Mass Surveillance of Personal Data by EU Member States and Its
Total Page:16
File Type:pdf, Size:1020Kb
Mass Surveillance of Personal Data by EU Member States and its Compatibility with EU Law Didier Bigo, Sergio Carrera, Nicholas Hernanz, Julien Jeandesboz, Joanna Parkin, Francesco Ragazzi and Amandine Scherrer No. 62 / November 2013 Abstract In the wake of the disclosures surrounding PRISM and other US surveillance programmes, this paper assesses the large-scale surveillance practices by a selection of EU member states: the UK, Sweden, France, Germany and the Netherlands. Given the large-scale nature of these practices, which represent a reconfiguration of traditional intelligence gathering, the paper contends that an analysis of European surveillance programmes cannot be reduced to a question of the balance between data protection versus national security, but has to be framed in terms of collective freedoms and democracy. It finds that four of the five EU member states selected for in-depth examination are engaging in some form of large-scale interception and surveillance of communication data, and identifies parallels and discrepancies between these programmes and the NSA-run operations. The paper argues that these programmes do not stand outside the realm of EU intervention but can be analysed from an EU law perspective via i) an understanding of national security in a democratic rule of law framework where fundamental human rights and judicial oversight constitute key norms; ii) the risks posed to the internal security of the Union as a whole as well as the privacy of EU citizens as data owners and iii) the potential spillover into the activities and responsibilities of EU agencies. The paper then presents a set of policy recommendations to the European Parliament. This study was commissioned as a Briefing Paper by the European Parliament's Committee on Civil Liberties, Justice and Home Affairs. The original document entitled “National Programmes of Mass Surveillance of Personal Data in the EU Member States and their Compatibility with EU Law”, can be downloaded from the European Parliament’s website (www.europarl.europa.eu/studies). It is republished by the Centre for European Policy Studies with the kind permission of the European Parliament. CEPS Papers in Liberty and Security in Europe offer the views and critical reflections of CEPS researchers and external collaborators on key policy discussions surrounding the construction of the EU’s Area of Freedom, Security and Justice. The series encompasses policy-oriented and interdisciplinary academic studies and commentary about the internal and external implications of Justice and Home Affairs policies inside Europe and elsewhere throughout the world. Unless otherwise indicated, the views expressed are attributable only to the authors in a personal capacity and not to any institution with which they are associated. This publication may be reproduced or transmitted in any form for non-profit purposes only and on the condition that the source is fully acknowledged. ISBN 978-94-6138-364-8 Available for free downloading from the CEPS website (http://www.ceps.eu) ©CEPS, 2013 Contents Executive Summary ...................................................................................................................................... i Introduction .................................................................................................................................................. 1 1. Controversy between the actors about the scale of the problem .............................................................. 5 1.1 Large-scale electronic surveillance in democracies: Compatibility or not? ...................................... 5 1.1.1 Surveillance, Intelligence services and democracy ................................................................ 6 1.1.2 Large-scale surveillance and mass surveillance: What is at stake? ......................................... 7 1.2 Political and ethical controversies regarding the use of these technologies by intelligence services: The question of legitimacy ............................................................................................... 9 1.2.1 The position of the security services ..................................................................................... 9 1.2.2 The position of the other actors .......................................................................................... 10 2. EU member state practices in the context of the revelations of NSA large-scale operations .................. 12 2.1 Technical features ........................................................................................................................ 13 2.2 Scale ............................................................................................................................................ 14 2.3 Data types and data targets ........................................................................................................... 14 2.4 Processing and analysis of data .................................................................................................... 15 2.5 Cooperation between national and international security actors .................................................... 16 2.6 Legal regimes and oversight ......................................................................................................... 17 3. Legal modalities of action at EU level and compatibility with EU law ................................................. 19 3.1 National security and democratic rule of law ................................................................................ 20 3.1.1 National Security and the ECHR ........................................................................................ 21 3.1.2 National security and the EU Charter of Fundamental Rights .............................................. 24 3.2 Whose security? Sincere cooperation and citizens’ liberties compromised .................................... 25 3.3 Home affairs agencies .................................................................................................................. 27 4. Conclusions and recommendations: Implications of large-scale surveillance for freedom, fundamental rights, democracy and sovereignty in the EU ................................................................... 29 4.1 General conclusions ..................................................................................................................... 29 4.2 Policy recommendations .............................................................................................................. 32 Academic references ................................................................................................................................... 37 ANNEX The EU Member States’ Practices in the context of the Revelations of Large-Scale Surveillance Operations by the NSA .................................................................................................... 39 1. The United Kingdom ....................................................................................................................... 39 2. Sweden............................................................................................................................................ 45 3. France ............................................................................................................................................. 48 4. Germany ......................................................................................................................................... 52 5. The Netherlands .............................................................................................................................. 57 Mass Surveillance of Personal Data by EU Member States and its Compatibility with EU Law Didier Bigo, Sergio Carrera, Nicholas Hernanz, Julien Jeandesboz, Joanna Parkin, Francesco Ragazzi and Amandine Scherrer CEPS Paper in Liberty and Security in Europe No. 61 / November 2013 Executive Summary Surveillance of population groups is not a new phenomenon in liberal regimes and the series of scandals surrounding the surveillance programmes of the National Security Agency (NSA) in the US and the UK’s Government Communications Headquarters (GHCQ) only reminds us of the recurrence of transgressions and illegal practices carried out by intelligence services. However, the scale of surveillance revealed by Edward Snowden should not be simply understood as a routine practice of intelligence services. Several aspects emerged from this series of revelations that directly affect EU citizens’ rights and EU institutions’ credibility in safeguarding those rights. First, these revelations uncover a reconfiguration of surveillance that enables access to a much larger scale of data than telecommunications surveillance of the past. Progress in technologies allows a much larger scope for surveillance, and platforms for data extraction have multiplied. Second, the distinction between targeted surveillance for criminal investigation purposes, which can be legitimate if framed according to the rule of law, and large-scale surveillance with unclear objectives is increasingly blurred. It is the purpose and the scale of surveillance that are precisely at the core of what differentiates democratic regimes from police states. Third, the intelligence services have not yet provided acceptable answers to the recent accusations directed at them. This raises the issue of accountability of intelligence services and their private-sector partners and reinforces