Several key legal developments have taken place since the publication of the 2017 FRA report. For example, the CJEU and ECtHR issued seminal judgments on the transatlantic flow of data and surveillance by intelligence services; the General Data Protection Regulation (GDPR)[12] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, OJ 2016 L 119.
and the Law Enforcement Directive[13] Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ 2016 L 119.
entered into force at EU level, (hereafter referred to as the 2016 European data protection reform); and the Council of Europe adopted the modernised convention for the protection of individuals with regard to the processing of personal data (Convention 108+).[14] Council of Europe, Committee of Ministers, Protocol amending the Convention for the protection of individuals with regard to automatic processing of personal data (ETS No. 108), ETS No. 223, 18 May 2018.
Such legal developments have necessitated changes to national intelligence laws, thus requiring FRA to update its data to reflect such legal reforms.
Figure 1 presents an overview of reforms of legal frameworks on surveillance that have taken place in the EU-27 since the 2017 FRA report was published. The majority of EU Member States (17) have reformed, or are in the process of reforming, their legal frameworks on intelligence services. Legal changes have been quite diverse, ranging from changes in organisational issues to changes in the accountability regimes of intelligence services and remedies against their actions.
Figure 1 – EU Member States’ legal frameworks for surveillance – reforms since mid-2017
Figure 1 – EU Member States’ legal frameworks for surveillance – reforms since mid-2017
Source: FRA, 2023
Reforms were triggered for various reasons beyond legal developments at EU level, requiring incorporation at EU Member State level. In Austria, for example, findings of a parliamentary enquiry on serious misconduct and corruption of intelligence officials and the response to the terrorist attack in Vienna on 2 November 2020 led to the creation of a new agency.[15] Austria, Federal Act amending the Act concerning Police State Protection Act, the Security Police Act, the Criminal Code, the Code of Criminal Procedure 1975 and the Expungement Redemption Act 1972 (Bundesgesetz, mit dem das Polizeiliche Staatsschutzgesetz, das Sicherheitspolizeigesetz, das Strafgesetzbuch, die Strafprozeßordnung 1975 und das Tilgungsgesetz 1972 geändert werden, Federal Law Gazette I No. 148/2021, 26 July 2021; Parliament of Austria (n.d.), BAT Committee of Inquiry (3/A-USA) (BVT-Untersuchungsausschuss (3/A-USA); Parliament of Austria (2019), BAT Committee of Inquiry: Valuable findings, but still some questions unanswered (BVT-Untersuchungsausschuss: Wertvolle Erkenntnisse, aber noch einige Fragen offen, Parliamentary Correspondence No. 937, 25 September 2019; and Commission of Inquiry into the Terrorist Attack of November 2nd, 2020 (Untersuchungskommission (2021), Final report (Abschlussbericht, 10 February 2021.
A new specialised and independent oversight body was also established as a result of the reforms.[16] Austria, State Protection and Intelligence Service Act (Bundesgesetz über die Organisation, Aufgaben und Befugnisse des Verfassungsschutzes - Staatsschutz- und Nachrichtendienst-Gesetz, Federal Law Gazette I No. 5/2016, Art. 17a f..
Greece has also amended its legal framework several times since 2017. The changes involved various issues, such as the organisation of intelligence services,[17] Greece, Emergency regulations for the protection of public health from the ongoing consequences of the COVID-19 pandemic, development, social protection, re-opening of the courts and other matters (Κατεπείγουσες ρυθμίσεις για την προστασία της δημόσιας υγείας από τις συνεχιζόμενες συνέπειες της πανδημίας του κορωνοϊού COVID-19, την ανάπτυξη, την κοινωνική προστασία και την επαναλειτουργία των δικαστηρίων και άλλα ζητήματα, Law No. 4790, Government Gazette Issue A’ 48/31.03.2021, Art. 87.
the authorisation of surveillance, and the abolishment and subsequent reintroduction of notification of surveillance.[18] Greece, Waiving privacy procedure, cyber security and protection of citizens’ personal data (Διαδικασία άρσης του απορρήτου των επικοινωνιών, κυβερνοασφάλεια και προστασία προσωπικών δεδομένων πολιτών, Law No. 5002/2022, Government Gazette Issue A’ 228/09.1.2022, Art. 4 (7).
The latest of these amendments were made in response to complaints against the intelligence services regarding the inappropriate monitoring of communications of politicians and journalists. Allegations that unknown actors were using illegal spyware to monitor the communications of politicians, journalists and other public figures, as reported in the media, also necessitated these changes.[19] Greece, Kathimerini, ‘Observations: Against the backdrop of the bill, the conflict’, 17 November 2022.
In response to the spyware allegations, investigations were initiated by the Greek data protection authority (DPA) and criminal authorities.
FRA data suggest that spyware revelations since 2021 have had almost no impact on national reforms to date, except in Greece, where reforms in December 2022 addressed the regulation of spyware.[20] Greece, Waiving privacy procedure, cyber security and protection of citizens’ personal data (Διαδικασία άρσης του απορρήτου των επικοινωνιών, κυβερνοασφάλεια και προστασία προσωπικών δεδομένων πολιτών, Law No. 5002/2022, Government Gazette Issue A’ 228/09.1.2022, Arts. 10–14.
In August 2022, the Prime Minister of Spain announced plans to reform the law on intelligence services.[21] Spain, La Moncloa (2022), ‘Pedro Sánchez announces a reform of the legal control regulation of the National Intelligence Centre (CNI) to strengthen its guarantees’, press release, 26 May 2022.
At the time of writing, no draft law had been published. In addition, the government’s 2023 action plan does not refer to such a reform.[22] Spain, Government of Spain(Gobierno de España, General Administration of the State (Administración General del Estado, Annual Action Plan 2023 (Plan Anual Normativo 2023, 2023.
In some cases, court judgments on successful constitutional or administrative law challenges against intelligence laws necessitated amendments to such laws, such as in France,[23]France, Council of State (Conseil d’État, French Data Network and Others v. France, Decision No. 393099, 21 April 2021.
Germany[24]Germany, Federal Constitutional Court (Bundesverfassungsgericht, BVerfG), 1 BvR 2835/17, 19 May 2020; and BVerfG (2022), 1 BvR 2354/13, 28 September 2022.
and Portugal.[25]Portugal, Constitutional Court (Tribunal Constitucional, Judgment No. 464/2019, 21 October 2019.
In Germany, for example, among other changes, a new oversight body was set up in 2021.[26] Germany, Act to Change the Federal Intelligence Service Act to Implement the Guidelines of the Federal Constitutional Court and the Federal Administrative Court (Gesetz zur Änderung des BND-Gesetzes zur Umsetzung der Vorgaben des Bundesverfassungsgerichts sowie des Bundesverwaltungsgerichts, 19 April 2021, setting up the Independent Supervisory Council (Unabhängiger Kontrollrat.
Data protection reforms following the implementation of the 2016 European data protection reform also led to restrictions on or exclusions in the powers of national DPAs to exercise oversight over intelligence services in some countries, such as Bulgaria,[27] Bulgaria, Amendments and supplements to the Personal Data Protection Act (Закон за изменение и допълнение на Закона за защита на личните данни, 26 February 2019; State Intelligence Agency Act (Закон за Държавна агенция „Разузнаване”, 13 October 2015, last amended 4 August 2020, Arts. 27 and 28; Military Intelligence Act (Закон за военното разузнаване, 13 November 2015, last amended 26 March 2021, Art. 78; and State Agency for National Security Act (Закон за Държавна агенция „Национална сигурност”, 13 October 2015, last amended 5 June 2020, Art. 37.
Croatia,[28]Croatia, General Regulation on Data Protection Act (Zakon o provedbi Opće uredbe o zaštiti podataka, 25 May 2018.
Greece[29] Greece, Hellenic Data Protection Authority (HDPA), measures for implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, and transposition of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016, and other provisions, Law No. 4624, Government Gazette Issue A’ 137/29.08.2019, Art. 10 (5).
and Lithuania.[30] Lithuania, Law on Legal Protection of Personal Data Processed for the Purposes of Prevention, Investigation, Detection, or Prosecution of Criminal Acts, Execution of Sentences, or National Security and Defence (Asmens duomenų, tvarkomų nusikalstamų veikų prevencijos, tyrimo, atskleidimo ar baudžiamojo persekiojimo už jas, bausmių vykdymo arba nacionalinio saugumo ar gynybos tikslais, teisinės apsaugos įstatymas), No. XIII-1435, 30 June 2018, Art. 39 (3).
In others, such as Hungary, changes do not appear to have substantially strengthened the DPAs.[31]Hungary, Act 112 of 2011 on the right to informational self-determination and information freedom (törvény az információs önrendelkezési jogról és az információszabadságról, Art. 51/A; amendment entered into force on 26 July 2018, introduced by Amending Act 38 of 2018, 26 July 2018, Art. 20.
In some Member States, such as Cyprus and Luxembourg, reforms appear to have reinforced the role of national DPAs (see the section ‘Expert bodies and data protection authorities’).