Information Note on the Court’s case-law 191

December 2015

Roman Zakharov v. Russia [GC] - 47143/06

Judgment 4.12.2015 [GC]

Article 34

Victim

User of mobile phone complaining of system of secret surveillance without effective domestic remedies: victim status upheld

Article 8

Article 8-1

Respect for private life

Shortcomings in legal framework governing secret surveillance of mobile telephone communications: violation

Facts – The applicant, who was the editor-in-chief of a publishing company, brought judicial proceedings against three mobile network operators, complaining of interference with his right to privacy of his telephone communications. He claimed that pursuant to the relevant domestic law, the mobile network operators had installed equipment which permitted the Federal Security Service (FSB) to intercept all telephone communications without prior judicial authorisation. He sought an injunction ordering the removal of the equipment and ensuring that access to telecommunications was given to authorised persons only.

The domestic courts rejected the applicant’s claim, finding that he had failed to prove that his telephone conversations had been intercepted or that the mobile operators had transmitted protected information to unauthorised persons. Installation of the equipment to which he referred did not in itself infringe the privacy of his communications.

In the Convention proceedings the applicant complained that the system of covert interception of mobile telephone communications in Russia did not comply with the requirements of Article 8 of the Convention. On 11 March 2014 a Chamber of the Court relinquished jurisdiction to the Grand Chamber.

Law – Article 8

(a) Victim status – The Court’s approach in Kennedy v. the United Kingdom was best tailored to the need to ensure that the secrecy of surveillance measures does not result in the measures being effectively unchallengeable and outside the supervision of the national judicial authorities and the Court. Accordingly, an applicant can claim to be the victim of a violation occasioned by the mere existence of secret surveillance measures or of legislation permitting such measures, if the following conditions are satisfied:

(i) Scope of the legislation – The Court will take into account the scope of the legislation permitting secret surveillance measures by examining whether the applicant can possibly be affected by it, either because he or she belongs to a group of persons targeted by the contested legislation or because the legislation directly affects all users of communication services by instituting a system where any person can have his or her communications intercepted.

(ii) Availability of remedies at national level – The Court will take into account the availability of remedies at the national level and will adjust the degree of scrutiny depending on the effectiveness of such remedies. Where the domestic system does not afford an effective remedy, widespread suspicion and concern among the general public that secret surveillance powers are being abused cannot be said to be unjustified. In such circumstances the menace of surveillance can be claimed in itself to restrict free communication through the postal and telecommunication services, thereby constituting for all users or potential users a direct interference with the right guaranteed by Article 8. There is therefore a greater need for scrutiny by the Court and an exception to the rule which denies individuals the right to challenge a law in abstracto is justified. In such cases the individual does not need to demonstrate the existence of any risk that secret surveillance measures were applied to him. By contrast, if the national system provides for effective remedies, a widespread suspicion of abuse is more difficult to justify. In such cases, the individual may claim to be a victim of a violation occasioned by the mere existence of secret measures or of legislation permitting secret measures only if he is able to show that, due to his personal situation, he is potentially at risk of being subjected to such measures.

In the instant case, the contested legislation directly affected all users of the mobile telephone services, since it instituted a system of secret surveillance under which any person using the mobile telephone services of national providers could have their mobile telephone communications intercepted, without ever being notified of the surveillance. Furthermore, the domestic law did not provide for effective remedies for persons suspecting they had been subjected to secret surveillance. An examination of the relevant legislation in abstracto was therefore justified. The applicant did not need to demonstrate that due to his personal situation he had been at risk of being subjected to secret surveillance. He was thus entitled to claim to be the victim of a violation of the Convention.

Conclusion : preliminary objection dismissed (unanimously).

(b) Merits – The mere existence of the contested legislation amounted in itself to an interference with the exercise of the applicant’s rights under Article 8. The interception of mobile telephone communications had a basis in the domestic law and pursued the legitimate aims of the protection of national security and public safety, the prevention of crime and the protection of the economic well-being of the country. It remained to be ascertained whether the domestic law was accessible and contained adequate and effective safeguards and guarantees to meet the requirements of “foreseeability” and “necessity in a democratic society”.

(i) Accessibility – It was common ground that almost all the domestic legal provisions governing secret surveillance had been officially published and were accessible to the public. Although there was some dispute over the accessibility of further provisions, the Court noted that they had been published in an official ministerial magazine and could be accessed through an internet legal database, and so did not find it necessary to pursue the issue further.

(ii) Scope of application of secret surveillance measures – The nature of the offences which could give rise to an interception order was sufficiently clear. However, it was a matter of concern that the domestic law allowed secret interception of communications in respect of a very wide range of offences. Furthermore, interception could be ordered not only in respect of a suspect or an accused, but also in respect of persons who might have information about an offence. While the Court had found in a previous case* that interception measures in respect of a person possessing information about an offence might be justified under Article 8, it noted in the instant case that the domestic law did not clarify who might fall into that category in practice. Nor did the law give any indication of the circumstances under which communications could be intercepted on account of events or activities endangering Russia’s national, military, economic or ecological security. Instead, it left the authorities an almost unlimited discretion in determining which events or acts constituted such a threat and whether the threat was serious enough to justify secret surveillance. This created possibilities for abuse.

(iii) Duration of secret surveillance measures – While the domestic law contained clear rules on the duration and renewal of interceptions providing adequate safeguards against abuse, the relevant provisions on discontinuation of the surveillance measures did not provide sufficient guarantees against arbitrary interference.

(iv) Procedures for, inter alia , storing and destroying intercepted data – Domestic law contained clear rules governing the storage, use and communication of intercepted data, making it possible to minimise the risk of unauthorised access or disclosure. However, although the Court considered reasonable the six-month time-limit applicable to the storage of intercept material if the person concerned was not charged with a criminal offence, it deplored the lack of a requirement to destroy immediately any data that were not relevant to the purpose for which they were obtained. The automatic storage for six months of clearly irrelevant data could not be considered justified under Article 8.

Further, in cases where the person under surveillance was charged with a criminal offence the trial judge had unlimited discretion under the domestic law to decide whether to order the further storage or destruction of intercept material used in evidence. Ordinary citizens thus had no indication as to the circumstances in which intercept material could be stored. The domestic law was, therefore, not sufficiently clear on this point.

(v) Authorisation of interceptions – As regards the authorisation procedures, any interception of telephone or other communications had to be authorised by a court. However, judicial scrutiny was limited in scope. In particular, materials containing information about undercover agents or police informers or about the organisation and tactics of operational-search measures could not be submitted to the judge and were therefore excluded from the court’s scope of review. Thus the failure to disclose the relevant information to the courts deprived them of the power to assess whether there was a sufficient factual basis for suspecting persons in respect of whom operational-search measures were requested of a criminal offence or of activities endangering national, military, economic or ecological security. Indeed, Russian judges were not instructed to verify the existence of “reasonable suspicion” against the person concerned or to apply the “necessity” and “proportionality” tests.

In addition, the relevant domestic law did not contain any requirements with regard to the content of interception requests or authorisations. As a result, courts sometimes authorised the interception of all telephone communications in an area where a criminal offence had been committed, without mentioning a specific person or telephone number. Some authorisations did not mention the duration for which interception was authorised. Such authorisations granted a very wide discretion to the law-enforcement authorities as to which communications to intercept and for how long.

Furthermore, in cases of urgency it was possible to intercept communications without prior judicial authorisation for up to 48 hours. However, the urgent procedure did not provide sufficient safeguards to ensure that it was used sparingly and only in duly justified cases. The domestic law did not limit the use of the urgent procedure to cases involving immediate serious danger and so gave the authorities unlimited discretion to determine the situations in which it was used, thus creating possibilities for abuse. Furthermore, although under domestic law a judge had to be immediately informed of each instance of urgent interception, the judge’s power was limited to authorising the extension of the interception measure beyond 48 hours. Russian law thus did not provide for an effective judicial review of the urgent procedure.

In sum, the authorisation procedures provided for by Russian law were not capable of ensuring that secret surveillance measures were not ordered haphazardly, irregularly or without due and proper consideration.

An added difficulty was that law-enforcement authorities generally had no obligation under the domestic law to show judicial authorisation to the communications service provider before obtaining access to communications, while for their part the service providers were required to install equipment giving the authorities direct access to all users’ mobile telephone communications. The system was therefore particularly prone to abuse.

(vi) Supervision – The prohibition set out in domestic law on logging or recording interceptions made it impossible for the supervising authority to discover interceptions carried out without proper judicial authorisation. Combined with the authorities’ technical ability to intercept communications directly, this provision rendered any supervisory arrangements incapable of detecting unlawful interceptions and was therefore ineffective.

Where interceptions were carried out on the basis of proper judicial authorisation, judicial supervision was limited to the initial authorisation stage. Subsequent supervision was entrusted to the President, Parliament, the Government, the Prosecutor General and competent lower-level prosecutors. The domestic law did not set out the manner in which the President, Parliament and the Government were to supervise interceptions. There were no publicly available regulations or instructions describing the scope of their review, the conditions under which it could be carried out, or the procedures for reviewing the surveillance measures or remedying breaches.

While a legal framework provided, at least in theory, for some supervision by prosecutors, it was not capable in practice of providing adequate and effective guarantees against abuse. In particular:

– there were doubts about the prosecutors’ independence as they were appointed and dismissed by the Prosecutor General after consultation with the regional executive authorities and had overlapping functions as they both approved requests for interception and then supervised their implementation;

– there were limits on the scope of their supervision (prosecutors had no information about the work of undercover agents and surveillance measures related to counter-intelligence escaped their supervision as the persons concerned would be unaware they were subject to surveillance and were thus unable to lodge a complaint);

– there were limits on their powers, for example, even though they could take measures to stop or remedy breaches and to bring those responsible to account, there was no specific provision requiring destruction of unlawfully obtained intercept material;

– their supervision was not open to public scrutiny and knowledge as their reports were not published or otherwise accessible to the public;

– the Government had not submitted any inspection reports or decisions by prosecutors ordering the taking of measures to stop or remedy a detected breach of law.

(vii) Notification of interception and available remedies – Persons whose communications were intercepted were not notified. Unless criminal proceedings were opened against the interception subject and the intercepted data was used in evidence, the person concerned was unlikely ever to find out if his or her communications had been intercepted.

Persons who did somehow find out could request information about the data concerned. However, in order to lodge such a request they had to be in possession of the facts of the operational-search measures to which they were subjected. Access to information was thus conditional on a person’s ability to prove that his or her communications had been intercepted. Furthermore, interception subjects were not entitled to obtain access to documents relating to the interception of their communications: they were at best entitled to receive “information” about the collected data. Such information was provided only in very limited circumstances, namely if the person’s guilt had not been proved in accordance with law and the information did not contain State secrets. Since, under Russian law, information about the facilities used in operational-search activities, the methods employed, the officials involved and the data collected constituted a State secret, the possibility of obtaining information about interceptions appeared ineffective.

The judicial remedies referred to by the Government were available only to persons in possession of information about the interception of their communications. Their effectiveness was therefore undermined by the absence of a requirement to notify the interception subject or of an adequate possibility to request and obtain information about interceptions from the authorities. Accordingly, Russian law did not provide an effective judicial remedy against secret surveillance measures in cases where no criminal proceedings were brought against the interception subject.

In sum, the domestic legal provisions governing the interception of communications did not provide adequate and effective guarantees against arbitrariness and the risk of abuse. The domestic law did not meet the “quality of law” requirement and was incapable of keeping the “interference” to what was “necessary in a democratic society”.

Conclusion : violation (unanimously).

Article 41: Finding of a violation constituted sufficient just satisfaction for any non-pecuniary damage.

(See Weber and Saravia v. Germany (dec.), 54934/00, 29 June 2006, Information Note 88 ; Kennedy v. the United Kingdom , 26839/05, 18 May 2010, Information Note 130 ; see, more generally, the Handbook on European data protection law )

* Iordachi and Others v. Moldova , 25198/02, 10 February 2009, Information Note 116 .

© Council of Europe/European Court of Human Rights This summary by the Registry does not bind the Court.

Click here for the Case-Law Information Notes