Given that everybody is already writing about Apple vs FBI case, I don’t think there is anything to be added at the moment. Especially that in European context (particularly in regard to civil law countries) it is quite hard to imagine court issuing a similar order. That is of course not even taking into account problems of jurisdiction and fact that almost every company of similar importance is located in the United States. But that might be a topic for another post.
What is however definitely worth writing about, and received relatively low media exposure, are the possible consequences of the case of Szabo and Vissy v Hungary. Case concerned two members of watchdog NGO (Eötvös Károly Közpolitikai Intézet) who claimed to be targeted by broad surveillance powers granted to Hungarian Anti-Terrorism Task Force (TEK). Case is especially interesting that ECHR implicitly granted possibility of actio popularis in the context of extensively broad legislation. Let’s head straight to the details than.
Applicants complained against powers granted to the mentioned task force by section 7/E of Act no. XXXIV of 1994 on the Police. Section allowed extensive and invasive surveillance. TEK was authorised to conduct property searches, audio-visual surveillance, intercepting letters and parcel, as well as surveillance of the electronic means of communication. The Act provided usual justification for these activities – national security, fighting terrorism and rescuing Hungarian citizens outside the borders of the country. What was especially concerning, was that these operational techniques were available to TEK without independent judicial authorisation. Powers mentioned were subject only to the approval of the Minister of Justice. Bottom line was that TEK could engage in aggressive surveillance against any person (or group of people) in Hungary, and the only requirement was to present a general suspicion that the target might be involved in activity that threatens national security. Possible complaints against actions of secret services were not investigated by judicial authorities either, but by Minister of Home Affairs, and eventually National Security Committee – yet still no mechanism of remedy was established. Judiciary was therefore completely excluded of the process of authorising surveillance (the Court noted though that generally executive is better suited to supervise surveillance, however it cannot trample need for impartial oversight).
Applicants filed a constitutional complaint, which of course was dismissed. Constitutional court however, made one very interesting remark. Judges noted that the concept of activities that threaten national security is broader than just scope of activities that constitutes an offence. Therefore effectively it is entirely up to secret services and the cabinet whether surveillance might be used – as person subjected does not even have to do anything related to criminal activity as defined by Hungarian criminal code.
Regarding findings of the Judges of ECHR, first issue was mentioned admissibility of the case, as applicants generally had no proofs that they were specifically targeted by secret services. ECHR however noted that due to particularly distressing scope of the provisions and importance of ensuring adequate safeguards, the very existence of such law might be a basis for granting victim status to an applicant – even if he cannot pinpoint how his rights were violated. This is in stark contrast to the approach of US Supreme Court in the case of Clapper v. Amnesty International USA, where case was dismissed on the grounds that claimants could not prove that they were target of surveillance. For the ECHR, fact that law effectively allowed surveillance of basically every citizen of Hungary in combination with lack of effective complaint procedure was a sufficient basis for allowing the case.
In terms of the merits of the case, there was little doubt that provisions violated rights granted under the Article 8 of the convention. Lack of oversight or adequate safeguards, extremely broad scope of possible targets, possibility of unlimited extensions of the time of surveillance, exclusion of judiciary from exercising oversight and lack of remedy were sufficient basis for ruling that the law violated the Convention.
What is most interesting about the judgement however, is its possible impact on mass surveillance policies in Europe. Strictly speaking ECHR has directly (by distinguishing Szabo and Vissy from Kennedy v the UK case) stated that surveillance which is not limited to any particular group of persons (“indiscriminate capturing of vast amounts of communications“) violates standards set by the Convention. This poses a question about data retention policies which still remain alive in many European countries despite ECJ ruling which found Data Retention Directive unlawful. Unless ECHR will follow the route of US Supreme Court and establish European equivalent of third-party doctrine, Szabo and Vissy basically invalidates any form of surveillance that does not have specifically designated target. Given that Poland has just re-authorised data retention (despite judgement of the Constitutional Tribunal, but that is a separate matter) and UK is trying to implement it once again through Investigatory Powers Bill, it is quite likely that those provisions will be challenged in Strasbourg as well. Furthermore, given the admissibility precedent I’d say that it is entirely possible that NGOs might try to lodge an analogous complaint to ECHR – based on the very existence of such provisions. Court’s judgement that would outright ban data retention would certainly be a huge victory for privacy in Europe. The research report on the case-law regarding internet currently states that in ECHR jurisprudence, generally it is acceptable to store telecommunication data as long there are sufficient safeguards against abuse by the state. However, there is yet to be a case directly challenging data retention policies, or even massive collection programs such as GCHQ’s Tempora. At this point it is still too early to predict that outcome of such case would be as good for privacy, but still Szabo and Vissy is definitely a move in this direction.