The 2017 FRA report presented the various expert oversight bodies established in the Member States and analysed the oversight frameworks, alongside the features and powers of these bodies. The report stated that these bodies should have “two essential qualities: be independent and have sufficient powers to carry out continuous control that is subject to public scrutiny”.[81] FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office, p. 73.
These powers relate, on the one hand, to the appropriate review of the measures and, on the other hand, to the oversight bodies’ ability to ensure that effective action is taken if they find irregularities.[82] FRA (2017), Surveillance by intelligence services: Fundamental rights safeguards and remedies in the EU – Volume II: Field perspectives and legal update, Luxembourg, Publications Office, p. 75.
Since 2017, six Member States – Czechia, Finland, Germany, Lithuania, Luxembourg, and the Netherlands – have set up new, or replaced old, expert bodies dedicated to the oversight of intelligence services.
In Czechia, the establishment of a new oversight body is regulated by a 2018 law. This body has not become operational yet because of the high number of requirements imposed on its members. They should, among other things, hold top secret clearance, have no connection to the intelligence services and be over the age of 40. Additional requirements were removed in 2022 to facilitate the procedure for nominating members.[83] Czechia, Act No. 325/2017 Coll., effective from 1 January 2018, which amended Act No. 153/1994 Coll., on the intelligence services of the Czech Republic; and Act No. 150/2021 Coll., amending Act No. 289/2005 Coll. on military intelligence, as amended, and some other acts.
The section below provides an updated list of bodies specialised in intelligence oversight, excluding DPAs. For the purpose of this report, DPAs are considered expert bodies. However, as they are not specialised in intelligence oversight, except in Belgium, they are dealt with separately.
Expert bodies, excluding DPAs, overseeing intelligence services in the EU-27
Austria
-
Legal Protection Commissioner at the federal Ministry of the Interior (Rechtsschutzbeauftragter beim Bundesminister für Inneres)
-
Independent Control Commission on the Protection for the Constitution (Unabhängige Kontrollkommission Verfassungsschutz)
Belgium
-
Standing Intelligence Agencies Review Committee (Standing Committee I) (Vast Comité van Toezicht op de inlichtingen – en veiligheidsdiensten/Comité permanent de Contrôle des services de renseignement et de sécurité)*
-
Administrative Commission (Bestuurlijke Commissie/Commission Administrative)
Bulgaria
-
National Bureau for Control over Special Intelligence Means (Национално бюро за контрол на специалните разузнавателни средства)
Croatia
-
Office of the National Security Council (Ured Vijeća za nacionalnu sigurnost)
-
Council for Civilian Oversight of Security and Intelligence Services (Vijeće za građanski nadzor sigurnosno-obavještajnih agencija)
Cyprus
-
Three-Member Committee (Τριμελής Επιτροπή)
Czechia
-
Independent Control Body of the Intelligence Services (Orgán nezávislé kontroly zpravodajských služeb České republiky)
Denmark
-
Danish Intelligence Oversight Board (Tilsynet med Efterretningstjenesterne)
Estonia
Finland
-
Intelligence Ombudsman (Tiedusteluvalvontavaltuutettu/ Underrättelsetillsynsombudsman)
France
-
National Commission for Control of Intelligence Techniques (Commission nationale de contrôle des techniques de renseignement)
-
Specialised Formation of the Council of State (formation spécialisée du Conseil d’État)
Germany
-
G 10 Commission (G 10-Kommission)
-
Independent Supervisory Council (Unabhängiger Kontrollrat)
Greece
-
Hellenic Authority for Communication Security and Privacy (Αρχή Διασφάλισης του Απορρήτου των Επικοινωνιών)
Hungary
Ireland
-
A designated judge of the High Court oversees the interception of communications and data retention, while another judge of the High Court is designated to oversee the use of surveillance devices such as audio bugs and location-tracking devices.
Italy
Latvia
Lithiuania
-
Intelligence Ombudsman (Žvalgybos kontrolierius)
Luxembourg
-
Special Commission (Commission Spéciale)
Malta
-
Commissioner of the Security Service (Kummissarju tas-Servizz ta’ Sigurtà)
-
Security Committee (Kumitat ta’ Sigurtà)
Netherlands
-
Review Committee on the Intelligence and Security Services (Commissie van Toezicht op de Inlichtingen- en Veiligheidsdiensten, CTIVD)
-
Investigatory Powers Commission (Toetsingscommissie Inzet Bevoegdheden, TIB)
Poland
Portugal
-
Council for the Oversight of the Intelligence System of the Portuguese Republic (Conselho de Fiscalização do Sistema de Informações da República Portuguesa)
Romania
Slovakia
Slovenia
Spain
Sweden
-
Swedish Foreign Intelligence Inspectorate (Statens inspektion för försvarsunderrättelseverksamheten)
-
Commission on Security and Integrity Protection (Säkerhets- och integritetsskyddsnämnden)
-
Foreign Intelligence Court (Försvarsunderrättelsedomstolen)
Notes:
* The 2018 data protection reform in Belgium established Standing Committee I as the supervisory authority in the area of data protection.
Source: FRA, 2023
In 2021, Austria reformed its oversight framework and established a new expert body: the Independent Control Commission on the Protection for the Constitution (Unabhängige Kontrollkommission Verfassungsschutz).[84] Austria, Federal Act amending the Act concerning Police State Protection Act, the Security Police Act, the Criminal Code, the Code of Criminal Procedure 1975 and the Expungement Redemption Act 1972 (Bundesgesetz, mit dem das Polizeiliche Staatsschutzgesetz, das Sicherheitspolizeigesetz, das Strafgesetzbuch, die Strafprozeßordnung 1975 und das Tilgungsgesetz 1972 geändert werden), Federal Law Gazette I No. 148/2021, 26 July 2021, Art. 4a.
This body identifies systemic deficiencies in and ways to improve the intelligence services. It acts either on its own initiative or at the request of the Minister for the Interior or the parliamentary committee on intelligence oversight. In addition, it serves as a contact point for whistle-blowers.[85]Austria, Explanatory notes to the Federal Act amending the Act concerning Police State Protection Act, the Security Police Act, the Criminal Code, the Code of Criminal Procedure 1975 and the Expungement Redemption Act 1972 (Eräuterungen zum Bundesgesetz, mit dem das Polizeiliche Staatsschutzgesetz, das Sicherheitspolizeigesetz, das Strafgesetzbuch, die Strafprozeßordnung 1975 und das Tilgungsgesetz 1972 geändert werden).
This new expert body consists of five independent people appointed by the National Council with a two-thirds majority. These people must possess legal qualifications and experience and undergo a trustworthiness test before appointment.[86]Austria, State Protection and Intelligence Service Act (Bundesgesetz über die Organisation, Aufgaben und Befugnisse des Verfassungsschutzes - Staatsschutz- und Nachrichtendienst-Gesetz, Federal Law Gazette I No. 5/2016, Art. 17b, Section 2a.
To safeguard the body’s independence, it has separate office premises from the intelligence agency. This body does not deal with matters in the area of expertise of the Legal Protection Commissioner at the federal Ministry of the Interior or any other legal protection authority.
Another example of a new oversight body is the Finnish Intelligence Ombudsman (tiedusteluvalvontavaltuutettu / underrättelsetillsynsombudsmannen), set up in 2019. It oversees both the civilian intelligence authorities and the military intelligence authorities. It is an independent body with investigative powers and an extensive right to access information. The body can order the suspension or cessation of surveillance if it considers that the intelligence authority has acted unlawfully.
The body can also temporarily stop a surveillance technique authorised by a court and refer the matter to the authorising court. It also receives investigation requests and complaints from individuals and acts on them.[87] Finland, Act on the Oversight of Intelligence Gathering (laki tiedustelutoiminnan valvonnasta/lag om övervakning av underrättelseverksamheten, Act No. 121/2019, 18 January 2019, Sections 11–14.
Similarly, in Lithuania, a new expert body – the Intelligence Ombudsman (Žvalgybos kontrolierius) – was set up through a 2021 law that came into effect on 1 January 2022.[88] Lithuania, Law on Intelligence Ombudsmen (Žvalgybos kontrolierių įstatymas), No. XIV-868, 23 December 2021
This body was established after the national DPA was excluded from exercising any control over data processing by national institutions for national security and defence purposes.[89]Lithuania, Law on Legal Protection of Personal Data Processed for the Purposes of Prevention, Investigation, Detection, or Prosecution of Criminal Acts, Execution of Sentences, or National Security and Defence (Asmens duomenų, tvarkomų nusikalstamų veikų prevencijos, tyrimo, atskleidimo ar baudžiamojo persekiojimo už jas, bausmių vykdymo arba nacionalinio saugumo ar gynybos tikslais, teisinės apsaugos įstatymas), No. XIII-1435, 30 June 2018, Art. 39 (3).
It is composed of two ombudspersons who are appointed by the parliament for a five-year term. The body has its own staff and budget, and one of the two ombudspersons is appointed as its head.
The Intelligence Ombudsman is independent and accountable only to parliament, to which it submits an annual report. It supervises intelligence services and their compliance with human rights standards and data protection regulations. It also carries out assessments of the legality of intelligence services’ activities and methods.
The ombudsman can investigate intelligence services’ activities and processing of personal data, and may access the data they collect. It can initiate investigations on its own initiative, or based on complaints received from individuals, parliamentarians or other public institutions.
Germany established the Independent Supervisory Council (Unabhängiger Kontrollrat) in 2021. This council acts as a quasi-judicial oversight body tasked with the authorisation of surveillance measures, and as an administrative oversight body for ex post oversight. Its members are six judges of the Federal Supreme Court and/or the Federal Administrative Court, who are elected by the Parliamentary Oversight Panel (Parlamentarisches Kontrollgremium) for 12 years.Cooperation among the different German intelligence oversight bodies is provided for by an amendment of the Parliamentary Oversight Panel Act. The act authorises the panel to request information from the G 10 Commission, the Federal Commissioner for Data Protection and Freedom of Information, and the Independent Supervisory Council, if deemed necessary for the panel’s investigations.[90] Germany, Act to Change the Federal Intelligence Service Act to Implement the Guidelines of the Federal Constitutional Court and the Federal Administrative Court (Gesetz zur Änderung des BND-Gesetzes zur Umsetzung der Vorgaben des Bundesverfassungsgerichts sowie des Bundesverwaltungsgerichts,19 April 2021.
In the Netherlands, the Investigatory Powers Commission assesses the legality of the authorisation the responsible ministers grant to intelligence services to perform surveillance activities.This body supplements the main oversight body, the Review Committee on the Intelligence and Security Services (Commissie Van Toezicht op de Inlichtingen- en Veiligheidsdiensten). This committee is tasked with the ongoing supervision of surveillance activities that intelligence services conduct after authorisation.[91] The Netherlands, Intelligence and Security Services Act 2017 (Wet op de inlichtingen- en veiligheidsdiensten 2017, 1 May 2022, Arts. 32–37.
The 2016 European data protection reform also led to important changes in intelligence oversight. FRA research indicates that national data protection laws passed after 2016 led mostly to broader restrictions on or even the prevention of DPAs exercising oversight and reviewing the data processing activities of intelligence services (see Figure 5), such as in Bulgaria, Croatia and Greece. These changes concerned not only the oversight functions of DPAs over intelligence activities, but also authorities’ remedial powers, as described in the section ‘Remedies’.
However, in some states, such as France, Italy and Slovenia, no important changes affected the general oversight framework. In Slovenia, under the 2022 data protection reform, the Director of the intelligence service can delay the DPA’s inspections in very limited circumstances.[92] Slovenia, Personal Data Protection Act (Zakon o varstvu osebnih podatkov, ZVOP-2), Official Journal of the Republic of Slovenia, No. 136/22, 15 December 2022, Art. 29 (6).
In some countries, such as Belgium and Lithuania, the exclusion of DPAs from overseeing the activities of intelligence services was accompanied by the provision of supervisory powers in the area of data protection to oversight bodies.
Figure 5 – DPAs’ oversight powers over national intelligence services in the EU-27
Source: FRA, 2023
In Bulgaria, processing for “national defence and national security” was excluded from the scope of personal data legislation and the GDPR, restricting the oversight of intelligence services by its national DPA: the Commission for Personal Data Protection (Комисия за защита на личните данни).[93] Bulgaria, Amendments and supplements to the Personal Data Protection Act (Закон за изменение и допълнение на Закона за защита на личните данни, 26 February 2019.
This change was accompanied by corresponding amendments to the laws governing the different intelligence services. These amendments excluded the State Intelligence Agency from the Commission for Personal Data Protection’s oversight but retained the agency’s limited oversight of the activities of the Military Intelligence Service and the State Agency for National Security.[94]Bulgaria, State Intelligence Agency Act (Закон за Държавна агенция „Разузнаване”, 13 October 2015, last amended 4 August 2020, Arts. 27 and 28; Military Intelligence Act (Закон за военното разузнаване, 13 November 2015, last amended 26 March 2021, Art. 78; State Agency for National Security Act (Закон за Държавна агенция „Национална сигурност”, 13 October 2015, last amended 5 June 2020, Art. 37.
A similar change was passed in Greece in 2019. The new data protection law excluded the Greek DPA from supervising operations involving the processing of classified personal data carried out for activities concerning national security.[95]Greece, Hellenic Data Protection Authority (HDPA), measures for implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, and transposition of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016, and other provisions, Law No. 4624, Government Gazette Issue A’ 137/29.08.2019, Art. 10, para. 5.
A similar change occurred in Croatia. The new data protection laws prevented bodies of the security intelligence system from conducting data processing for the purpose of protecting national security and, hence, exempted them from any oversight by the national DPA.[96]Croatia, Implementation of the General Regulation on Data Protection Act (Zakon o provedbi Opće uredbe o zaštiti podataka, Official Gazette No. 42/18, Art. 1 (2); Act on the Protection of Natural Persons in Connection with the Processing and Exchange of Personal Data for the Purposes of Prevention, Research, Detection or Prosecution of Criminal Offenses or Execution of Criminal Sanctions (Zakon o zaštiti fizičkih osoba u vezi s obradom i razmjenom osobnih podataka u svrhe sprječavanja, istraživanja, otkrivanja ili progona kaznenih djela ili izvršavanja kaznenih sankcija,Official Gazette (Narodne novine No. 68/18, Art. 3 (2); Croatian Personal Data Protection Agency (n.d.), Croation Personal Data Protection Agency;Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka (n.d.), Insight into the files of school employees by employees of the Security and Intelligence Agency (Uvid u dosje zaposlenika škole od strane zaposlenika Sigurnosno-obavještajne agencije.
While Lithuania established a new oversight body in 2021, by enacting the European data protection reform in 2018 the country had specifically removed the DPA’s powers over intelligence services’ data processing for the purposes of national security and defence.[97] Lithuania, Law on Legal Protection of Personal Data Processed for the Purposes of Prevention, Investigation, Detection, or Prosecution of Criminal Acts, Execution of Sentences, or National Security and Defence (Asmens duomenų, tvarkomų nusikalstamų veikų prevencijos, tyrimo, atskleidimo ar baudžiamojo persekiojimo už jas, bausmių vykdymo arba nacionalinio saugumo ar gynybos tikslais, teisinės apsaugos įstatymas, No. XIII-1435, 30 June 2018, Art. 39 (3).
In Belgium, the 2018 data protection reform designatedthe Standing Intelligence Agencies Review Committee (Standing Committee I) (Le Comité permanent de contrôle des services de renseignement, Comité permanent R) as the supervisory authority for all data processing activities of intelligence services linked to national security.[98] Belgium, Act on the protection of natural persons with regard to the processing of personal data (Loi relative à la protection des personnes physiques à l’égard des traitements de données à caractère personnel, 5 September 2018. See Belgium, Standing Intelligence Agencies Review Committee (Standing Committee I) (2019), Activity Report 2018 (Rapport d’activités 2018, p. 71.
The Belgian DPA (L’Autorité de protection des données) is excluded from performing any oversight on data processing by intelligence services.
However, data protection law calls for cooperation between the various sectoral supervisory authorities. Accordingly, in 2020, a protocol for cooperation was adopted.[99]Belgium, Autorité de protection des données, Organe de contrôle de l’information policière, Comité permanent de contrôle des services de renseignement and Comité permanent de contrôle des services de police, Protocol for cooperation between the Belgian federal supervisory authorities in the field of data protection agreement between the data protection authority, the police information supervisory body, the permanent committee for the control of the intelligence services and the permanent committee control of police services (Protocole de coopération entre les autorités de contrôle fédérales belges en matière de protection des données convention entre l’autorité de protection des données, l’organe de contrôle de l’information policière, le comité permanent de contrôle des services de renseignement et le comité permanent de contrôle des services de police, 20 November 2020.
It clarifies the division of tasks and the scope of powers of the data protection supervisory authorities in Belgium. Since 2018, the Standing Committee I has reported annually on its activities as a supervisory authority in the area of data protection.[100] See the latest report: Belgium, Standing Committee I (2022), Rapport d’activités 2021, p. 123.
Other data protection reforms were enacted in other Member States. In Germany, for example, the data protection reform revised the framework for data processing in the field of national security.[101]Germany, Act for the Adjustment of Data Protection Law to Regulation (EU) 2016/679 and for the Implementation of Directive (EU) 2016/680 (Gesetz zur Anpassung des Datenschutzrechts an die Verordnung (EU) 2016/679 und zur Umsetzung der Richtlinie (EU) 2016/680, 30 June 2017,
The laws of the three federal intelligence services included new provisions on the specific role and oversight of the Federal Commissioner for Data Protection and Freedom of Information (Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, BfDI), thus transferring the supervisory powers from the old Federal Data Protection Act to intelligence legislation.[102]Germany, Federal Act on the Protection of the Constitution (Bundesverfassungsschutzgesetz, after further legal changes, 20 December 1990, Sections 27 and 28; Federal Intelligence Agency Act (Bundesnachrichtendienstgesetz, 20 December 1990, Sections 63 and 64; Military Counter Intelligence Act (Gesetz über den Militärischen Abschirmdienst, Sections 13 and 13a.
In particular, with regard to the Federal Intelligence Service (Bundesnachrichtendienst), the BfDI’s power to issue ad hoc opinions on critical issues to the parliament and the general public is limited in that the BfDI may inform other oversight bodies only confidentially.[103] Germany, Act to Change the Federal Intelligence Service Act to Implement the Guidelines of the Federal Constitutional Court and the Federal Administrative Court (Gesetz zur Änderung des BND-Gesetzes zur Umsetzung der Vorgaben des Bundesverfassungsgerichts sowie des Bundesverwaltungsgerichts, 19 April 2021.
The oversight powers of DPAs appear to have been reinforced since 2017 in only a few countries. For example, in Luxembourg, based on the 2018 data protection reform, the National Commission for Data Protection (Commission Nationale pour la Protection des Données) is responsible for monitoring and verifying the legal compliance of the processing of personal data by the State Intelligence Service. In this regard, the National Commission for Data Protection enjoys significant investigative, corrective, authorisation and advisory powers. It also hears complaints and provides for remedies, subject to judicial appeal.[104] Luxembourg, Act of 1 August 2018 on the organisation of the National Data Protection Commission, implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), amending the Labour Code and the amended Act of 25 March 2015 stipulating the rules of remuneration and the terms and conditions for the promotion of State civil servants (Loi du 1er août 2018 portant organisation de la Commission nationale pour la protection des données et mise en oeuvre du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/CE (règlement général sur la protection des données), portant modification du Code du travail et de la loi modifiée du 25 mars 2015 fixant le régime des traitements et les conditions et modalités d’avancement des fonctionnaires de l’État, Arts. 8, 44 and 45.
In Cyprus, following the 2018 reforms, the DPA has access to all personal data and information necessary to perform its mandate. The confidentiality of the data is not maintained, unless they are covered by legal professional privilege. Past restrictions on accessing records, which were kept for national security purposes, were abolished.[105] Cyprus, Law on the protection of individuals with regard to the processing of personal data and the free circulation of personal data of 2018 (O περί της Προστασίας των Φυσικών Προσώπων Έναντι της Επεξεργασίας των Δεδομένων Προσωπικού Χαρακτήρα και της Ελεύθερης Κυκλοφορίας των Δεδομένων αυτών Νόμος του 2018, No. 125(I)/2018, Art. 25 (a).
In Sweden, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten) can, on its own initiative, now issue warning orders but also injunctions requiring the intelligence services to take measures to secure the lawfulness of data processing.[106] Sweden, Act (2021:1171) on the processing of personal data by the Swedish Armed Forces (Lag [2021:1171] om behandling av personuppgifter vid Försvarsmakten, 2 December 2021, Chapter 6, Sections 3 and 4; Act (2021:1172) on the processing of personal data by the National Defence Radio Establishment (Lag [2021:1172] om behandling av personuppgifter vid Försvarets radioanstalt, 2 December 2021, Chapter 6, Sections 4 and 5. See also Ministry of Defence (Försvarsdepartementet (2021), Processing of personal data by the Swedish Armed Forces and the National Defence Radio Establishment (Behandling av personuppgifter vid Försvarsmakten och Försvarets radioanstalt, government bill, 13 September 2021, p. 148.
In Hungary, the implementation of the GDPR allowed the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság), which oversees the activities of intelligence services, to start investigations on its own initiative. This power was relied on in its review of Pegasus-related allegations.[107] Hungary, Act 112 of 2011 on the right to informational self-determination and information freedom (törvény az információs önrendelkezési jogról és az információszabadságról, Art. 51/A; amendment entered into force on 26 July 2018, introduced by Amending Act 38 of 2018, 26 July 2018, Art. 20.
However, the ECtHR recently found a violation of the ECHR in respect of the limited powers of the authority. The authority can perform its tasks by sending its fact-finding requests to the overseeing minister and rely on their findings.[108] ECtHR, Hüttl v. Hungary, No. 58032/16, 29 September 2022, para. 18.
Figure 6 summarises the current situation with regard to expert bodies’ and DPAs’ oversight of intelligence services across EU Member States.
Figure 6 – Oversight of surveillance by intelligence services by expert bodies and DPAs

Note: * As over other data controllers.
Source: FRA, 2023