FIRST SECTION

Application no. 2309/10 Marie RINGLER against Austria lodged on 12 January 2010

STATEMENT OF FACTS

The applicant, Ms Marie Ringler , is an Austrian national, who lives in Vienna. She is represented before the Court by Ms M. Windhager , a lawyer practising in Vienna.

A. The circumstances of the case

The facts of the case, as submitted by the applicant, may be summarised as follows.

On 1 January 2008 Federal Law no. 114/2007 containing an amendment to the Police Powers Act ( Sicherheitspolizeigesetz ) entered into force. Among other measures, its section 53(3a) and (3b) extended the powers of the police authorities to request personal data of telephone/mobile phone and internet users from telecommunications providers.

The applicant is a member of the Vienna Regional Parliament. She does not claim that any of these measures have in fact been ordered or implemented against her, nor that she has been affected by measures directed against other persons. However, she contends that she hosts a website and is as such considered as a provider of telecommunications services and may therefore be required to give information under 53(3a) of the Police Powers Act. Moreover, as an internet and mobile phone user she may be subjected to measures under section 53(3a) and (3b) at any point in time without prior or subsequent notification and without having any effective remedy at her disposal.

The applicant lodged a complaint under Article 140 of the Federal Constitution ( Bundes-Verfassungsgesetz ) with the Constitutional Court requesting it to review the constitutionality of section 53(3a) and (3b) of the Police Powers Act.

On 1 July 2009 the Constitutional Court rejected the applicant ’ s complaint as being inadmissible. It noted that only persons with whose rights a law interfered directly, without being applied through a decision of a court or an administrative authority, had the right to lodge a complaint under Article 140 of the Federal Constitution.

In so far, as the applicant claimed that she was required to give certain information as a provider of telecommunications services, the Constitutional Court held that although section 53(3a) of the Police Powers Act did not contain any new obligations to store data it contained an obligation to provide certain types of information. It accepted that in so far as section 53(3a) obliged the applicant, as a provider of telecommunication services, to give information it interfered with her rights. However, if such information was actually requested she had a remedy, namely a complaint to the Independent Administrative Panel under section 88 of the Police Powers Act at her disposal. She was therefore not directly affected.

In so far as she had asserted that she was a mobile phone and internet user and was therefore likely to be affected by section 53(3a) and (3b) of the Police Powers Act, the Constitutional Court referred to its decision of 1 July 2009 in a similar case (see the summary of that decision in the case of Tretter and Others v. Austria , no. 3599/10).

The Constitutional Court ’ s decision was served on the applicant on 15 July 2009.

B. Relevant domestic law

1. The Police Powers Act

The Police Powers Act ( Sicherheitspolizeigesetz ) regulates the tasks and powers of the police authorities for providing assistance in case of immediate threats to life, limb, security or property of persons ( erste allgemeine Hilfeleistungspflicht ) and for maintaining public peace, order and security ( Aufrechterhaltung der öffentlichen Ruhe , Ordung und Sicherheit ).

The police authorities are the Federal Minister for the Interior, the Regional Security Authorities ( Sicherheitsdirektionen ), the Federal Police Authorities ( Bundespolizeidirektionen ) and the District Administrative Authorities ( Bezirksverwaltungsbehörden ).

In the context of their task of maintaining public security, the police authorities inter alia have to assess and avert dangers ( allgemeine Gefahren ) emanating from criminal organisations or from the commission or preparation of intentional criminal offences under the Criminal Code, the National Socialism Prohibition Act, the Aliens Police Act or the Drugs Offences Act (section 21(1) read in conjunction with section 16). Moreover, they have to carry out the observation of groups, if in view of their structures and developments in their sphere, there is reason to believe that criminal offences presenting a serious danger to public security, in particular acts of religiously or ideologically motivated violence might be committed (section 21(3)). Further tasks in the context of maintaining public security include the protection of the constitutional institutions of the Republic, the protection of the representatives of foreign States or international organisations or the protection of persons (in particular of persons who may give information about criminal organisations or about the preparation or commission of criminal offences) (section 22). A further task is the search for wanted persons (section 24).

Sections 51 to 54 of the Police Powers Act regulate the police authorities ’ powers to collect, process and transmit personal data ( personenbezogene Daten ). When using such data they have to respect the general principle of proportionality. They may only use data in so far as is necessary for the fulfilment of their tasks. The provisions of the Data Protection Act apply unless explicitly provided otherwise.

a. Section 53

Section 53(3a) allows the police authorities to request the providers of public telecommunications services and of services under the E-Commerce Act, to disclose the name, address and number of a specific telephone connection, the IP-address relating to a specific message and the time of its transmission and the name and address of the user to whom an IP-address was attributed at a specific point in time, if specific facts give reason to believe that there is a situation of danger and the data are required for the fulfilment of their tasks. Providers are obliged to give the requested information without delay and free of cost.

Section 53(3b) allows the police authorities – if specific facts give reason to believe that there is an immediate danger for the life of health of a person – to request the providers of public telecommunications services to provide the location data and the international mobile phone user code (IMSI) of the mobile phone or other terminal carried by that person and to use technical devices to locate it. The police authority is responsible for the lawfulness of the request and has to provide documentation of the request to the operator within 24 hours.

Further amendments to sections 53(3a) and (3b) were introduced by Federal Law no. 33/2011: inter alia the police authorities are now obliged to inform the person concerned by a request under 53(3a) to disclose the name and address of the user to whom an IP-address was attributed at a specific point in time / the person concerned by a request under 53(b) to provide location data if particular types of stored data ( Vorratsdaten ) were required to answer the request. The information may be delayed for as long as the purpose of the measure would be jeopardised by disclosure.

b. Sections 91a to 91d

Pursuant to section 91a the Federal President (upon the proposal of the Government and after having heard the President of Parliament as well as the Presidents of the Constitutional Court and the Administrative Court) appoints a legal protection commissioner ( Rechtsschutzbeauftragter ) and two deputies at the Federal Ministry of the Interior. They are nominated for a five-year term and may be re-appointed. In the exercise of their functions they are independent and are not bound by any instructions.

Section 91b requires the legal protection commissioner and the two deputies to have specific experience and knowledge of human rights and to have at least five years ’ experience in a legal profession. The Minister for the Interior has to provide them with the staff and equipment necessary for the fulfilment of their tasks.

Pursuant to Section 91c, the police authorities have

- to inform the legal protection commissioner about requests made under section 53(3a) and (3b) and 54(4b).

- to inform the legal protection commissioner of the collection of personal data through covert investigations under section 54(3) or through covert audio and video recordings under section 54(4) and to give reasons for use of these measures;

- to obtain prior authorisation from the legal protection commissioner if they intend to use covert investigations under section 54(3) or covert audio and video recordings under section 54(4) in the context of the observation of groups under section 21(3);

- to inform the Federal Minister of the Interior about their intention to carry out an operative and strategic analysis of personal data pursuant to section 53a(2). The Minister has to give the legal protection commissioner the possibility to comment within three days. The operative or strategic analysis of personal data may not be carried out before the expiry of this time-limit.

Section 91d obliges the police authorities to give the legal protection commissioner access to all their documents and recordings and to provide him with any information necessary for the fulfilment of his tasks, with the exception of information or documents relating to the identity of persons or sources, whose disclosure would constitute a danger for national security or for the security of persons.

The legal protection commissioner may supervise the implementation of measures enumerated in section 91c at any time and has to have access to all areas in which recordings or results of investigations are stored. Moreover, he has to ensure that the police authorities comply with their duty to correct or delete data as required by section 63 or other specific provisions requiring them to delete data.

If the legal protection commissioner considers that the use of personal data has breached the rights of an individual, who does not have knowledge of that use, he may inform the person concerned or, if this is not possible pursuant to section 26(2) of the Data Protection Act, lodge a complaint with the Data Protection Commission. An amendment by Federal Law no. 33/2011 now makes it clear that the legal protection commissioner, in case he perceives a breach of an individual ’ s rights, has a duty to inform the person concerned or to lodge a complaint with the Data Protection Commission, respectively.

The legal protection commissioner submits a yearly activity report to the Minister of the Interior. Upon request, the competent sub-committee of the Parliamentary Committee for the Interior has to be given access to this report.

2. The Data Protection Act

Section 1 of the Data Protection Act ( Datenschutzgesetz 2000, Federal Law no. 165/1999) guarantees the right to confidentiality of personal data, insofar as there is a legitimate interest in their non-disclosure. Personal data are defined as data relating to an identified or identifiable individual.

Section 24(1) of the Data Protection Act regulates the duty of anyone who requests the processing of personal data, including public authorities, to inform the person concerned of the purpose for which the data were collected and to indicate the name and address of the person or entity having made the request. However, pursuant to section 24(3), the person concerned does not have to be informed, if data are obtained by transmission from another person or entity which is provided for by law. Further exceptions from the obligation to inform the person concerned of t he processing of personal data are contained in section 24(4). They cover inter alia the processing of data for the prevention and prosecution of criminal offences if providing the information would endanger the purpose of the use of the data.

Section 26(1) contains the obligation for anyone who has requested the processing of personal data, including public authorities, to give detailed information to the person concerned on the personal data used (nature of data, their source, transmission to third persons, the purpose of the processing and its legal basis). The person concerned has to make a written request. Pursuant to section 26(2) such information is to be withheld inter alia , if legitimate public interests would be violated by the disclosure. Such legitimate public interests may for instance arise in the context of the protection of the constitutional institutions of the Republic or in the interests of the prevention or prosecution of criminal offences.

Pursuant to section 27 anyone who has requested the processing of personal data, including public authorities, has to rectify incorrect data and to delete data which were unlawfully obtained, either ex officio or upon a request of the person concerned.

COMPLAINTS

1. The applicant complained under Article 8 of the Convention that the powers provided to the police authorities under section 53(3a) and (3b) of the Police Powers Act to request personal data of telephone/mobile phone and internet users from telecommunications providers entailed by their very existence an interference with her right to respect for her private life and correspondence.

She submitted that the interference with her right to respect for her private life was not “in accordance with the law” as required by Article 8 § 2 as the contested provisions of the Police Powers Act failed to fulfil the criteria of “foreseeability” and compliance with the rule of law developed by the Court ’ s case law in respect of the collection and processing of personal data without the knowledge of the person concerned. In particular the conditions under which the police authorities could make use of their powers were broadly defined in section 53(3a) and (3b) and there were no sufficient safeguards against abuse.

Furthermore, the interference resulting from the impugned provisions of the Police Powers Act was not “necessary in a democratic society” within the meaning of Article 8 § 2 as it was disproportionate. In particular the same police authorities who wished to collect or use the personal data under section 53(3a) and (3b) decided on whether the conditions for doing so were met. There was no independent control and, as a rule, no subsequent information of the person concerned.

2. Furthermore, the applicant complained under Article 13 of the Convention that she did not dispose of any effective remedy in respect of the alleged violation of Article 8. She asserted in particular that persons concerned by measures under section 53(3a) and (3b) of the Police Powers Act were, as a rule, not informed of the collection or processing of their personal data even if there was no, or no longer, an interest in secrecy. Consequently, none of the remedies provided for in the Data Protection Act were available to her.

In particular section 26 of the Data Protection Act presupposed that the person concerned had been informed about the collection or processing of data by a specific authority. The person concerned was then able to request detailed information about the use of his or her data from that authority. However, a person suspecting that the police authorities had made use of their powers under section 53(3a) or (3b) could not be expected to request a multitude of police authorities if they had collected or processed his or her personal data.

QUESTIONS TO THE PARTIES

1. May the applicant claim to be the victim of a violation of the Convention, within the meaning of Article 34 in that the legislation in issue amounts in itself to an interference with the exercise of her rights under Article 8 of the Convention?

2. Is the alleged interference in accordance with the law and necessary in terms of Article 8 § 2 of the Convention? In particular, does the applicable law meet the requirement of lawfulness within the meaning of Article 8 § 2? Is it sufficiently foreseeable and compatible with the rule of law? Does the law contain adequate and effective safeguards against possible abuse?

3. Does the applicant have at her disposal effective domestic remedies for her complaint under Article 8, as required by Article 13 of the Convention? In particular, would the applicant be notified of the use of her personal data under section 53(3a) or (3b) of the Police Powers Act? Which remedies are available to the applicant once she has been notified?