight. The existing case-law of the Court with regard to safeguards against abuse of intelligence methods is already adequate and there is no need to engage in an extensive analysis, for example, of EU data protection law. Furthermore, the efforts to infuse ordinary data protection approaches into this area of Article 8 case-law are bound to create confusion and uncertainty.
[1] Those also sometimes described as "simulated purchases" or "test purchases".
[2] The processing of personal data for law-enforcement purposes by the courts and by the prosecuting and investigating authorities (which by Article 117 § 2 of the 1991 Constitution of Bulgaria are also part of the judicial branch) is supervised by the Supreme Judicial Council's Inspectorate (section 78(2) of the 2002 Act).
[3] See footnote 2 above.
[4] Article 94(1) of the GDPR repealed Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31 - "Data Protection Directive") with effect from 25 May 2018.
[5] That working party had been set up under Article 29 of the 1995 Data Protection Directive (repealed with effect from 25 May 2018 - see footnote 4 above), and was replaced by the European Data Protection Board established by Article 68 § 1 of the GDPR.
BAILII: