¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
The CJEU also examined a question by the Court of Appeal (England & Wales) (Civil Division) as to whether, in the Digital Rights judgment, the Court had interpreted Article 7 or 8 of the Charter in such a way as to expand the scope conferred on Article 8 of the Convention by the European Court of Human Rights. The CJEU stated:
BAILII:
"127. As a preliminary point, it should be recalled that, whilst, as Article 6(3) [of the Treaty on European Union] confirms, fundamental rights recognised by the [Convention] constitute general principles of EU law, the [Convention] does not constitute, as long as the European Union has not acceded to it, a legal instrument which has been formally incorporated into EU law ... .
128. Accordingly, the interpretation of Directive 2002/58, which is at issue in this case, must be undertaken solely in the light of the fundamental rights guaranteed by the Charter ... .
129. Further, it must be borne in mind that the explanation on Article 52 of the Charter indicates that paragraph 3 of that article is intended to ensure the necessary consistency between the Charter and the [Convention], 'without thereby adversely affecting the autonomy of Union law and ... that of the Court of Justice of the European Union' (judgment of 15 February 2016, N., C-601/15 PPU, EU:C:2016:84, paragraph 47). In particular, as expressly stated in the second sentence of Article 52(3) of the Charter, the first sentence of Article 52(3) does not preclude Union law from providing protection that is more extensive then the [Convention]. It should be added, finally, that Article 8 of the Charter concerns a fundamental right which is distinct from that enshrined in Article 7 of the Charter and which has no equivalent in the [Convention].
130. However, in accordance with the Court's settled case-law, the justification for making a request for a preliminary ruling is not for advisory opinions to be delivered on general or hypothetical questions, but rather that it is necessary for the effective resolution of a dispute concerning EU law ... .
131. In this case, in view of the considerations set out, in particular, in paragraphs 128 and 129 of the present judgment, the question whether the protection conferred by Articles 7 and 8 of the Charter is wider than that guaranteed in Article 8 of the ECHR is not such as to affect the interpretation of Directive 2002/58, read in the light of the Charter, which is the matter in dispute in the proceedings in Case C-698/15.
132. Accordingly, it does not appear that an answer to the second question in Case C-698/15 can provide any interpretation of points of EU law that is required for the resolution, in the light of that law, of that dispute.
133. It follows that the second question in Case C-�698/15 is inadmissible."
The CJEU ruled as follows:"1. Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter of Fundamental Rights of the European Union, must be interpreted as precluding national legislation which, for the purpose of fighting crime, provides for general and indiscriminate retention of all traffic and location data of all subscribers and registered users relating to all means of electronic communication.
2. Article 15(1) of Directive 2002/58, as amended by Directive 2009/136, read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter of Fundamental Rights, must be interpreted as precluding national legislation governing the protection and security of traffic and location data and, in particular, access of the competent national authorities to the retained data, where the objective pursued by that access, in the context of fighting crime, is not restricted solely to fighting serious crime, where access is not subject to prior review by a court or an independent administrative authority, and where there is no requirement that the data concerned should be retained within the European Union.
3. The second question referred by the Court of Appeal (England & Wales) (Civil Division) is inadmissible."
4. The General Data Protection Regulation
81. On 25 May 2018 the General Data Protection Regulation (Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC) entered into force. Like the Directive it replaced, the Regulation does not apply to State activities concerning public safety, defence and State security (Article 2(2)).THE LAW
I. ALLEGED VIOLATION OF ARTICLE 8 OF THE CONVENTION
82. The applicant complained that that Swedish state practice and legislation concerning signals intelligence had violated and continued to violate its right to respect for private life and correspondence. The complaint concerned three time periods: from 2002 to 1 January 2009, from 1 January 2009 to 1 December 2009 and from 1 December 2009 onwards. The applicant invoked Article 8 of the Convention, which reads as follows:"1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."
A. Admissibility
83. The Government questioned whether the applicant had exhausted all domestic remedies available and left it for the Court to determine the exhaustion issue. They further submitted that the applicant could not claim to be a victim of the alleged violation of Article 8. With regard to private life, the Government disputed that such a right was afforded to legal persons. In any event, they argued that the complaint was manifestly ill-�founded.84. In regard to the Government's first objection, the Court notes, as explained below (see paragraphs 171-177), that there is, in practice, no remedy which provides detailed grounds in its response to a complainant who suspects that he or she has had his communications intercepted. Furthermore, the Government have not pointed to any individual effective remedy that would have to be exhausted for the purposes of Article 35. The Court therefore finds that the applicant was not required to bring any domestic proceedings and accordingly rejects the objection concerning the exhaustion of domestic remedies.85. As regards private life, the Court has previously held that it may be open to doubt whether a legal person can have a private life within the meaning of Article 8. However, it can be said that its mail and other communications are covered by the notion of "correspondence" which applies equally to communications originating from private and business premises. Moreover, applicants who are legal persons may fear that they are subjected to secret surveillance and it has accordingly been accepted that they may claim to be victims (see Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria, no. 62540/00, § 60, 28 June 2007, with further references). It is therefore appropriate to examine the complaint under the right to respect for the applicant's correspondence.86. Considering that the Government's objection on victim status is closely linked to the substance of the applicant's complaint, it must be joined to the merits.87. The Court further notes that this complaint is not manifestly ill-�founded within the meaning of Article 35 § 3 (a) of the Convention. It is not inadmissible on any other grounds. It must therefore be declared admissible.B. Merits
1. The applicant's victim status and the existence of an interference
(a) The parties' submissions
88. The Government submitted that the applicant could not claim to be a victim of a violation of the Convention by the mere existence of legislation concerning signals intelligence. The aggregate of control mechanisms, supervisory elements and remedies available constituted sufficient safeguards against abuse of the FRA's competence to conduct signals intelligence. Furthermore, the possibility that the applicant had been subject to signals intelligence was virtually non-existent.89. The applicant disagreed with the Government and remarked, with reference to the case of Kennedy v. the United Kingdom (no. 26839/05, 18 May 2010), that its victim status was based on the risk of secret surveillance measures having been applied.(b) The Court's assessment
90. In the Roman Zakharov v. Russia judgment ([GC], no. 47143/06, § 171, ECHR 2015), which concerned covert interception of mobile telephone communications, the Court, adopting the Kennedy approach, clarified the conditions under which an applicant can claim to be a victim of a violation of Article 8 without having to prove that secret surveillance measures have in fact been applied to him or her specifically. Accordingly, the Court accepts that an applicant can claim to be the victim of a violation occasioned by the mere existence of secret surveillance measures, or legislation permitting such measures, if the following conditions are satisfied.91. Firstly, regard will be had to the scope of the legislation permitting secret surveillance measures through an examination of whether the applicant can possibly be affected by it, either because he or she belongs to a group of persons targeted by the contested legislation or because the legislation directly affects all users of communication services by instituting a system where any person can have his or her communications intercepted.92. Secondly, the availability of remedies at the national level will be taken into account; the degree of scrutiny will depend on the effectiveness of such remedies. Where the domestic system does not afford an effective remedy to the person who suspects that he or she was subjected to secret surveillance, widespread suspicion and concern among the general public that secret surveillance powers are being abused cannot be said to be unjustified. In such circumstances, the menace of surveillance can be claimed in itself to restrict free communication through postal and telecommunication services, thereby constituting for all users or potential users a direct interference with the right guaranteed by Article 8. There is therefore a greater need for scrutiny by the Court and an exception to the rule, which denies individuals the right to challenge a law in abstracto, is justified. In such cases the individual does not need to demonstrate the existence of any risk that secret surveillance measures were actually applied to him or her.93. By contrast, if the national system provides for effective remedies, a widespread suspicion of abuse is more difficult to justify. In such cases, the individual may claim to be a victim of a violation occasioned by the mere existence of secret measures or of legislation permitting secret measures only if he or she is able to show that, due to the specific personal situation, he or she is potentially at risk of being subjected to such measures.94. The Court considers that the contested legislation on signals intelligence institutes a system of secret surveillance that potentially affects all users of, for example, mobile telephone services and the internet, without their being notified about the surveillance. Also, as concluded above (see paragraph 84), no domestic remedy provides detailed grounds in response to a complainant who suspects that he or she has had his communications intercepted. In these circumstances, the Court considers an examination of the relevant legislation in abstracto to be justified.95. The applicant is therefore entitled to claim to be the victim of a violation of the Convention, even though it is unable to allege that it has been subjected to a concrete measure of interception. For the same reasons, the mere existence of the contested legislation amounts in itself to an interference with the exercise of the applicant's rights under Article 8. The Court therefore dismisses the Government's objection concerning the applicant's lack of victim status.2. The temporal scope of the Court's examination
96. As already mentioned, the applicant has complained about three different time periods, arguing that each period is characterised by a different legal regime.97. In other cases where the law has been reviewed in abstracto and amendments have been made to the legislation while the application was pending, the Court has limited itself to reviewing Convention compliance of the law in force at the time of its examination (see, for example, Association for European Integration and Human Rights and Ekimdzhiev, cited above; Iordachi and Others v. Moldova, no. 25198/02, 10 February 2009; and Roman Zakharov, cited above).98. As stated above, the Court's task is not to examine measures that have "directly affected" the applicant, but to review the relevant Swedish law and practice in abstracto. The Swedish legislation has been amended on many occasions since the application was lodged with the Court, also since the start of the third time period on 1 December 2009. It cannot be the task of the Court, when reviewing the law in abstracto, to examine compatibility with the Convention before and after every single legislative amendment. The review will therefore focus on the Swedish legislation as it stands at the time of the present examination.3. The justification of the interference
(a) General principles
99. The Court reiterates that any interference can only be justified under Article 8 § 2 if it is in accordance with the law, pursues one or more of the legitimate aims to which paragraph 2 of Article 8 refers and is necessary in a democratic society in order to achieve any such aim. The following general principles have been collated in Roman Zakharov (see §§ 228-236 of that judgment and the further references listed therein).100. The wording "in accordance with the law" requires the impugned measure both to have some basis in domestic law and to be compatible with the rule of law, which is expressly mentioned in the Preamble to the Convention and inherent in the object and purpose of Article 8. The law must thus meet quality requirements: it must be accessible to the person concerned and foreseeable as to its effects (Roman Zakharov, § 228).101. The Court has held on several occasions that the reference to "foreseeability" in the context of interception of telephone communications cannot be the same as in many other fields. Foreseeability in the special context of secret measures of surveillance cannot mean that an individual should be able to foresee when the authorities are likely to intercept communications so that he or she can adapt his or her conduct accordingly. However, especially where a power vested in the executive is exercised in secret, the risk of arbitrariness is evident. It is therefore essential to have clear, detailed rules on interception of telephone communications, especially as the technology available for use is continually becoming more sophisticated. The domestic law must be sufficiently clear to give citizens an adequate indication as to the circumstances and conditions which give public authorities the power to resort to such measures (Roman Zakharov, § 229).102. Moreover, since the implementation in practice of measures of secret surveillance of communications is not open to scrutiny by the individuals concerned or the public at large, it would be contrary to the rule of law for the discretion granted to the executive or to a judge to be expressed in terms of an unfettered power. Consequently, the law must indicate the scope of any such discretion conferred on the competent authorities and the manner of its exercise with sufficient clarity to give the individual adequate protection against arbitrary interference (Roman Zakharov, § 230).103. In its case-law on secret measures of surveillance in criminal investigations, the Court has developed the following minimum safeguards that should be set out in law in order to avoid abuses of power: a description of the nature of offences which may give rise to an interception order; a definition of the categories of people liable to have their communications intercepted; a limit on the duration of the measures; the procedure to be followed for examining, using and storing the data obtained; the precautions to be taken when communicating the data to other parties; and the circumstances in which recordings may or must be erased or destroyed (Roman Zakharov, § 231).
104. As to the question whether an interference has been "necessary in a democratic society" in pursuit of a legitimate aim, the Court has acknowledged that, when balancing the interest of the respondent State in protecting its national security through secret surveillance measures against the seriousness of the interference with an applicant's rights under Article 8, the national authorities enjoy a certain margin of appreciation in choosing the means for achieving the legitimate aim of protecting national security. However, this margin is subject to European supervision embracing both legislation and decisions applying it. In view of the risk that a system of secret surveillance set up to protect national security may undermine or even destroy democracy under the cloak of defending it, the Court must be satisfied that there are adequate and effective guarantees against abuse. The assessment depends on all the circumstances of the case, such as the nature, scope and duration of the possible measures, the grounds required for ordering them, the authorities competent to authorise, carry out and supervise them, and the kind of remedy provided by the national law. It has to be determined whether the procedures for supervising the ordering and implementation of the restrictive measures are such as to keep the "interference" to what is "necessary in a democratic society" (Roman Zakharov, § 232).105. Review and supervision of secret surveillance measures may come into play at three stages: when the surveillance is first ordered, while it is being carried out, or after it has been terminated. As regards the first two stages, the very nature and logic of secret surveillance dictate that not only the surveillance itself but also the accompanying review should be effected without the individual's knowledge. Consequently, since the individual will necessarily be prevented from seeking an effective remedy of his or her own accord or from taking a direct part in any review proceedings, it is essential that the procedures established should themselves provide adequate and equivalent guarantees safeguarding his or her rights. In addition, the values of a democratic society must be followed as faithfully as possible in the supervisory procedures if the bounds of necessity, within the meaning of Article 8 § 2, are not to be exceeded. In a field where abuse is potentially so easy in individual cases and could have such harmful consequences for democratic society as a whole, it is in principle desirable to entrust supervisory control to a judge, judicial control normally offering the best guarantees of independence, impartiality and a proper procedure (Roman Zakharov, § 233).106. As regards the third stage, after the surveillance has been terminated, the question of subsequent notification of surveillance measures is inextricably linked to the effectiveness of remedies and hence to the existence of effective safeguards against the abuse of monitoring powers. There is in principle little scope for recourse to a remedy by the individual concerned unless he or she is advised of the measures taken without his or her knowledge and thus able to challenge their legality retrospectively or, in the alternative, that any person who suspects that his or her communications are being or have been intercepted can apply to an appropriate body, so that the latter's jurisdiction does not depend on a notification having been given to the subject who has had communications intercepted (Roman Zakharov, § 234).107. Having found an interference of the applicant's rights under Article 8 § 1, in examining the justification for the interference under Article 8 § 2, the Court needs to determine whether the contested legislation itself is in conformity with the Convention (Roman Zakharov, § 235). In cases where the legislation permitting secret surveillance is contested, the matter of the lawfulness of the interference is closely related to the question whether the "necessity" requirement has been complied with and it is therefore appropriate to address these two issues jointly. The "quality of law" in this sense implies that the domestic law must not only be accessible and foreseeable in its application, but must also ensure that secret surveillance measures are applied only when "necessary in a democratic society", in particular by providing for adequate and effective safeguards and guarantees against abuse (Roman Zakharov, § 236).(b) Existing case-law on the bulk interception of communications
108. The Court has considered the Convention compatibility of regimes which expressly permit the bulk interception of communications on two occasions: first in Weber and Saravia v. Germany ((dec.), no. 54934/00, ECHR 2006-XI), and then in Liberty and Others v. the United Kingdom (no. 58243/00, 1 July 2008).
109. In Weber and Saravia the applicants complained about the process of strategic monitoring under the amended G10 Act, which authorised the monitoring of international wireless telecommunications. Signals emitted from foreign countries were monitored by interception sites situated on German soil with the aid of certain catchwords which were listed in the monitoring order. Only communications containing these catchwords were recorded and used. Having particular regard to the six "minimum safeguards" (see paragraph 103 above), the Court considered that there existed adequate and effective guarantees against abuses of the State's strategic monitoring powers. It therefore declared the applicants' Article 8 complaints to be manifestly ill-founded.110. In Liberty and Others the Court was considering the regime under the Interception of Communications Act 1985 which allowed the executive to intercept communications passing between the United Kingdom and an external receiver. At the time of issuing an interception warrant, the Secretary of State was required to issue a certificate containing a description of the intercepted material which he considered should be examined. On the face of the 1985 Act, external communications sent to or from an address in the United Kingdom could only be included in the certificate if the Secretary of State considered it necessary for the prevention or detection of acts of terrorism. Otherwise, the legislation provided that material could be contained in a certificate, and thus listened to or read, if the Secretary of State considered that this was required in the interests of national security, the prevention of serious crime or the protection of the United Kingdom's economy. The Court held that the domestic law at the relevant time did not indicate with sufficient clarity, so as to provide adequate protection against abuse of power, the scope or manner of exercise of the very wide discretion conferred on the State to intercept and examine external communications. In particular, it did not set out in a form accessible to the public any indication of the procedure to be followed for selecting for examination, sharing, storing and destroying intercepted material.(c) Application of these principles to the facts of the case
111. It has not been disputed by the parties that the Swedish signals intelligence, in its present structure, has a basis in domestic law. Furthermore, the Court considers it clear that the measures permitted by Swedish law pursue legitimate aims in the interest of national security by supporting Swedish foreign, defence and security policy and identifying external threats to the country. It therefore remains to be ascertained whether the domestic law is accessible and contains adequate and effective safeguards and guarantees to be considered "foreseeable" and "necessary in a democratic society".112. The Court has expressly recognised that the national authorities enjoy a wide margin of appreciation in choosing how best to achieve the legitimate aim of protecting national security (see Weber and Saravia, cited above, § 106). In Weber and Saravia and Liberty and Others the Court accepted that bulk interception regimes did not per se fall outside this margin. Given the reasoning of the Court in those judgments and in view of the current threats facing many Contracting States (including the scourge of global terrorism and other serious crime, such as drug trafficking, human trafficking, sexual exploitation of children and cybercrime), advancements in technology which have made it easier for terrorists and criminals to evade detection on the internet, and the unpredictability of the routes via which electronic communications are transmitted, the Court considers that the decision to operate a bulk interception regime in order to identify hitherto unknown threats to national security is one which continues to fall within States' margin of appreciation.113. Nevertheless, it is evident from the Court's case-law over several decades that all interception regimes (both bulk and targeted) have the potential to be abused, especially where the true breadth of the authorities' discretion to intercept cannot be discerned from the relevant legislation (see, for example, Klass and Others v. Germany, 6 September 1978, Series A no. 28; Kennedy, cited above; Roman Zakharov, cited above, and Szabó and Vissy v. Hungary, no. 37138/14, 12 January 2016). Therefore, while States enjoy a wide margin of appreciation in deciding what type of interception regime is necessary to protect national security, the discretion afforded to them in operating an interception regime must necessarily be narrower. In this regard, the Court has identified six minimum safeguards that both bulk interception and other interception regimes must incorporate in order to be sufficiently foreseeable to minimise the risk of abuses of power (see paragraph 103 above).114. Accordingly, adapting these minimum safeguards where necessary to reflect the operation of a bulk interception regime dealing exclusively with national security issues, the following assessment of the interference established (see paragraph 95 above) will address, in turn, the accessibility of the domestic law, the scope and duration of signals intelligence, the authorisation of the measures, the procedures to be followed for storing, accessing, examining, using, communicating and destroying the intercepted data, the arrangements for supervising the implementation of the measures, any notification mechanisms and the remedies provided for by national law.(i) Accessibility of domestic law
115. The Court finds that all legal provisions relevant to signals intelligence have been officially published and are accessible to the public, a fact that has not been questioned by the applicant.(ii) Scope of application of signals intelligence
(α) The parties' submissions
116. The applicant submitted that, whereas the conduct against which signals intelligence could be directed had clear affinities to various criminal offences, for instance crimes against the security of the nation, the same could not be said for the FRA's development activities. The latter activities allegedly permitted bulk collection of data, including large amounts of communications data, without regard to the requirement that interception be ordered only in regard to certain specific offences. The applicant further emphasised that, since 1 January 2013, the Security Police and the NOA have been given a mandate to issue more detailed tasking directives for signals intelligence. Since the general tasks of these two authorities were crime prevention and investigation there was a risk that signals intelligence was being conducted outside the scope of foreign intelligence activities.117. The Government submitted that the FRA's development activities were as rigorously regulated - and subject to supervision to the same extent - as signals intelligence in general. The Government also opposed the claim that signals intelligence could be used to investigate crimes, as the law did not permit such use of signals intelligence.(β) The Court's assessment
118. The Court reiterates that the national law must define the scope of application of secret surveillance measures by giving citizens an adequate indication as to the circumstances in which public authorities are empowered to resort to such measures (see paragraph 103 above).119. The requirement of "foreseeability" of the law does not go so far as to compel States to enact legal provisions listing in detail all conduct that may prompt a decision to subject an individual to secret surveillance on "national security" grounds. By the nature of things, threats to national security may vary in character and may be unanticipated or difficult to define in advance. At the same time, it must be emphasised that in matters affecting fundamental rights it would be contrary to the rule of law for a discretion granted to the executive in the sphere of national security to be expressed in terms of unfettered power. Consequently, the law must indicate the scope of any such discretion conferred on the competent authorities and the manner of its exercise with sufficient clarity, having regard to the legitimate aim of the measure in question, to give the individual adequate protection against arbitrary interference (see Roman Zakharov, cited above, § 247, with further references).120. The Signals Intelligence Act stipulates eight purposes for which signals intelligence may be conducted (see paragraph 12 above). Although some of these purposes are generally framed, they are further elaborated upon in the preparatory works (paragraph 13), which is an essential source of Swedish legislation. The Court finds that these eight purposes are adequately indicated (cf. Roman Zakharov, cited above, §§ 246 and 248).121. It is of further importance that signals intelligence conducted on fibre optic cables may only concern communications crossing the Swedish border in cables owned by a communications service provider. Communications between a sender and a receiver in Sweden may not be intercepted, regardless whether the source is airborne or cable-based.122. It is true that the FRA may also intercept signals as part of its development activities which, it appears, mainly concern the collection of communications data. Such collection is made in order to monitor changes in the international signals environment and to develop the FRA's own signals intelligence technology, and may lead to data not relevant for the regular foreign intelligence being intercepted and read. Also, the search terms used for interception of communications data - whether part of the development activities or not - are less specific than those used for interception of the content of a communication (see paragraph 62 above). However, as noted by the Signals Intelligence Committee (paragraph 63), the development activities are essential for the proper functioning of the foreign intelligence and the information thereby obtained may be used in the regular foreign intelligence only if such use is in conformity with the purposes established by law and the applicable tasking directives. Moreover, the provisions applicable to the regular foreign intelligence work are also relevant to the development activities and to any interception of communications data, including the requirement of a permit issued by the Foreign Intelligence Court (paragraph 18). It is further of relevance in this context that, in its 2010 and 2016 reports, the Data Protection Authority found no evidence that personal data had been collected for other purposes than those stipulated for the signals intelligence activities (paragraphs 59-�60). In these circumstances, the Court is satisfied that the scope of application of the development activities is sufficiently demarcated.123. As from 1 January 2013, the Security Police and the NOA have been authorised to issue detailed tasking directives for signals intelligence. While, as pointed out by the applicant, the tasks of these authorities include crime prevention and investigation, section 4 of the Foreign Intelligence Act clearly excludes the use of foreign intelligence to solve tasks in the area of law enforcement or crime prevention (see paragraph 8 above).124. Consequently, the Court finds that the law indicates the scope of mandating and performing signals intelligence conferred on the competent authorities and the manner of its exercise with sufficient clarity.(iii) Duration of secret surveillance measures
(α) The parties' submissions
125. The applicant submitted that the legislation satisfied the minimum requirements in terms of duration of the permit.126. The Government held that the Signals Intelligence Act clearly regulated the maximum duration of a permit and the conditions under which a permit could be renewed.(β) The Court's assessment
127. The Court has held that it is not unreasonable to leave the overall duration of interception to the discretion of the relevant domestic authorities which have competence to issue and renew interception warrants, provided that adequate safeguards exist, such as a clear indication in the domestic law of the period after which an interception warrant will expire, the conditions under which a warrant can be renewed and the circumstances in which it must be cancelled (see Roman Zakharov, cited above, § 250).128. As regards the first two safeguards, the Signals Intelligence Act stipulates that a permit may be granted for a maximum of six months and that it may be extended, following a new examination, for six months at a time (see paragraph 23 above). The examination preceding a renewal must be understood as encompassing a full review by the Foreign Intelligence Court as to whether the conditions set out in section 5 of the Act are still met (paragraph 19). The Act thus gives clear indications of the period after which the permit will expire and of the conditions under which it can be renewed.129. In respect of the third safeguard, the circumstances in which interception must be discontinued, the legislation is not equally clear. There is no provision obliging the FRA, the authorities mandated to issue detailed tasking directives or the Foreign Intelligence Court to cancel a signals intelligence mission if the conditions for it have ceased to exist or the measures themselves are no longer necessary (cf. Klass and Others, cited above, § 52; and Kennedy, cited above, § 161).130. Nevertheless, notwithstanding that the relevant legislation is less clear with regard to the third safeguard, it must be borne in mind that any permit is valid for a maximum of six months and that a renewal requires a review as to whether the conditions are still met. Furthermore, although the Foreign Intelligence Inspectorate is not tasked with inspecting every signals intelligence permit, it may decide that an intelligence interception shall cease, if during an inspection it is evident that the interception is not in accordance with a permit (see paragraph 36 above). The Court also has regard to the fact that the permits in question concern the collection of intelligence related to threats to national security and are not targeting individuals suspected of criminal conduct, in which case the need for specific provisions on the cancellation of permits would have been more prominent. Moreover, as noted by the Data Protection Authority (paragraph 60), the FRA continuously reviews whether the specific personal data it has intercepted is still needed for its signals intelligence activities. In these circumstances, the Court is satisfied that there are safeguards in place which adequately regulate the duration, renewal and cancellation of interception measures.(iv) Authorisation of secret surveillance measures
(α) The parties' submissions
131. The applicant submitted that, although signals intelligence could not be conducted without prior authorisation by the Foreign Intelligence Court, the court's impartiality and independence from the Government could be questioned and its activities were covered by complete secrecy. Its hearings and decisions had never been made public. The same was true for information about the number of hearings, the number of permits granted or rejected, any reasoning of its decisions or the amount or type of search terms being used. As to the composition of the court, its members were elected for a limited period of time, except for the president.132. The Government emphasised that all signals intelligence conducted required a permit from the Foreign Intelligence Court, including the FRA's development activities. The Government also stressed that the court was independent from Parliament and public authorities. Although its activities were governed by secrecy, a privacy protection representative was present to safeguard the interests of individuals.(β) The Court's assessment
133. As the Court has previously held, the authorisation of telephone tapping by a non-judicial authority may be compatible with the Convention (see, for example, Klass and Others, cited above, § 51; and Weber and Saravia, cited above, § 115), provided that that authority is sufficiently independent from the executive (Roman Zakharov, cited above, § 258). However, the rule of law implies, inter alia, that an interference by the executive authorities with an individual's rights should be subject to an effective control which should normally be assured by the judiciary, at least in the last resort, judicial control normally offering the best guarantees of independence, impartiality and a proper procedure (Klass and Others, cited above, §§ 55 and 56). Prior judicial authorisation may serve to limit the authorities' discretion in interpreting the scope of mandating and performing signals intelligence. Thus, a requirement of prior judicial authorisation constitutes an important safeguard against arbitrariness (Roman Zakharov, cited above, § 249). Nevertheless, prior authorisation of such measures is not an absolute requirement per se, because where there is extensive subsequent judicial oversight, this may counterbalance the shortcomings of the authorisation (Szabó and Vissy, cited above, § 77).134. Under Swedish law, signals intelligence conducted by the FRA must be authorised in advance by the Foreign Intelligence Court. The president of the court is a permanent judge, whereas the vice president and other members are appointed by the Government on four-year terms. Neither Parliament nor the Government or other authorities may interfere with the court's decision-making, which is legally binding.135. The main rule is that the court shall hold public hearings but, when secrecy applies, hearings may be held in private. As submitted by the applicant, and confirmed by the Government, the court's activities are in practice covered by complete secrecy. A hearing has never been open to the public and all decisions are confidential. As noted by the applicant, no information is disclosed to the public about the number of hearings, the number of permits granted or rejected, the reasoning of the court's decisions or the amount or type of search terms being used.136. The Court is mindful of the fact that the nature of signals intelligence requires that surveillance is done in secret (see paragraph 101 above). It must therefore be accepted that, where there is a system of prior authorisation, sensitive aspects of the authorising body's activities are withheld from the public for as long as required in the individual case, in order not to defeat the purpose of the signals intelligence. However, such a procedure could only be accepted where there are adequate safeguards in place.137. The Government have submitted that the lack of transparency is compensated by the presence of the privacy protection representative. He or she must be present during the court's examination, except in very urgent cases. The representative is either a present or former permanent judge or attorney and has access to all the case documents and may make statements. He or she does not appear on behalf of any individual concerned by the signals intelligence permit at issue, but protects the interests of the general public.138. The Court is of the view that, while the privacy protection representative cannot appeal against a decision by the Foreign Intelligence Court or report any perceived irregularities to the supervisory bodies, the presence of the representative at the court's examinations compensates, to a limited degree, for the lack of transparency concerning the court's proceedings and decisions.139. More importantly, taking into account that proceedings and decisions relating to secret surveillance largely require secrecy, the Court considers that what is essential for the protection of individuals' rights in the context of the regime under consideration is that the FRA's signals intelligence is subject to a system of prior authorisation whereby the FRA must submit for independent examination an application for a permit to conduct surveillance in respect of each intelligence collection mission. As an additional safeguard against abuse and arbitrariness, the task of examining whether the mission is compatible with applicable legislation and whether the intelligence collection is proportional to the resultant interference with personal integrity has been entrusted to a body whose presiding members are or have been judges. Furthermore, the supervision of the Foreign Intelligence Court is extensive as the FRA, in its applications, must specify not only the mission request in question and the need for the intelligence sought but also the signal carriers to which access is needed and the search terms - or at least the categories of search terms - that will be used (see paragraphs 18-20 above). The Court therefore considers that the judicial supervision performed by the Foreign Intelligence Court is of crucial importance in that it limits the FRA's discretion by interpreting the scope of mandating and performing signals intelligence.140. As a final point under this heading, it should be noted that the FRA itself may decide to grant a permit, if it is feared that the application of a permit from the Foreign Intelligence Court might cause delay or other inconveniences of essential importance for one of the specified purposes of the signals intelligence. In this context the Court reiterates the need for safeguards to ensure that such emergency measures are used sparingly and only in justified cases (Roman Zakharov, cited above, § 266). As the legislation states that such a decision must be followed by an immediate notification to and a subsequent rapid review by the Foreign Intelligence Court where the permit may be changed or revoked, the Court finds this procedure acceptable (cf. Szabó and Vissy, cited above, § 81).141. In light of the foregoing, the Court finds that the provisions and procedures relating to the system of prior court authorisation, on the whole, provide important guarantees against abuse.(v) Procedures to be followed for storing, accessing, examining, using and destroying the intercepted data
(α) The parties' submissions
142. The applicant argued that the procedures in these aspects were regulated in only very broad terms. For example, there was no general obligation to destroy data.143. The Government pointed out that the Foreign Intelligence Inspectorate was responsible for scrutinising the treatment and destruction of data in general and had a mandate to terminate surveillance and order the destruction of data that had been collected in a way that was incompatible with a permit issued by the Foreign Intelligence Court.(β) The Court's assessment
144. The Court notes that personnel at the FRA treating personal data are security cleared and, if secrecy applies to the personal data, subject to confidentiality. They are under an obligation to handle the personal data in a safe manner. Also, they could face criminal sanctions if tasks relating to the treatment of personal data are mismanaged (see paragraph 30 above). Furthermore, the FRA must ensure that personal data is collected only for certain expressly stated and justified purposes, determined by the direction of the foreign intelligence activities through tasking directives. The personal data treated also has to be adequate and relevant in relation to the purpose of the treatment. No more personal data than what is necessary for that purpose may be processed. All reasonable efforts have to be made to correct, block and obliterate personal data which is incorrect or incomplete in relation to the purpose (paragraph 28).145. Contrary to the applicant's claim, there are several provisions regulating the situations when intercepted data has to be destroyed. For example, intelligence must be destroyed immediately if it 1) concerns a specific natural person and has been determined to lack importance for the purpose of the signals intelligence, 2) is protected by constitutional provisions of secrecy for the protection of anonymous authors or media sources, 3) contains information shared between a criminal suspect and his or her counsel and is thus protected by attorney-client privilege, or 4) involves information given in a religious context of confession or individual counselling, unless there are exceptional reasons for examining the information (see paragraph 25 above). Moreover, if communications have been intercepted between a sender and receiver both in Sweden, despite the ban on the interception of such communications, they must be destroyed as soon as their domestic nature has become evident (paragraph 26). Also, where a temporary permit granted by the FRA has been revoked by the Foreign Intelligence Court, all intelligence collected on the basis of that permit must be immediately destroyed (paragraph 27).146. Although the FRA may maintain databases for raw material containing personal data up to one year, it has to be kept in mind that raw material is unprocessed information. That is, it has yet to be subjected to manual treatment. The Court accepts that it is necessary for the FRA to store raw material before it can be manually processed. At the same time, the Court stresses the importance of deleting such data as soon as it is evident that it lacks pertinence for a signals intelligence mission.147. In sum, examining the legislation on storing, accessing, examining, using and destroying intercepted data, the Court is satisfied that it provides adequate safeguards against abuse of treatment of personal data and thus serves to protect individuals' personal integrity (cf. Roman Zakharov, cited above, §§ 253-256; and Kennedy, cited above, §§ 162-164).(vi) Conditions for communicating the intercepted data to other parties
(α) The parties' submissions
148. The applicant submitted that the conditions for communicating data left a large discretion to the FRA, for instance through the lack of specification as regards the foreign authorities and international organisations to whom data could be communicated.149. The Government maintained that the procedures for communicating data, including the communication to other states and international organisations as part of Sweden's international cooperation, contained sufficient safeguards and that supervision was provided by the Foreign Intelligence Inspectorate.(β) The Court's assessment
150. With regard to the communication of intercepted data to other parties, the purpose of signals intelligence naturally demands that it may be reported to concerned national authorities, in particular the authority which ordered the mission. Furthermore, given the context - the collection of intelligence on foreign circumstances that may have an impact on Swedish national security and other essential national interests as well as the country's participation in international security operations - it is evident that there must be a possibility of exchanging intelligence collected with international partners. Thus, the FRA Personal Data Processing Act allows the communication of personal data to other states or international organisations if necessary for the activities of the FRA within international defence and security cooperation and as long as it is not prevented by secrecy. Further discretion is given to the Government, which may decide to communicate personal data to states or organisations in other cases when necessary for the activities of the FRA, thus presumably in cases where such communication would otherwise be prevented by rules of secrecy. The FRA Personal Data Processing Ordinance adds that such disclosure is permitted for the benefit of the Swedish Government and Sweden's comprehensive defence strategy as long as it does not harm Swedish interests (see paragraph 35 above). The relevant provision of the Public Access to Information and Secrecy Act contains an exception to the rule of secrecy in relation to foreign authorities and international organisations in cases where an express legal provision allows disclosure or when the information in an analogous situation may be given to a Swedish authority and the disclosing authority finds it to be consistent with Swedish interests (paragraph 58). Thus, whereas national interests are taken into account, the legislation does not indicate that possible harm to the individual concerned must be considered. Furthermore, the legislation only in very broad terms mentions that the data may be communicated to "other states or international organisations"; there is no provision requiring the recipient to protect the data with the same or similar safeguards as those applicable under Swedish law. Also the situation where data may be communicated - when necessary for "international defence and security cooperation" - opens up for a rather wide scope of discretion. In the Court's view, the mentioned lack of specification in the provisions regulating the communication of personal data to other states and international organisations gives some cause for concern with respect to the possible abuse of the rights of individuals. On the whole, however, the Court considers that the supervisory elements described below sufficiently counterbalance these regulatory shortcomings.(vii) Supervision of the implementation of secret surveillance measures
(α) The parties' submissions
151. The applicant, pointing to the findings of the National Audit Office, submitted that the Foreign Intelligence Inspectorate's own documentation of its supervisory work was scarce and that the Inspectorate lacked specified goals.152. The Government submitted that an assessment of the report of the National Audit Office had been communicated to Parliament. The Office's overall conclusion was that the Inspectorate had been given the necessary prerequisites to carry out its supervisory functions in an efficient and effective manner. The FRA had taken the Inspectorate's views seriously and implemented measures accordingly. As to the Inspectorate's goals, these were clearly specified in the legislation.(β) The Court's assessment
153. The Court has found that, although it is in principle desirable to entrust supervisory control to a judge, supervision by a non-judicial body may be considered compatible with the Convention, provided that the supervisory body is independent of the authorities carrying out the surveillance, and is vested with sufficient powers and competence to exercise an effective and continuous control (see Roman Zakharov, cited above, § 275, with further reference).154. As to the requirement of independence, the Court has taken into account the manner of appointment and the legal status of the members of the supervisory body. In particular, it has found sufficiently independent the bodies composed of members of Parliament of both the majority and the opposition, or of persons qualified to hold judicial office, appointed either by Parliament or by the Prime Minister (see Roman Zakharov, cited above, § 278, with further references).155. As regards the supervisory body's powers and competence, it is essential that it has access to all relevant documents, including closed materials, and that all those involved in interception activities have a duty to disclose to it any material required. Other important elements to take into account when assessing the effectiveness of the supervision are the supervisory body's powers with respect to any breaches detected and the possible public scrutiny of its activities. Moreover, it is for the Government to illustrate the practical effectiveness of the supervision arrangements with appropriate examples (see Roman Zakharov, cited above, §§ 281-283, with further references).156. The members of the Foreign Intelligence Inspectorate are appointed by the Government on terms of at least four years and the president and vice-president are current or former permanent judges. The other members are suggested by the parliamentarian party groups (see paragraph 37 above). The Court, therefore, finds no reason to question the independence of the Inspectorate.157. The Inspectorate shall examine in particular the search terms used, the destruction of intelligence and how reports are communicated; the FRA shall report to it the search terms which directly relate to a specific natural person (see paragraph 36 above). The Inspectorate has access to all relevant documents (paragraph 39). It is within its powers to decide that the collection of intelligence shall cease or that information collected shall be destroyed, if during an inspection it becomes evident that the collection has not been in accordance with a particular permit; though, as of yet, no such measure has proved necessary (paragraphs 36 and 39). The Inspectorate is also in charge of the signal carriers, which includes ensuring that the FRA is only provided with access to signal carriers insofar as such access is covered by the permit (paragraph 24). The Inspectorate is to forward to the FRA, and if needed to the Government, any opinions or suggestions for measures to which the inspections give rise (paragraph 38).158. The Court considers that the supervision of the Foreign Intelligence Inspectorate is of particular value in ensuring that the provisions applicable to the activities of the FRA are respected and that, generally, signals intelligence is performed in a manner which offers adequate safeguards against abuse. The above-mentioned rules governing the work of the Inspectorate indicate that it has been given sufficient powers to carry out this task. Moreover, contrary to the applicant's claim, the Court understands the report of the National Audit Office as concluding that the Inspectorate has been able to carry out its supervisory task efficiently. The Office also found that the FRA has taken the Inspectorate's views and suggestions seriously and have implemented measures based on them (see paragraph 40 above). The Court is therefore satisfied that the Inspectorate's supervision is efficient, not only in theory but also in practice.159. The Court also finds that the Inspectorate's activities are open to public scrutiny. Beyond the audit provided by the National Audit Office, the Inspectorate submits annual reports to the Government on its activities; these reports are available to the public (see paragraph 38 above).160. As regards personal data, further supervisory functions are provided by the Data Protection Authority. The Authority has on request access to personal data that is processed, documentation on the treatment of personal data along with the security measures taken on such treatment and access to the facilities connected to the processing of personal data. If the Authority finds that personal data is or could be processed illegally, it shall take remedial action through remarks to the FRA. The Authority may also apply to an administrative court to have illegally processed personal data destroyed (see paragraph 43 above). The Authority's supervision led to reports published in 2010 and 2016, in which some aspects of the FRA's activities were criticised. Issues of personal data and personal integrity, however, were generally considered to have been dealt with in a satisfactory manner (paragraphs 59-60).161. Having regard to the above, the Court finds that the supervisory elements provided by the Foreign Intelligence Inspectorate and the Data Protection Authority fulfill the requirements on supervision in general. Moreover, the Parliamentary Ombudsmen and the Chancellor of Justice have general supervisory responsibilities in regard to the FRA.(viii) Notification of secret surveillance measures
(α) The parties' submissions
162. The applicant submitted that the obligation on the FRA to notify natural persons when search terms directly related to them had been used was void of any practical meaning, since notifications had never been made due to secrecy.163. The Government confirmed that a notification had never been given by the FRA for reasons of secrecy, but submitted that this was compensated by the remedy according to which the Foreign Intelligence Inspectorate could check at the request of an individual whether his or her communication had been subject to signals intelligence.(β) The Court's assessment
164. The Court reiterates that it may not be feasible in practice to require subsequent notification in all cases. The activity or danger against which a particular series of surveillance measures is directed may continue for years, even decades, after the suspension of those measures. Subsequent notification to each individual affected by a suspended measure might well jeopardise the long-term purpose that originally prompted the surveillance. Furthermore, such notification might serve to reveal the working methods and fields of operation of the intelligence services and even possibly to identify their agents. Therefore, the fact that persons concerned by secret surveillance measures are not subsequently notified once surveillance has ceased cannot by itself warrant the conclusion that the interference was not "necessary in a democratic society", as it is the very absence of knowledge of surveillance which ensures the efficacy of the interference. As soon as notification can be carried out without jeopardising the purpose of the restriction after the termination of the surveillance measure, information should, however, be provided to the persons concerned (see Roman Zakharov, cited above, § 287, with further references).165. The Court, mindful of the fact that the applicant is not a natural person, notes that, in theory, the FRA is obliged to inform a natural person, if search terms directly related to him or her have been used, about when and why the collection took place. The person shall be notified as soon as it can be done without detriment to the foreign intelligence activities, but at the latest one month after the signals intelligence mission was concluded. However, the obligation to notify does not apply where secrecy applies. The parties, as well as the Data Protection Authority in its report of 6 December 2010 (see paragraph 59 above) and the Signals Intelligence Committee in its report of 11 February 2011 (paragraph 64), have confirmed that in practice a notification has never been made, due to secrecy. Thus, the Court agrees with the applicant that the obligation on the FRA to notify individuals lacks practical significance.166. The Court has previously found that the absence of a requirement to notify the subject of interception of postal and telephone communications at any point in time or in any circumstances was incompatible with the Convention, in that it deprived the subject of the interception an opportunity to seek redress for unlawful interferences with his or her rights under Article 8 and rendered the remedies available under national law theoretical and illusory rather than practical and effective (see Association for European Integration and Human Rights and Ekimdzhiev, cited above, §§ 90 and 91). By contrast, in the case of Kennedy, the absence of a requirement to notify the subject of interception at any point in time was compatible with the Convention, because in the United Kingdom any person who suspected that his or her communications were being or had been intercepted could complain about an unlawful interception to a tribunal, whose jurisdiction did not depend on notification to the subject that there had been an interception of his or her communications (Kennedy, cited above, § 167).167. Taking into account that the requirement to notify the subject of secret surveillance measures is not applicable to the applicant and is, in any event, devoid of practical significance, the Court accordingly finds it pertinent to examine the issue of notification together with the remedies available in Sweden; two issues that are inextricably linked (see Roman Zakharov, cited above, § 286).(ix) Available remedies
(α) The parties' submissions
168. The applicant submitted that persons who had availed themselves of the possibility to request an investigation by the Foreign Intelligence Inspectorate had received a standardised reply that no unlawful surveillance had taken place. The applicant also stressed that the Inspectorate had no power to order compensation to be paid. No complaints regarding signals intelligence conducted by the FRA had been received by the Data Protection Authority after 2009. In regard to the Parliamentary Ombudsmen, the Chancellor of Justice and the other remedies mentioned by the Government, the applicant did not see any prospects of success unless there was evidence to establish that an individual had in fact been subjected to unlawful interception.169. The Government emphasised that Swedish legislation offered several remedies. Beyond the possibility for individuals to request the Foreign Intelligence Inspectorate to check if his or her communications had been intercepted, the FRA was obliged, upon request, to inform the individual if his or her personal data had been treated or not and to correct, block or destroy personal data that had not been processed in accordance with law. In addition, complaints could be addressed to the Parliamentary Ombudsmen and the Chancellor of Justice, who had the power to investigate that relevant laws had been properly applied and, in so doing, were entitled to have access to documents of courts and administrative authorities, including the Foreign Intelligence Court and the FRA. Although they could not render legally binding decisions, their opinions commanded great respect in Swedish society. Also the Data Protection Authority, aside from being the supervisory authority on the FRA's treatment of personal data, could examine individual complaints. Furthermore, it was possible for an individual to bring an action for damages, report a matter for prosecution and bring a claim for compensation for violations of the Convention.170. The International Commission of Jurists, Norwegian Section, submitted that remedies were not available to non-Swedish citizens, despite the fact that Swedish signals intelligence was focused on communications crossing the Swedish border.(β) The Court's assessment
171. As the Court noted above, in the case of Kennedy the absence of a requirement to notify the subject of interception was compatible with the Convention, because the jurisdiction of the tribunal where the interception could be challenged did not depend on a prior notification (see Kennedy, cited above, § 167). Under the Signals Intelligence Act, the Foreign Intelligence Inspectorate, at the request of an individual, investigates whether his or her communications have been intercepted through signals intelligence. If so, the Inspectorate verifies whether the interception and treatment of the information was in accordance with law. The Inspectorate must notify the individual that an investigation has been carried out. A request can be made by legal and natural persons regardless of nationality and residence (see paragraph 46 above). The Inspectorate has the power to decide that the collection of intelligence shall cease or that the intelligence shall be destroyed (paragraph 36).172. Like in the Kennedy case, the Court is therefore satisfied that the remedy offered by the Foreign Intelligence Inspectorate is not dependent on prior notification. Although the Inspectorate may decide on the discontinuation of intelligence collection or the destruction of intelligence, unlike in Kennedy, it may not order compensation to be paid. However, with regard to compensation per se, the Court is mindful that there is an effective remedy in Sweden in that compensation from the State can be sought through the Chancellor of Justice or the domestic courts (see paragraph 53 above).173. The Inspectorate examines if the individual's communications have been intercepted using signals intelligence. However, that examination is limited to the question whether or not the collection of intelligence was in accordance with law. The individual cannot obtain information whether his or her communications have actually been intercepted, only if there has been any unlawfulness. As pointed out by the applicant, the Inspectorate does not give any reasons for its conclusions reached on the issue of lawfulness. In contrast, the Court noted in Kennedy that the publication of the tribunal's legal rulings enhanced the level of scrutiny afforded to secret surveillance activities in the United Kingdom (see Kennedy, cited above, § 167). Moreover, as the decision of the Inspectorate is final, an individual who is not satisfied with the response from the Inspectorate may not seek review by, for instance, making an appeal to a court.174. As to the remedies available directly through the FRA, the Court makes the following observations. The FRA is, upon request, required to inform an individual whether personal data concerning him or her has been processed. A request may be submitted once per calendar year. If such data has been treated, the FRA must specify what information on the individual is concerned, from where it was collected, the purpose of the treatment and to which recipients or categories of recipients the personal data has been reported (see paragraph 47 above). The Court notes that such an obligation is well-tailored to lower suspicion and concern among the general public that secret surveillance measures are being abused.175. However, like the notification requirement, there is no obligation on the FRA to give information if secrecy applies to it. While the FRA's decisions may be appealed against to the Administrative Court in Stockholm (see paragraph 49 above), the Court has to assume that, like with other aspects of the FRA's activities, strict secrecy applies and, therefore, no information on personal data is given to requesting individuals. In the absence of examples provided by the Government that illustrate the effectiveness of this remedy, the Court cannot find that it has practical importance. Furthermore, the FRA's procedure to correct, block or destroy personal data (paragraph 48) is dependent on the individual's knowledge that personal data has been registered and the nature of that data. Therefore, that remedy must be deemed to be ineffective in practice.176. The Court notes, however, that Swedish law provides for several remedies of a general nature, in particular the possibility of addressing individual complaints to the Parliamentary Ombudsmen and the Chancellor of Justice (see paragraphs 51-53 above). These two institutions examine whether courts and authorities and their officials comply with laws and regulations and fulfil their obligations, not the least in regard to citizens' fundamental rights and freedoms. They are thus authorised to scrutinise the work of the courts and authorities involved in signals intelligence activities and there appears to be no impediment preventing an individual from introducing a complaint about an interference of privacy rights. The two institutions have the right of access to documents and other materials for the performance of their scrutiny. While their decisions are not legally binding, their opinions command great respect in Sweden. They also have the power to initiate criminal or disciplinary proceedings against public officials for actions taken in the discharge of their duties. As regards the Chancellor of Justice, it is also of relevance that a practice has developed in the last several years according to which the Chancellor may receive and resolve individual compensation claims for alleged violations of the Convention (paragraphs 53 and 172).Moreover, the Court notes that the Data Protection Authority may receive and examine individual complaints under the Personal Data Act (paragraph 54).177. To sum up, the Court observes that the Swedish remedies available for complaints relating to secret surveillance do not include the recourse to a court, save for an appeal against the FRA's decisions on disclosure and corrective measures, which remedies the Court have as such found to be ineffective. Furthermore, there does not appear to be a possibility for an individual to be informed of whether his or her communications have actually been intercepted or, generally, to be given reasoned decisions. Thus, in regard to the final stage of supervision of signals intelligence measures - reviews requested by individuals after the measures have been carried out - the Swedish system does not offer the same guarantees in these respects as the scrutiny in the United Kingdom, examined in the Kennedy case.178. Nevertheless, there are several remedies by which an individual may initiate an examination of the lawfulness of measures taken during the operation of the signals intelligence system, notably through requests to the Foreign Intelligence Inspectorate, the Parliamentary Ombudsmen and the Chancellor of Justice. In the Court's view, the aggregate of remedies, although not providing a full and public response to the objections raised by a complainant, must be considered sufficient in the present context, which involves an abstract challenge to the signals intelligence regime itself and does not concern a complaint against a particular intelligence measure. In reaching this conclusion, the Court attaches importance to the earlier stages of supervision of the regime, including the detailed judicial examination by the Foreign Intelligence Court of the FRA's requests for permits to conduct signals intelligence and the extensive and partly public supervision by several bodies, in particular the Foreign Intelligence Inspectorate.(x) Conclusion
179. The Court is mindful of the potentially harmful effects that the operation of a signals intelligence scheme may have on the protection of privacy. Nevertheless, the Court acknowledges the importance for national security operations of a system such as the one examined in the present case. It notes, in this respect, the similar conclusions drawn by the Venice Commission (see paragraph 69 above). Having regard to the present-day threats being posed by global terrorism and serious cross-border crime as well as the increased sophistication of communications technology, the decision to set up a bulk interception regime in order to identify such threats was one which fell within the respondent State's margin of appreciation. As noted above (paragraph 112), in deciding on the type of regime necessary, the margin afforded was a wide one.180. As noted simultaneously, the State's discretion in operating the interception regime is more narrow. When examining the Swedish system of signals intelligence in abstracto, the Court has had regard to the relevant legislation and the other information available in order to assess whether, on the whole, there are sufficient minimum safeguards in place to protect the public from abuse. While the above assessment has disclosed some areas where there is scope for improvement - notably the regulation of the communication of personal data to other states and international organisations (see paragraph 150 above) and the practice of not giving public reasons following a review of individual complaints (paragraphs 173 and 177) - the Court is of the opinion that the system reveals no significant shortcomings in its structure and operation. The regulatory framework has been reviewed several times, in order to expand the use of signals intelligence but also, more importantly, with the aim to enhance protection of privacy. It has developed in such a way that it minimises the risk of interference with privacy and compensates for the lack of openness. In particular, the scope of the signals intelligence measures and the treatment of intercepted data are clearly defined in law, the authorisation procedure is detailed and entrusted to a judicial body and there are several independent bodies tasked with the supervision and review of the system. The Court's finding that the system reveals no significant shortcomings is the result of an examination in abstracto and does not preclude a review of the State's liability under the Convention where, for example, the applicant has been made aware of an actual interception.181. Accordingly, making an overall assessment and having regard to the margin of appreciation enjoyed by the national authorities in protecting national security, the Court finds that the Swedish system of signals intelligence provides adequate and sufficient guarantees against arbitrariness and the risk of abuse. The relevant legislation meets the "quality of law" requirement and the "interference" established can be considered as being "necessary in a democratic society". Furthermore, the structure and operation of the system are proportionate to the aim sought to be achieved.There has accordingly been no violation of Article 8 of the Convention.II. ALLEGED VIOLATION OF ARTICLE 13 OF THE CONVENTION
182. The applicant complained that it has had no effective domestic remedy through which to challenge the violation of its rights under Article 8 of the Convention. The applicant relied on Article 13 of the Convention, which reads as follows:"Everyone whose rights and freedoms as set forth in [the] Convention are violated shall have an effective remedy before a national authority notwithstanding that the violation has been committed by persons acting in an official capacity."
183. The Government contested that argument.184. Having regard to the findings under Article 8 (see, in particular, paragraph 178 above), the Court considers that, although the present complaint is closely linked to the complaint under Article 8 and therefore has to be declared admissible, it raises no separate issue under Article 13 of the Convention.FOR THESE REASONS, THE COURT, UNANIMOUSLY,
1. Joins to the merits the Government's objection regarding the applicant's lack of victim status and declares the application admissible;
2. Dismisses the Government's above-mentioned objection;
3. Holds that there has been no violation of Article 8 of the Convention;
4. Holds that there is no need to examine separately the complaint under Article 13 of the Convention.
Done in English, and notified in writing on 19 June 2018, pursuant to Rule 77 §§ 2 and 3 of the Rules of Court.
Stephen PhillipsBranko Lubarda
RegistrarPresident
BAILII: