FIRST SECTION

Application no. 3599/10 Hannes TRETTER and O thers against Austria lodged on 15 January 2010

STATEMENT OF FACTS

The applicants, Mr Hannes Tretter and twenty-three others are represented before the Court by Mr E. Scheucher , a lawyer practising in Vienna. They are all Austrian nationals and one company with seat in Austria, respectively. The list of applicants is annexed to this statement of facts.

A. The circumstances of the case

The facts of the case, as submitted by the applicants, may be summarised as follows.

On 1 January 2008 Federal Law no. 114/2007 containing an amendment to the Police Powers Act ( Sicherheitspolizeigesetz ) entered into force. It extended the powers of the police authorities to request personal data of telephone/mobile phone and internet users from telecommunications providers, to collect and process personal data of suspects and certain other categories of persons for the purposes of operative or strategic analysis and to carry out covert investigations and to make covert audio and video recordings.

The applicants, who are university professors of human rights law or constitutional law, practicing lawyers, judges, doctors, accountants, employees, businessmen and a journalist by profession, do not claim that any of these measures have in fact been ordered or implemented against them, nor that they have been affected by measures directed against other persons. They contend that under the law as it stands they may be subjected to such measures at any point in time without prior or subsequent notification and without having any effective remedy at their disposal. They submit in particular that each of them has a mobile and/or landline phone and an internet access with an IP-address and is likely in his or her respective profession to deal with confidential data and to come within the scope of measures under the Police Powers Act .

The applicants lodged a complaint under Article 140 of the Federal Constitution ( Bundes-Verfassungsgesetz ) with the Constitutional Court ( Verfassungsgerichtshof ) requesting it to review the constitutionality of section 53(1), (3a), (3b) and (4), of section 53a(1) and (2) section 54(2), (3), (4) and (4b) of the Police Powers Act and of section 24 of the Data Protection Act ( Datenschutzgesetz 2000 ).

On 1 July 2009 the Constitutional Court rejected the applicants ’ complaint as being inadmissible. It noted that only persons with whose rights a law interfered directly, without being applied through a decision of a court or an administrative authority, had the right to lodge a complaint under Article 140 of the Federal Constitution. The applicants had not claimed that the police authorities had requested any information about them or taken any measures against them under the contested provisions. They had merely asserted that they were likely to be affected by these provisions as they were mobile phone and internet users and exercised certain professions. In the Constitutional Court ’ s view this was not enough to show that they were directly affected by the said provisions.

Referring to the case-law of the European Court of Human Rights ( Klass and Others v. Germany , 6 September 1978, Series A no. 28, and Weber and Saravia v. Germany ( dec. ), no. 54934/00 , ECHR 2006 ‑ XI), the Constitutional Court observed that section 53(3a) and (3b) of the Police Powers Act did not regulate secret surveillance of communications but merely empowered the police authorities to obtain specific information about telephone or internet users from providers of telecommunication services. The applicants ’ complaint in respect of these provisions was inadmissible on that ground alone.

Furthermore, in case the applicants had reason to believe that their data had been requested or processed by the police authorities on the basis of the contested provisions, they had remedies under the Data Protection Act at their disposal, in particular the right to obtain information and the right to request the destruction of data under sections 26 and 27 of that said Act.

Finally, the Constitutional Court observed that a system of safeguards was in place: pursuant to section 91c of the Police Powers Act the police authorities had to inform the legal protection commissioner ( Rechtsschutz-beauftragter ) of the reasons for any measures of covert investigations and surveillance through covert audio and video recordings under section 54(3) and (4) of the Police Powers Act. In certain cases they had to obtain prior authorisation from the legal protection commissioner for the use of such measures.

They also had to notify him of any request for information about telephone or internet users under section 53(3a) and (3b) and about measures of tracing motor vehicles under section 54(4b) of the said Act.

The Minister for the Interior had to be notified without delay of measures under section 53a(2) of the Police Powers Act, i.e. of the processing of personal data for operational or strategic analysis. In turn, the Minister had to inform the legal protection commissioner, who could comment within three days.

In cases in which the legal protection commissioner considered that an individual ’ s right had been violated by the use of personal data he could inform the person concerned or, where that was not possible pursuant to section 26(2) of the Data Protection Act, he could lodge a complaint with the Data Protection Commission.

Finally, the Constitutional Court also rejected the applicants ’ complaint under section 24 of the Data Protection Act, referring to the reasons set out in respect of the contested provisions of the Police Powers Act.

The Constitutional Court ’ s decision was served on the applicants ’ counsel on 15 July 2009.

B. Relevant domestic law and practice

1. The Police Powers Act

The Police Powers Act ( Sicherheitspolizeigesetz ) regulates the tasks and powers of the police authorities for providing assistance in case of immediate threats to life, limb, security or property of persons ( erste allgemeine Hilfeleistungspflicht ) and for maintaining public peace, order and security ( Aufrechterhaltung der öffentlichen Ruhe , Ordung und Sicherheit ).

The police authorities are the Federal Minister for the Interior, the Regional Security Authorities ( Sicherheitsdirektionen ), the Federal Police Authorities ( Bundespolizeidirektionen ) and the District Administrative Authorities ( Bezirksverwaltungsbehörden ).

In the context of their task of maintaining public security, the police authorities inter alia have to assess and avert dangers ( allgemeine Gefahren ) emanating from criminal organisations or from the commission or preparation of intentional criminal offences under the Criminal Code, the National Socialism Prohibition Act, the Aliens Police Act or the Drugs Offences Act (section 21(1) read in conjunction with section 16). Moreover, they have to carry out the observation of groups, if in view of their structures and developments in their sphere, there is reason to believe that criminal offences presenting a serious danger to public security, in particular acts of religiously or ideologically motivated violence might be committed (section 21(3)). Further tasks in the context of maintaining public security include the protection of the constitutional institutions of the Republic, the protection of the representatives of foreign States or international organisations or the protection of persons (in particular of persons who may give information about criminal organisations or about the preparation or commission of criminal offences) (section 22). A further task is the search for wanted persons (section 24).

Sections 51 to 54 of the Police Powers Act regulate the police authorities ’ powers to collect, process and transmit personal data ( personenbezogene Daten ). When using such data they have to respect the general principle of proportionality. They may only use data in so far as is necessary for the fulfilment of their tasks. The provisions of the Data Protection Act apply unless explicitly provided otherwise.

Unless indicated otherwise the description of sections 53, 53a and 54 below refers to the version which was introduced by the Federal Law no. 114/2007.

a. Section 53

Section 53 (1) of the Police Powers Act allows the police authorities to collect and process personal data for providing assistance in case of immediate threats to life, limb, security or property of persons, for the defence against criminal organisations, for the observations of groups as defined in section 21(3) of the Act, for the prevention of dangers as defined in section 16, i.e. dangers emanating from the preparation or commission of criminal offences, for searches of wanted persons and for the preservation of order at specific events.

Section 53(3a) allows the police authorities to request the providers of public telecommunications services and of services under the E-Commerce Act, to disclose the name, address and number of a specific telephone connection, the IP-address relating to a specific message and the time of its transmission and the name and address of the user to whom an IP-address was attributed at a specific point in time, if specific facts give reason to believe that there is a situation of danger and the data are required for the fulfilment of their tasks. Providers are obliged to give the requested information without delay and free of cost.

Section 53(3b) allows the police authorities – if specific facts give reason to believe that there is an immediate danger for the life of health of a person – to request the providers of public telecommunications services to provide the location data and the international mobile phone user code (IMSI) of the mobile phone or other terminal carried by that person and to use technical devices to locate it. The police authority is responsible for the lawfulness of the request and has to provide documentation of the request to the operator within 24 hours.

Section 53(4) allows the police authorities to collect personal data for all purposes listed in paragraph 1, from any available source with appropriate means, in particular through access to publicly available sources, and to process them.

However, dragnet investigations ( Rasterfahndung ) within the meaning of section 141 of the Code of Criminal Procedure are not allowed (section 53(2)).

Further amendments to sections 53(3a) and (3b) were introduced by Federal Law no. 33/2011: inter alia the police authorities are now obliged to inform the person concerned by a request under 53(3a) to disclose the name and address of the user to whom an IP-address was attributed at a specific point in time / the person concerned by a request under 53(b) to provide location data if particular types of stored data ( Vorratsdaten ) were required to answer the request. The information may be delayed for as long as the purpose of the measure would be jeopardised by disclosure.

b. Section 53a

Section 53a(1) regulates the processing of data of natural and legal persons, objects and buildings for the purposes of planning, co-ordination and supervision of police operations, such as searches for wanted persons, maintenance of public order at specific events, protection of persons or buildings and assistance in case of immediate threats to life, limb, security or property of persons. In respect of persons affected by the operation at issue the police authorities may process personal data allowing to identify and to contact the person. For wanted persons they may also process their photo and data concerning their physical appearance. In addition further data including registration numbers of motor vehicles, information on date, place and reasons for the operation and other administrative data may be processed.

Section 53a(2) regulates operative and strategic analysis of personal data for the defence against criminal organisations or to prevent dangers emanating from the preparation or commission of criminal offences, if a repetition of the offences is likely in view of their nature. It empowers the police authorities to process – by means of operative or strategic analysis – a broad range of personal data (including not only name, former and alias names, names of the parents, gender, date and place of birth, nationality, place of residence, but also data necessary to provide a personal description and information about a person ’ s profession, occupation and living situation) of the following groups of persons: suspects, victims or persons in respect of whom th ere is reason to believe they may become the victim of an offence punishable with more than one year ’ s imprisonment, witnesses, contact persons (if their contact with the suspect is not just one by coincidence and if there are reasons to believe that information on a suspect may be obtained through them) and informants. They may also use information concerning the specific case and administrative data even if they are sensitive data within the meaning of section 4(2) of the Data Protection Act (which defines data concerning a person ’ s racial or ethnic origin, political opinions, membership in a trade union, religious beliefs or philosophical convictions, health and sexual life as “sensitive data”).

c. Section 54

Section 54(2) allows the police authorities to collect personal data through observation of groups as defined in section 21(3) or in order to prevent a criminal offence against life, health, morals, freedom, property or environment planned by a specific person, while it is still in the stage of preparation or if the defence against a criminal organisation or against the danger emanating from the preparation or commission of a criminal offence would otherwise be considerably more difficult.

Section 54 (3) allows the police authorities to collect information through covert investigations ( verdeckte Ermittlung ) if the defence against a criminal organisation or against the danger emanating from the preparation or commission of a criminal offence would otherwise be considerably more difficult, or if the observation of groups under section 21(3) with other means would be without prospects of success.

Section 54(4) allows the police authorities to collect personal data with the help of covert audio and video recordings if the defence against a criminal organisation or against the danger emanating from the preparation or commission of a criminal offence would otherwise be considerably more difficult, or if the observation of groups under section 21(3) by other means would be without prospects of success. They are not empowered to use audio recording devices in order to record statements which are not made in public and not in the presence of the investigator; they are not empowered either to use video recording devices in order to record conduct outside the public sphere and the sphere within the visual reach of the investigator.

Section 54(4b) allows the police authorities to make use of tracing devices for registration plates of motor vehicles for the purposes of searches for wanted persons. The use of such devices is limited to one month. The data obtained are to be deleted as soon as they are no longer needed for the purpose of the specific search.

d. Sections 91a to 91d

Pursuant to section 91a the Federal President (upon the proposal of the Government and after having heard the President of Parliament as well as the Presidents of the Constitutional Court and the Administrative Court) appoints a legal protection commissioner ( Rechtsschutzbeauftragter ) and two deputies at the Federal Ministry of the Interior. They are nominated for a five-year term and may be re-appointed. In the exercise of their functions they are independent and are not bound by any instructions.

Section 91b requires the legal protection commissioner and the two deputies to have specific experience and knowledge of human rights and to have at least five years ’ experience in a legal profession. The Minister for the Interior has to provide them with the staff and equipment necessary for the fulfilment of their tasks.

Pursuant to Section 91c, the police authorities have

- to inform the legal protection commissioner about requests made under section 53(3a) and (3b) and 54(4b).

- to inform the legal protection commissioner of the collection of personal data through covert investigations under section 54(3) or through covert audio and video recordings under section 54(4) and to give reasons for use of these measures;

- to obtain prior authorisation from the legal protection commissioner if they intend to use covert investigations under section 54(3) or covert audio and video recordings under section 54(4) in the context of the observation of groups under section 21(3);

- to inform the Federal Minister of the Interior about their intention to carry out an operative and strategic analysis of personal data pursuant to section 53a(2). The Minister has to give the legal protection commissioner the possibility to comment within three days. The operative or strategic analysis of personal data may not be carried out before the expiry of this time-limit.

Section 91d obliges the police authorities to give the legal protection commissioner access to all their documents and recordings and to provide him with any information necessary for the fulfilment of his tasks, with the exception of information or documents relating to the identity of persons or sources, whose disclosure would constitute a danger for national security or for the security of persons.

The legal protection commissioner may supervise the implementation of measures enumerated in section 91c at any time and has to have access to all areas in which recordings or results of investigations are stored. Moreover, he has to ensure that the police authorities comply with their duty to correct or delete data as required by section 63 or other specific provisions requiring them to delete data.

If the legal protection commissioner considers that the use of personal data has breached the rights of an individual, who does not have knowledge of that use, he may inform the person concerned or, if this is not possible pursuant to section 26(2) of the Data Protection Act, lodge a complaint with the Data Protection Commission. An amendment by Federal Law no. 33/2011 now makes it clear that the legal protection commissioner, in case he perceives a breach of an individual ’ s rights, has a duty to inform the person concerned or to lodge a complaint with the Data Protection Commission, respectively.

The legal protection commissioner submits a yearly activity report to the Minister of the Interior. Upon request, the competent sub-committee of the Parliamentary Committee for the Interior has to be given access to this report.

2. The Data Protection Act

Section 1 of the Data Protection Act ( Datenschutzgesetz 2000, Federal Law no. 165/1999) guarantees the right to confidentiality of personal data, insofar as there is a legitimate interest in their non-disclosure. Personal data are defined as data relating to an identified or identifiable individual.

Section 24(1) of the Data Protection Act regulates the duty of anyone who requests the processing of personal data, including public authorities, to inform the person concerned of the purpose for which the data were collected and to indicate the name and address of the person or entity having made the request. However, pursuant to section 24(3), the person concerned does not have to be informed, if data are obtained by transmission from another person or entity which is provided for by law. Further exceptions from the obligation to inform the person concerned of t he processing of personal d ata are contained in section 24 (4). They cover inter alia the processing of data for the prevention and prosecution of criminal offences if providing the information would endanger the purpose of the use of the data.

Section 26(1) contains the obligation for anyone who has requested the processing of personal data, including public authorities, to give detailed information to the person concerned on the personal data used (nature of data, their source, transmission to third persons, the purpose of the processing and its legal basis). The person concerned has to make a written request. Pursuant to section 26(2) such information is to be withheld inter alia, if legitimate public interests would be violated by the disclosure. Such legitimate public interests may for instance arise in the context of the protection of the constitutional institutions of the Republic or in the interests of the prevention or prosecution of criminal offences.

Pursuant to section 27 anyone who has requested the processing of personal data, including public authorities, has to rectify incorrect data and to delete data which were unlawfully obtained, either ex officio or upon a request of the person concerned.

COMPLAINTS

1. The applicants complained under Article 8 of the Convention that the powers provided to the police authorities under sections section 53(1), (3a), (3b) and (4), section 53a(1) and (2) as well as under section 54(2), (3), (4) and (4b) of the Police Powers Act, in particular the power to request personal data of telephone/mobile phone and internet users from telecommunications providers, the power to collect and process personal data of suspects and certain other categories of persons for the purposes of operative or strategic analysis and the power to carry out covert investigations and to make covert audio and video recordings entailed by their very existence an interference with their right to respect for their private life and correspondence.

They submitted that the interference with their right to respect for their private life and correspondence was not “in accordance with the law as required” by Article 8 § 2, as the contested provisions of the Police Powers Act failed to fulfil the criteria of “foreseeability” and compliance with the rule of law developed by the Court ’ s case-law. In particular, the powers of the police authorities were very broadly defined and some of the measures lay entirely in the discretion of the police authorities.

Furthermore, the interference resulting from the impugned provisions of the Police Powers Act was not “necessary in a democratic society” within the meaning of Article 8 § 2 as it was disproportionate. The secret measures available to the police authorities were not restricted to the prevention or investigation of criminal offences, but were available for a whole range of police tasks, they potentially affected a large number of persons, the police authorities were given broad powers to process personal data and to link them with data obtained form a variety of other sources. Finally, persons concerned were not notified of the measures at issue even subsequently and did not have effective remedies at their disposal.

2. The applicants complained under Article 10 that the impugned provisions of the Police Powers Act also interfered with their right to freedom of expression. In particular the powers given to the police authorities pursuant to section 53(3a) and (3b) had a “chilling effect” on all users of communication technologies such as mobile phones or e-mails.

3. The applicants complained under Article 13 of the Convention that they did not dispose of any effective remedy in respect of violations of their rights under Articles 8 and 10. They asserted in particular that persons concerned by measures under the impugned provisions of the Police Powers Act are, as a rule, not notified of the collection or processing of their personal data even if there was no, or no longer, an interest in secrecy. Consequently, none of the remedies provided for in the Data Protection Act were available to them.

Furthermore they argued that the control exercised by the legal protection commissioner under section 91c of the Police Powers Act was not sufficient to compensate the lack of individual remedies. While the police authorities had to inform him of certain measures taken under the impugned provisions they did not in all cases have to inform him of the reasons justifying the use of the measure. Moreover, in cases in which he deemed that there had been a violation of an individual ’ s rights, the decision or not to inform the person concerned was in his discretion. It was also in his discretion whether or not to bring a case before the Data Protection Commission.

QUESTIONS TO THE PARTIES

1. May the applicants claim to be victims of a violation of the Convention, within the meaning of Article 34 in that the legislation in issue amounts in itself to an interference with the exercise of their rights under Article 8 and Article 10 of the Convention? In particular may the twenty-third applicant, being a legal person, allege to be affected by the various measures under the Police Powers Act in issue in the present case?

2. Is the alleged interference in accordance with the law and necessary in terms of Article 8 § 2 of the Convention? In particular, does the applicable law meet the requirement of lawfulness within the meaning of Article 8 § 2? Is it sufficiently foreseeable and compatible with the rule of law? Does the law contain adequate and effective saf eguards against possible abuse?

The Government are requested to provide, if available, any official reports or other documents describing the operation of the measures under sections 53, 53a and 54 of the Police Powers Act in practice as well as the exercise of control by the legal protection commissioner (number of measures applied per year, supervision of the implementation of measures by the legal protection commissioner, number of cases in which the legal protection commissioner notifies the persons concerned of measures taken).

3. Is the alleged interference prescribed by law and necessary in terms of Article 10 § 2 of the Convention?

4. Do the applicants have at their disposal effective domestic remedies for their complaints under Articles 8 and 10, as required by Article 13 of the Convention? In particular, would the applicants be notified of the use of their personal data under section 53 and 53a of the Police Powers Act or of any of the covert measures under section 54 of that Act having an impact on them? Which remedies are available to the applicants once they have been notified?