Venice Commission - Report on a rule of law and human rights compliant regulation of spyware
www.venice.coe.int
Disclaimer: this information was gathered by the Secretariat of the Venice Commission on the basis of contributions by the members of the Venice Commission, and complemented with information available from various open sources (academic articles, legal blogs, official information web-sites etc.).
Every effort was made to provide accurate and up-to-date information. For further details please visit our site : https://www.venice.coe.int/
7. Does a post-surveillance notification mechanism exist? Are there any other remedies available for individual targeted by measures of targeted surveillance?
There exist several mechanisms in order to review the use of investigative measures, to control and ensure whether the legal requirements are complied with, as well as to redress situations where this is not the case. For the sake of completeness, ex-ante mechanisms will be mentioned briefly as well. As a form of ex-ante review mechanism, Section 137 para. 1 of the Code of Criminal Procedure provides for a judicial ex-ante approval of most of the investigative measure. The covert monitoring of encrypted messages by installing spy software provided for in the repealed Section 135a leg.cit. would have had to be ordered by the public prosecutor's office on the basis of a court authorisation as well (with even stricter rules in case a room etc. had been intruded). In case of illegal use of an investigative measure (including, theoretically, such spyware), the judge must not give his approval. The competences of the independent legal protection officer (Section 47a para. 4 in connection with Section 147 of the Code of Criminal Procedure) combine ex-ante and ex-post review mechanisms. The legal protection officer is competent to examine and control the order, approval, authorisation and implementation of the investigative measure (Section 147 para. 1 leg.cit.). (S)he may lodge a complaint against the authorisation of certain measures (Section 147 para. 3). This provisions would have also applied to repealed Section 135a leg.cit. The legal protection officer shall be given the opportunity at any time to gain a personal impression of the implementation of an investigative measure pursuant to Section 135a or Section 136 para. 1 lit. 3; for this purpose, he or she shall have access to all files, documents and data. This also applies to the results of an investigative measure (Section 147 para. 3a of the Code of Criminal Procedure). After completion of an investigative measure, the legal protection officer must be given the opportunity to inspect and hear the entire results before they are filed. She/he is also entitled to request the destruction of results or parts thereof (Section 147 para. 4 leg.cit.). The public prosecutor has to store all results of the measures and send them to the court (Section 145 para. 1 leg.cit.). As a form of redress mechanism, any person claiming that an investigative measure was ordered or carried out in violation of the provisions of the Code of Criminal Procedure and, therefore, a subjective right has been violated in the investigation proceedings by the public prosecutor's office may appeal to the court (Section 106 para. 1 of the Code of Criminal Procedure, "objection due to infringement of rights"). Furthermore, as for compensation for damages, the federal government is liable, inter alia, for pecuniary damage caused by the surveillance of persons pursuant to Section 136 para. 1 no. 3 (optical/acoustic surveillance in case of crimes punishable by more than 10 years' imprisonment, among others). This would have applied to surveillance of encrypted messages pursuant to repealed Section 135a as well.
Article 2, § 3, de la L.R&S dispose que le dirigeant du service informe par écrit la personne
In accordance with Article 119 of the CPC, the judge for preliminary proceedings shall, without delay, a after taking the actions referred to in Article 116 of this law, notify the person against whom it is committed action was taken. The person against whom the measure was taken can request the Court examination of the legality of the order and the manner in which the measure was implemented.
The Personal Data Protection Act mandates secure handling of personal data, with timely breach notification requirements to relevant authorities and affected individuals.
In the criminal law context, sections 196 and 196.1 of the Criminal Code provide requirements for after-the-fact written notice to be provided to persons whose private communications have been intercepted pursuant to an authorization or in warrantless situations of urgency where there is imminent risk of harm. Further, while not a “notification mechanism”, the constitutionally required disclosure process in criminal proceedings may also provide information to an accused person about investigative measures that were taken against them during the course of a criminal investigation.
The Croatian Ombudsman handles human rights complaints regarding misuse of surveillance powers and can review the constitutionality of actions by government bodies, including the police. Moreover, the State Administration System Act allows individuals harmed by illegal or improper state surveillance to seek compensation through civil courts. This objective liability framework applies regardless of fault, based on a causal link between state actions and damage.
As a general rule, the individual in question must be notified once data reading is completed together with notification of the character of the suspected criminal activity in question. However, if such notification would be harmful to the investigation of the case, notification may be delayed or even not done at all. Decision on this is made by the court at the request of the police.
Yes, there is a general task to inform the persons whose data has been collected, but with exceptions. In practice, the post-surveillance mechanisms in the security services are mainly not functioning as the authorities consider such post-surveillance mechanism to lead to dangers which are considered as exceptional circumstances. See also § 29 of the Security Authorities Act. In criminal proceedings, the notification is made during the court procedure as all evidence has to be made available to the person concerned. See also § 126 13 of the Criminal Procedure Code.
Section 60 of the Coercive Measures Act provides on giving notice of the use of covert coercive measures; Section 20 of the Act on the Use of Network Traffic Intelligence in Civilian Intelligence provides on the notification of the use of network traffic intelligence; and Section 89 of the Act on Military Intelligence provides on the notification of the use of intelligence collection methods. Individuals can file investigation requests and complaints to the Intelligence Ombudsman. The complainant will receive a response to the complaint, but the content of the response should be considered on a case-by-case basis. Furthermore,
Individuals can challenge surveillance legality through administrative courts or the independent oversight body. Ex-Ante and ex-Post oversight are conducted by judiciary bodies, the National Commission on Informatics and Liberty (Commission nationale de l'informatique et des libertés), the Defender of Rights (Défenseur des Droits), and the CNCTR to ensure compliance with constitutional requirements. All records of surveillance must be documented, secured, and destroyed once irrelevant to an investigation, ensuring only pertinent information is retained. Affected individuals can seek legal review of surveillance operations if they believe they were targeted unlawfully.
On one hand, Section 101 of the Code of Criminal Procedure prescribes a notification mechanism of targeted surveillance measures in the framework of criminal proceedings. On the other hand, Section 59 of the Federal Intelligence Service Act and section 12 of the Article 10 Act regulates a system of notification in cases of targeted surveillance carried out by security services.
Article 4 para. 3 of law 5002/2022 provides for the procedure which has to be followed for the notification of targeted individuals after the surveillance has ended. There is no provision that the latter is notified that his communications have been intercepted. Therefore, interested individuals, should they suspect that they have been targeted, must submit a request thereof to ADAE, which, thereafter, submits it to ADAE. The law provides however that such requests are admissible only after the elapse time-period of three years from the termination of the surveillance.
N/A
Notification Mechanism
In the case of interception of face-to-face conversations, ordered by means of a spyware, the general procedure of control on the execution of the operations (Article 268 CCP) and on the preservation of the documentation (Article 269 CCP), entrusted to the judicial authority, as well as on the exercise of the rights of defense in criminal proceedings, do apply. Provisions are envisaged (Article 271 paragraph 1 CCP) for prohibiting the interception outside the cases allowed by law or without complying with the provisions of the law. Moreover, it is provided (Article 271, paragraph 1-bis CCP – specific rule) that data acquired during the preliminary operations prior to the insertion of the spyware on the portable electronic device and data acquired outside the time and place limits indicated in the authorization decree cannot be used in any case. At any stage and instance of the proceedings, the court shall order that the documentation of wiretaps carried out in breach of the prohibitions of the law be destroyed (Article 271, paragraph 3 CCP).
In Korea, a 2015 report revealed that the intelligence agency had used spyware during its operations. However, the purpose for which the spyware was used or how it was employed were not disclosed. This report raised significant concerns that fundamental rights, such as the right to communications secrets, may be violated in the process of data collecting for criminal investigations or national security purposes. The specifics of the alleged spyware use were not fully revealed, and since then, no requirements have been established to specify when spyware is allowed to be used for investigation and national security purposes, nor have any legislative controls been enacted to regulate the reasons or protocols for its use. As a result, the matter still remains subject to the ordinary laws as mentioned above.
There is no specific post-surveillance notification mechanism other than the oversight institutions and processes indicated above. At an institutional level, the Commissioner for the Oversight of Interception of Communication through its monitoring powers can exert post-surveillance effects. In cases where violations are found by the Commissioner, then the Kosovo Judicial Council addresses them to the Panel for Examination and Investigation based on Criminal Procedure Code, whereas the General Inspector of the Intelligence Agency addresses them based on competences prescribed in the Law on the Intelligence Agency.
According to the Criminal Procedure Code of the Kyrgyz Republic, persons whose rights have been restricted as a result of special investigative actions must be notified by the investigator in writing of the restriction that has taken place.
According to Art. 104 par. 2 StPO after the end of the surveillance, the investigating judge must inform the owner of the monitored communication system and the suspect (accused) of the fact of the surveillance. At the same time, the owner of the
In Lithuania, there is currently no mechanism for notifying individuals about post- surveillance activities in the Law on Criminal Intelligence. Recently, in 2023, there has been a discussion on this issue. Adjustments to the Law on Criminal Intelligence were
Article 88-4 § 6 of the Code of Criminal Procedure regulates the notification mechanism in the framework of criminal proceedings. Individual targeted are further informed that they can lodge an appeal for annulment on the basis and under the conditions of Article 126.
/
Criminal Investigations
Pas en l’état.
/
Article 262 of the Law on Criminal Procedure of the Republic of North Macedonia deals with the notification of the person affected by special investigative measures. When these measures are terminated, if it does not harm the ongoing procedure, the affected person has the right to request that the public prosecutor provide them with the written order related to these measures. The request can also be made to the court. The main purpose of this provision is to ensure transparency and the right to information for those subjected to special investigative measures, which is an important aspect of the right to defense and the right to a fair trial.
Law enforcement:
or all surveillance measures, there are two tracks of oversight. One is the ex ante judicial track, by the courts. The other is the ex post non-judicial track, by specially designated oversight bodies.
/
Any person who invokes their right in relation to data related to that person may exercise the right through the Data Inspection Commission.
Under the Law on National Security (Law No. 51/1991), if data does not support further investigation, individuals must be informed of the surveillance unless this risks national security or the confidentiality of sources. Article 21 § 2 of Law no. 51/91 on the National Security of Romania prescribes that a notification is excluded if: (a) it could lead to jeopardising the performance of the official duties of State bodies responsible for national security by disclosing their sources, including those of the security and intelligence services of other States; (b) could affect the defence of national security; (c) could prejudice the rights and freedoms of third persons; (d) could lead to the disclosure of the methods and means, including specific investigative techniques, used in the case in question by State bodies responsible for national security.
Law no. 98 of 21 July 2009 governing interceptions provides for several control mechanisms following the authorisation of interceptions by the Investigating Judge.
This question is, so far, regulated in the Criminal Procedure Code under the Article 163 “Handling Collected Materials”:
Sections 114 and 115 CPC stipulate that if the surveillance has not helped uncover any relevant information, any recordings or their copies must be immediately destroyed. A protocol on the destruction is to be included in the case file. The persons concerned who do not have access to the file must be, within three years from the final decision in the criminal case, notified that they had been subjected to surveillance and that any recordings have been destroyed. They must be informed of the possibility to file with the Supreme Court a motion for review of the court warrant authorising the surveillance.
There is no post-surveillance notification mechanism. The remedies available are those derived from the general legal provisions for the protection of privacy and secrecy of communications. Appeals have been lodged against the use of these programmes, as described in answer 4.2 above.
For notification afterwards on the use of secret investigative measures, the rules in the Code of Judicial Procedure Chapter 27, sections 31-33 apply. These provide, formally speaking, for notification, but there are a large number of exceptions, in particular where notification would damage ongoing investigations or damage other interests requiring secrecy. There is a list of serious offences (mainly security offences) where notification need not occur. In such cases of non-notification, SIN is to be informed.
Article 279 CPC provides for notification in regard to surveillance in criminal proceedings. The public prosecutor's office must inform the suspected person under surveillance (and any third persons under surveillance in accordance with Article 270 (b)) of the reason, type and duration of the surveillance at the latest when the preliminary proceedings conclude (paragraph 1). The compulsory measures court may postpone or waive the notification if the findings are not used as evidence in court proceedings and the postponement or omission is necessary to protect overriding public or private interests (paragraph 2). Persons whose postal or telecommunications services have been monitored or who have utilised the monitored postal address or the monitored telecommunications service must lodge an appeal in accordance with Articles 393-397 CPC. The deadline for appeal begins upon receipt of the notification (paragraph 3).
1) Criminal code of Ukraine
Unlawful interception of communications which occur intentionally or recklessly are rendered criminal offences.
While Fourth Amendment jurisprudence has determined that certain types of criminal surveillance require government warrants, this notice is not required to coincide with the timing of the search or seizure. Under the Electronic Communications Privacy Act, the government may acquire information via surveillance without notice. Warrants are not, in other words, equivalent to a post-surveillance notification system. Additionally, there is no notification mechanism under FISA– the law only requires that the government give notice when the information collected will be used against them.
Austria
Belgium
qu'elle a fait l'objet d'une méthode visée à l’article 18/17, à condition que:
1° une période de plus de dix ans se soit écoulée depuis la fin de la méthode;
2° la notification ne puisse nuire à une enquête de renseignement;
3° aucun manquement aux obligations visées aux articles 13, alinéa 3 et 13/4, alinéa 2 ne soit commis;
4° la notification ne puisse porter atteinte aux relations que la Belgique entretient avec des Etats étrangers et des institutions internationales ou supranationales.
Toute personne qui peut justifier d'un intérêt personnel et légitime, peut introduire une plainte auprès du Comité permanent R s’il estime avoir fait l’objet d’une décision illégale relative à une méthode spécifique ou exceptionnelle de recueil de données (art. 43/4 L.R&S). Les décisions du Comité permanent R ne sont susceptibles d'aucun recours. (article 43/8 L.S&R).
Bosnia and Herzegovina
In accordance with Article 77 of the Law on Intelligence and Security Agency, a citizen of Bosnia and of Herzegovina that was the subject of monitoring or eavesdropping should, after the end of the monitoring or eavesdropping, be informed of the measures taken, unless such information could endanger the completion of the Agency's tasks or the completion of the proceedings before the competent authorities.
Bulgaria
Canada
Individuals are free to make complaints to the above-noted oversight/review bodies, or may challenge the actions of investigative agencies in court.
Crotia
Denmark
See Art. 788 of the Administration of Justice Act.
Estonia
Finland
a response is provided to investigation requests, but such a response would only state that the investigation has been carried out.
France
Germany
According to Section 74(6) of the BKAG, persons affected by covert intervention in information technology systems (as defined in Section 49 BKAG) must be notified. Moreover, according to Section 74 (2) BKAG, notification is given as soon as this is possible, and it is made by the Federal Criminal Police Office. Under certain conditions, referrals and extensions are allowed.
Greece
Neither ADAE nor EYP can decide thereof, but a three-member committee, composed by EYP’s prosecutor, the high ranked second prosecutor in charge with the file (see answer to question 5) and the president of ADAE. That committee may satisfy the demand only if it considers that the disclosure does not jeopardize the scope for which the specific surveillance had been imposed. What is even more important, should that committee decide to notify the interested person, the law provides that no other information is notified to him but that his communications had indeed been intercepted for the disclosed period of time. Nevertheless, all information concerning the reasons why the surveillance was imposed are to be withheld.
It is clear from the above that no adequate protection is provided for individuals targeted. Beyond the mandatory three-year period that must elapse for the latter to initiate the above procedure, it is doubtful that even if duly notified, interested persons will obtain sufficient evidence to seek judicial protection.
Iceland
Ireland
The 1993 Act does not allow for the notification of surveillance after the fact. Section 10(3) of the 2009 Act provides that the Minister for Justice may make regulations for the disclosure of information about the use of a tracking or surveillance device to the person who was placed under surveillance or others affected by the surveillance. However, no such regulations have been made and as a result, there is no notification obligation in respect of this Act either.
Complaints Procedure
Criminal Justice (Surveillance) Act 2009
Under this Act, any person who believes they may have been the subject of an authorisation under sections 7 or 8 can apply to the Complaints Referee for an investigation. Where an application is made and is not considered frivolous or vexatious, the Referee must investigate whether an authorisation was issued or approval was granted as claimed, and if so, whether there has been a relevant contravention. If a contravention is found, the Referee must notify the application and any materially affected person in writing and report the findings to the Taoiseach. The Referee may also order the quashing of the authorisation or reversal of the approval and the destruction of related records, recommend compensation of up to €5,000 and report the matter to the relevant authorities (the Ombudsman Commission, Ministers, and designated judge). The Referee may decide not to notify the applicant, quash the authorisation, or recommend compensation if it is not in the public interest.
Interception of Postal Packets and Telecommunications Act 1993
Individuals who believe their communications have been intercepted under the Act can apply to the Complaints Referee for an investigation. The Referee is appointed by the Taoiseach and must be a judge of the Circuit or District Court or a barrister or solicitor with at least 10 years’ experience. The Referee investigates the validity of an authorisation and any contraventions of the Act’s provisions. If a contravention is found, then the Referee must notify the applicant in writing, and report the finding to the Taoiseach. They can take such actions as quashing the authorisation, ordering the destruction of intercepted communications, or recommending compensation for the application. If the Referee concludes that there has not been a contravention in relation to the authorisation, but that the offence concerned was not a serious offence, they can refer the question to the designated judge for further determination. The Referee has access to all official documents related to the authorisation and can request information from individuals concerned in the process. The Minister is obligated to implement any compensation recommendations made by the Referee.
Communications (Retention of Data) Act 2011, as amended by the Communications (Retention of Data) (Amendment) Act 2022
Section 12 of the 2011 Act provides that the person to whom the data relates shall be notified of the disclosure of Schedule 2 data to an applicant officer. Disclosures of Schedule 2 data made pursuant to an authorisation relating to the security of the state are excluded from this. A person who believes their data has been disclosed following a disclosure requirement may apply to the Complaints Referee to investigate.
Italy
Korea
The Protection of Communications Secrets Act lists the crimes for which investigative agencies may take communication-restricting measures for investigative purposes and outlines the procedure for requesting authorization for such measures. The Act also specifies the procedure intelligence agencies must follow when implementing communication-restricting measures for national security purposes. Even if the requirements for taking communication-restricting measures are not fully met, the measures can be implemented in cases of recognized emergencies, though the criteria for recognizing an emergency are highly stringent.
A request for permission to take communication-restricting measures for investigative purposes is filed by a prosecutor and approved by the court. These measure are only effective up to two months, but if the objective is achieved before the end of the two-month period, such measures must be terminated. The period can be extended for another two months, with the total period not exceeding one year. However, for certain crimes, the total period can be extended up to three years.
Wiretapping for national security purposes must be conducted by the intelligence agency with either permission from the chief presiding judge of the high court or approval from the President. There may be criticism that requiring approval from the President, rather than the judiciary, is inappropriate and ineffective in terms of the principle of the separation of powers. However, presidential approval is required only in special circumstances, while judicial permission is the standard procedure. The period of communication-restricting measures is four months, and such measures must be terminated once their objective is achieved. If necessary for national security, the period may be extended for an additional four months with judicial permission.
As mentioned earlier, if an emergency is recognized, communication-restricting measures can be implemented without prior permission. However, court approval must be obtained immediately after the emergency measures are taken. If court approval is not secured, the measures must be promptly suspended, and any materials acquired through them must be destroyed.
Any prosecutor or head of intelligence agency is required to provide the subject of the measures with the relevant facts in writing within 30 days from the date of termination of the measures. The National Assembly, when deemed necessary, requests the Minister of Court Administration or the heads of investigative or intelligence agency to file a report on the matter.
Kosovo
The Commissioner also cooperates closely with the Agency for the Protection of Personal Data and informs the Agency with the findings of the Commissioner’s monitoring report. As now indicated, obviously, affected individuals have access to judicial remedies and can also lodge complaints against public institutions with the Ombudsperson Institution.
Kyrgzstan
When a person becomes familiar with factual data obtained without his knowledge, the said person shall, prior to the criminal case being sent to court, be informed of the special investigative action taken to the extent that it directly affects the person concerned and excludes the disclosure of state and other secrets protected by law.
According to the Law “On operational-search activities”, a person who believes that the actions of a body carrying out operational-search activities have led to the restriction of his rights and freedoms has the right to appeal these actions to a higher body carrying out operational-search activities, to the prosecutor or to the court.
In the event of a violation by an agency (official) carrying out operational investigative activities of the rights and legitimate interests of individuals and legal entities, a higher agency, prosecutor or judge is obliged to take measures to restore these rights and legitimate interests, and compensate for the damage caused in accordance with the legislation of the Kyrgyz Republic.
Operational investigative activities carried out in violation of the law entail liability provided for by the legislation of the Kyrgyz Republic.
Liechtenstein
communications equipment shall be given the opportunity to inspect the recordings, as shall the suspect (accused) other than the owner of the communications equipment, but only to the extent that the recordings could be of significance for the current criminal proceedings or for criminal proceedings to be initiated against him.
Art. 104 par 4 Stop provides that If the owner of the intercepted communications equipment considers himself aggrieved by the fact that the interception has been ordered, authorized or maintained or that the retention of a recording has been ordered,
he shall be entitled to lodge an appeal with the Superior Court within fourteen days of notification by the investigating judge. Against this decision an individual complaint to the Constitutional Court may be lodged.
Lithuania
proposed, introducing a person’s right to be informed if criminal intelligence actions were used against them. However, these adjustments were not approved by the Lithuanian Parliament.
Additionally, according to Article 5(6) of the Law on Criminal Intelligence, if a person has been subjected to criminal intelligence, but the information obtained has not been confirmed and a pre-trial investigation has not been initiated, yet legal negative
consequences have arisen, they must, upon request, be provided with the data collected during the course of criminal intelligence about them. This does not include the data specified in Article 19(7) of this law. Article 19(7) states that detailed information on the methods and means of gathering criminal intelligence, the tactics used, the identity of undercover actors involved in criminal intelligence, and detailed information on the quantitative and personal composition of these actors is not to be provided.
Under the Code of Criminal Procedure, Article 161 governs the notification process for individuals subjected to certain investigative measures. According to this Article, a person who has been the subject of any measure outlined in the Chapter, without their knowledge, must be informed of such measures once they have concluded. Notification should occur as soon as it is possible without jeopardizing the success of the investigation. If criminal proceedings are terminated, any information collected about an individual’s private life must be destroyed immediately through an appropriate procedure.
Luxembourg
Malta
Moldova
During the criminal investigation, the investigating judge can postpone, by reasoned decision, informing the person under surveillance, but no later than the moment the criminal investigation ends. The intercepted and recorded communications will be kept in their entirety on the original support presented to the criminal investigation body by the technical subdivision. This support will be kept by the investigating judge who authorized the secret surveillance.
In its case-law, Judgment no. 31 of 23 September 2021, the Constitutional Court of the Republic of Moldova has analyzed whether the destruction of information obtain from secret surveillance of metadata deemed irrelevant by the investigating judge ensures the right to defense of the person subject to secret surveillance. The Court considered it necessary for the defense to have the opportunity to have access, at the end of the criminal investigation and, respectively, at the trial of the case on the merits, to the metadata obtained as a result of the application of secret surveillance. At the same time, the Court noted that the persons who will have access to the recordings made may find out certain data from the private life of third parties. Of course, the persons in question are under an obligation not to disclose this data.
One year after the judicial decision remains irrevocable, the metadata obtained as a result of secret surveillance is destroyed by the prosecutor based on the conclusion of the investigating judge, who draws up a report in this regard.
Intelligence investigations
According to article 221 of the Law no. 59/2012 on the special investigation activity, the informing of the person subject to the special investigative measure shall be postponed if one of the following grounds exists:
(a) the information constitutes an increased risk to the life and health of the person;
b) it is necessary to carry out another special investigation measure within the same special file;
c) the results of the special investigative measure necessitate criminal proceedings.
The investigating officer managing the special file shall draw up a reasoned report stating the existence of one of these grounds, which shall be approved by the head of the specialized subdivision and forwarded to the prosecutor for examination. The public prosecutor, when examining the report drawn up and approved by the investigating officer, shall ascertain the presence or absence of grounds for postponement of the notification of the person subject to the special investigative measure, shall determine whether these grounds are of a permanent or provisional nature and, by order, shall admit or reject the authorization to postpone the notification of the person subject to the special investigative measure.
Depending on the permanent or provisional nature of the grounds for postponement of the information, the public prosecutor may authorize the postponement of the information for a specified period of time, the specialized subdivision that initiated
the special investigative measure being obliged, upon the expiry of that period, to reassess the grounds for postponement of the information and to take the necessary actions in accordance with the provisions of this Law. The refusal of the public prosecutor to authorize the postponement of the information may be appealed by the head of the specialized subdivision to the superior public prosecutor.
In the case of permanent grounds, each period of time for which postponement of the information may be authorized, pending reassessment of the grounds, may not exceed 180 days, and in the case of provisional grounds, each period of time for which
postponement of the information may be authorized, pending reassessment of the grounds, may not exceed 30 days. The order issued by the public prosecutor authorizing the deferral of the investigation and the report drawn up by the investigating officer and approved by the head of the specialized subdivision shall be annexed to the case file.
However, according to Article 22 para. (9) of the Law no. 59/2012, after having established whether or not the special investigative measure is lawful, the public prosecutor shall, no later than 15 days from the date of issuing the decision/order on the legality of the special investigative measure, inform the person who has been subject to the special investigative measure in writing by registered letter. The materials confirming the person's notification shall be annexed to the special file. Within 30 days from this date of the information, the person subject to the special investigative measure shall have the right to acquaint himself/herself with the acts of disposition on the order, authorization, extension and termination of the special investigative measure, the minutes on the recording of the results of the special investigative measure, the information on the information carrier and the conclusion/order on the verification of the legality of the special investigative measure, except for the information classified as state secret (Article 22 para. (10) of the Law no. 59/2012).
According to Article 22 para. (11) of the Law no. 59/2012, the dismissal of the results of special investigative measures carried out lawfully shall be realized within 90 days from:
(a) expiry of the time limit for taking cognizance, if the person has not made use of this right;
(b) the expiry of the time limit for contesting the investigating judge's decision or the prosecutor's order, if no appeal has been lodged;
(c) the decision of the investigating judge or the order of the public prosecutor is upheld if an appeal has been lodged and the appeal has been rejected.
Article 26 of the Law no. 59/2012 provide for a redress in case of targeted surveillance. The prosecutor's order granting or refusing the authorization to carry out the special investigative measure or finding that the special investigative measure has been lawfully carried out or not lawfully carried out may be challenged before the hierarchically superior prosecutor by:
a) the head of the specialized subdivision which requested the authorization to carry out the special investigative measure;
b) the person subject to the special investigation measure.
The request for challenge shall be addressed to the hierarchically superior prosecutor within 15 days at the latest from the date of notification of the order and shall be lodged directly with him or with the prosecutor who issued the challenged act. If the contestation request has been submitted to the prosecutor who issued the contested act, he is obliged, within 48 hours of receipt, to forward the contestation request, accompanied by his explanations and the minutes of the recording of the results of the special investigative measure with all its annexes, to the prosecutor hierarchically superior.
In order to ensure the examination of the appeal, the head of the specialized subdivision shall provide the hierarchically superior prosecutor with all necessary materials, except for those containing data on persons who have confidentially contributed to the special investigative measure.
The hierarchically superior public prosecutor shall examine the request for contestation within 5 days at the latest and shall order, by order, which may not be contested:
a) the admission of the request of appeal with the annulment of the order of the lower hierarchical public prosecutor and the pronouncement of a new decision on the contested matters;
(b) to reject the appeal and uphold the order of the Prosecutor hierarchically below.
The procedure for appealing against decisions of the investigating judge on special investigative measures shall be governed by the Code of Criminal Procedure and shall be applied accordingly.
Article 313 of the Criminal procedure code provides a judicial remedy against unlawful actions and acts of the prosecution and special investigative bodies. The request may be lodged by the suspect, defendant, defense counsel, injured party, other participants in the proceedings or other persons whose rights and legitimate interests have been violated by these bodies, if the person does not agree with the result of the examination of his/her complaint by the prosecutor or has not received a response to his/her complaint from the prosecutor within the time limit provided by law.
The complaint shall be examined by the investigating judge within 30 days, without the presence of the parties, who shall be notified of the date of examination of the complaint. The judge, by reasoned decision, may order a hearing to be set for the appearance at the trial, summoning the public prosecutor, the person who lodged the complaint and the persons whose rights and freedoms may be affected by the admission of the complaint. The non-attendance at the hearing of the public prosecutor, the person who lodged the complaint and/or persons whose rights and freedoms may be affected by the admissibility of the complaint shall not prevent the examination of the complaint. In both cases, the prosecutor is obliged to submit the relevant materials to the court within 5 days of being notified. If the complaint is examined at the hearing, the prosecutor, the person who lodged the complaint and the persons whose rights and freedoms may be affected by the admission of the complaint shall give explanations.
The investigating judge, considering the complaint to be well-founded, shall adopt a decision obliging the prosecutor to remedy the violations of the rights and freedoms of the person or legal entity and, where appropriate, shall declare the nullity of the challenged procedural act or action. Finding that the challenged acts or actions have been performed in compliance with the law and that the rights or freedoms of the person or legal entity have not been violated, the investigating judge shall issue a ruling on the dismissal of the complaint. A copy of the judgment shall be sent to the person who lodged the complaint and to the public prosecutor.
Monaco
Morocco
North Macedonia
Article 262 of the Law on Criminal Procedure
Notification of the Affected Person
After the special investigative measures have been terminated, if it does not harm the procedure, upon request by the affected person, the public prosecutor will provide them with the written order. The affected person may also submit the request to the court.
The Law on Communication Surveillance provides several specific mechanisms and remedies related to post-surveillance notification and protections for individuals subjected to targeted surveillance.
Article 51 of the Law on Communications Surveillance stipulates that the Council for Civil Control must inform an individual if their telephone number has been unlawfully monitored. If a complaint is made by a citizen, the Council requests the Commission to verify the legality of the surveillance. The individual will be informed based on the findings of this oversight. Article 51(6) requires the Council to notify the citizen promptly if abuse is detected during the oversight. If no abuse is found, the citizen is still informed but with limited details to preserve confidentiality. If surveillance is found to be unlawful, the individual have legal recourse through the judicial system, including filing complaints with relevant authorities or seeking redress through legal channels.
Netherlands
Yes, a post-surveillance notification procedure exists in Dutch criminal procedural law. Informing the person involved in the application of a special investigative power is regulated in Article 126bb DCCP, which includes the use of hacking powers in Article 126nba, 126uba en 126zpa DCCP. The notification must take place as soon as possible but does not occur when this is ‘reasonably not possible’ or when individuals are automatically notified in pending criminal procedures. Individuals involved can also file a complaint with the Dutch Data Protection Authority.
Intelligence and security services:
Yes, a post-surveillance notification mechanism exists in Article 59(1) of the Act on Intelligence and Security Services. In principle, individuals involved in the application of an investigative power must be informed five years after the termination of the investigative power. Notification is not required when (a) sources of a service, including intelligence and security services of other countries, are disclosed; (b) relations with other countries and with international organisations are seriously harmed; or (c) a specific application of a method (modus operandi) or the identity of the person who assisted the service in applying the method is disclosed. The Dutch Review Committee on Intelligence and Security Services actively reviews these obligations, as shown in a recent publication in 2024. Individuals who are notified can file a complaint or seek compensation in civil proceedings at a court.
Norway
Ex ante
For the Intelligence Service, decisions on information gathering on cross boundary electronic information (internet traffic) requires approval by a court, see Article 8-1 of the 2020 Intelligence Act. This includes orders to internet providers to mirror electronic communication that crosses the Norwegian border, searches in stored meta data, the targeted gathering and storage of meta data, targeted gathering of information, and the processing of information concerning journalistic sources. The court will control the legality of the decision, see Article 8-4, including that the surveillance falls within the remit of the Intelligence Service’s mandate, as well as the basic criteria (necessity, proportionality etc.) and limitations are respected.
For the Police Security Service, Article 17 d of the 1995 Police Act (https://lovdata.no/lov/1995-08-04-53/§17d – not in English) requires all decisions of surveillance to be approved by a court. For the police in criminal investigations, surveillance measures (data reading, wire taps, data taps) must be approved by a court. For data reading, see Articles 216 o section 1 and generally Chapter 16 a of the 1981 Criminal Procedure Act (https://lovdata.no/lov/1981-05-22-25/§216a – not in English).
Ex post
The intelligence services, including the Intelligence Service and the Police Security Service, are subject to ex post oversight by the Norwegian Parliamentary Oversight Committee on Intelligence and Security Services (the EOS Committee). They have information in English on their website: https://eos-utvalget.no/en/home/, including on the legal framework: https://eos-utvalget.no/en/home/about-the-eos-committee/legal-framework/ . The EOS Committee is regulated by the 1995 Act relating to the Oversight of Intelligence, Surveillance, and Security Services. You can find an English translation of the law at the end of the EOS Committee’s annual report: https://eos-utvalget.no/wp-content/uploads/2023/06/EOS-Committee-annual-report-2022.pdf . According to Article 8 of the Act, the EOS Committee has complete access to all information held by the intelligence services regardless of classification. Unhindered access is also provided for by Article 7-10 of the 2020 Intelligence Act. The Intelligence Service must report decisions of bulk gathering of cross boundary data to the EOS Committee, see Article 7-3 of the 2020 Intelligence Act. The EOS Committee can address complaints by individuals and whistle blowers, see more on the procedure here: https://eos-utvalget.no/en/home/complaint-procedure/. The EOS Committee can also investigate issues by its own initiative. It produces an annual report to Parliament. If the EOS Committee during a control finds that surveillance is illegal, it can demand a cease of the surveillance and deletion of all information by a motion to the Oslo city court, see Article 7-12 of the 2020 Intelligence Act.
As for ex post oversight for the police, not including the Police Security Service, Article 216 h of the 1981 Criminal Procedure Act (https://lovdata.no/lov/1981-05-22-25/§216h – not in English) requires the establishment of an independent body tasked with controlling the legality of the use and storage of communication control measures (wire taps, surveillance, data taps). This body of at least 3 members (currently 6 members) is appointed by the Government. The leader must fulfil the requirements to qualify as a Supreme Court judge. The current leader is a professor of law, while the other members are barristers (3), a city court judge, and an engineer. The body and its procedures is further regulated by Article 12-16 in a regulation on communication control (FOR-2016-09-09-1047kommunikasjonskontrollforskriften, https://lovdata.no/dokument/SF/forskrift/2016-09-09-1047 - not in English). This regulation allows the body to address any issue raised by individuals or organisation concerning police surveillance, Article 15. The body may also by its own initiative address any issue, and shall prioritise issues that have raised public debate or criticism. The body has access to all information related to communication control measures, including the actual wire taps, videos, data taps etc., Article 16. Article 18 provides the body an independent status, meaning that it cannot be instructed.
Poland
Portugal
Romania
San Marino
These control mechanisms are implemented both through the intervention of the Judge responsible for Interceptions (see answer to question 6), who exercises wide and multiple binding powers with regard to the examination and acquisition of intercepted communications, and through the direct involvement of the suspected persons and their defence lawyers with regard to many of the tasks related to the taking of evidence from interceptions in criminal proceedings.
Once the Investigating Judge who ordered the interception has filed with the Registry the minutes and recordings of the relevant interceptions, the parties’ defence lawyers are entitled to examine the documents and listen to the recordings, as well as to resort to their trusted technical experts in the exercise of these rights. They may then request the acquisition of other communications or highlight conversations that are deemed irrelevant or the use of which is prohibited. Defence lawyers are also heard before the Judge responsible for Interceptions orders the acquisition of the conversations relevant to the criminal proceedings.
Serbia
If the public prosecutor does not initiate criminal proceedings within six months of the date of first examining the materials collected by applying special evidentiary actions or if he/she declares that he/she shall not use them in the proceedings or that he/she shall not request the conduct of proceedings against the suspect, the judge for preliminary proceedings shall issue a ruling on the destruction of the collected materials.
The judge for preliminary proceedings may inform the person against whom a special evidentiary action was conducted about the issuance of the ruling referred to in paragraph 1 of this Article, if during the conduct of the action his/her identity was established and if it would not threaten the possibility of conducting criminal proceedings.
The materials shall be destroyed under the supervision of the judge for preliminary proceedings who shall make a record thereof.
If during the performance of the special evidentiary actions it was acted in contravention of the provisions of this Code or an order of the authority conducting proceedings, the court’s decision may not be based on the data collected and the collected material shall be treated as unlawful evidence.
Slovakia
The notification duty does not apply in proceedings on particularly serious felonies or felonies committed by an organised group, criminal group or terrorist group, or where several persons participated in the commission of the criminal offence and, in relation to at least one of them, the criminal prosecution has not been concluded, or if the provision of such information could obstruct the purpose of the criminal proceedings.
However, no post-surveillance notification duty exists under the PAIA, which has been repeatedly criticised in the literature.
The affected persons may also file a constitutional complaint under Art. 127 of the Constitution. The constitutional complaint mechanism has recently proven essential in filling in a lacuna in the PAIA consisting in the fact that the regional courts exercising judicial review under PAIA have no power to specifically order the destruction of recordings obtained through illegal surveillance. This legislative omission was criticised by the European Court of Human Rights in its 2021 judgment in Zoltán Varga v. Slovakia (58361/12 et al.). In the recent 15 May 2024 judgment (III. ÚS 97/2012), the Constitutional Court specifically ordered – in this case – the Slovak Information Service to destroy any still existing recordings and other documents obtained through the illegal surveillance carried out in that case and to inform the complainant of their destruction.
Spain
Sweden
There is a standing remedy mechanism. Section 3 of the Supervision Act provides that, at the request of an individual, SIN is obliged to check whether he or she has been the subject of secret surveillance or subject to processing of personal data and whether the use of secret surveillance and associated activities or the processing of personal data was in accordance with laws and other regulations. There is an exception where the complaint is ”manifestly ill-founded”. SIN is to inform the complainant that a control has been carried out. However, the standard reply is ”no violation of the law has occurred”.
Switzerland
Art. 279 CPC Communication
1 Au plus tard lors de la clôture de la procédure préliminaire, le ministère public communique au prévenu ainsi qu’au tiers qui ont fait l’objet d’une surveillance au sens de l’art. 270, let. b, les motifs, le mode et la durée de la surveillance.
2 Avec l’accord du tribunal des mesures de contrainte, il est possible de différer la communication ou d’y renoncer aux conditions suivantes:
a. les informations recueillies ne sont pas utilisées à des fins probatoires;
b. cela est indispensable pour protéger des intérêts publics ou privés prépondérants.
3 Les personnes dont la correspondance par poste ou par télécommunication a été surveillée ou celles qui ont utilisé l’adresse postale ou le service de télécommunication surveillé peuvent interjeter recours conformément aux art. 393 à 397.201 Le délai de recours commence à courir dès la réception de la communication.
In the case of post-surveillance notifications regarding the activities of the security services, there is a clear distinction to be made between devices located in Switzerland and those located abroad.
− If the targeted device is located in Switzerland, Article 33 IntelSA applies:
Art. 33 Obligation d’informer les personnes surveillées
1 À la fin d’une opération de surveillance impliquant des mesures de recherche soumises à autorisation, le SRC informe la personne surveillée dans un délai d’un mois des motifs, du type et de la durée de la surveillance à laquelle elle a été soumise.
2 Il peut différer l’information des personnes surveillées ou déroger à l’obligation de les informer dans les cas suivants:
a. le report est nécessaire pour ne pas mettre en péril une mesure de recherche en cours ou ne pas entraver une procédure juridique en cours;
b. le report est nécessaire à cause d’un autre intérêt public prépondérant pour préserver la sûreté intérieure ou extérieure ou à cause des relations que la Suisse entretient avec l’étranger;
c. l’information pourrait mettre des tiers en grand danger;
d. la personne concernée n’est pas atteignable.
3 Le report de l’information des personnes surveillées ou la dérogation à l’obligation de les informer doivent être autorisés par le TAF et avalisés par le chef du DDPS selon la procédure d’autorisation visée à l’art. 29.
The FIS must notify the person being monitored within one month after concluding the operation. This notification must include the reason for, and the nature and duration of, the surveillance (paragraph 1). The FIS may postpone or waive the notification under the conditions set out in paragraph 2 a-d. In this case, the postponement or waiver of notification must be authorised and cleared in accordance with the authorisation procedure provided for in Article 29.
− If the target is located abroad, the individual is not informed of the intelligence measure.
This means that people whose electronic devices have been infiltrated abroad are never informed of the measures. The IntelSA provides clear and detailed guidance on the right to request information on all forms of secret surveillance measures, as set out in Articles 63-66.
Ukraine
Article 253. Notifying individuals in whose respect covert investigative (detective) actions have been conducted
1. Individuals whose constitutional rights were temporarily restricted during conducting covert investigative (detective) actions, as well as the suspect, his/her defence counsel shall be informed about such restriction in written form by public prosecutor or, upon his instruction, by investigator.
2. Specific time of notification shall be chosen taking into account the presence or absence of possible risks for the attainment of the objective of pre-trial investigation, public security, life or health of individuals who are involved in the conduct of covert investigative (detective) actions.
Appropriate notification of the fact and findings of covert investigative (detective) actions shall be made within twelve months since the date of termination of such actions, but not later than an indictment has been produced to court.
Additional information:
Criminal code of Ukraine
Article 254. Measures to protect information obtained through covert investigative (detective) actions
1. Information on the fact and methods of the conducting of covert investigative (detective) actions, executors thereof, as well as information obtained as a result of the conduct thereof, may not be disclosed by individuals who took knowledge of such information by way of reviewing the materials as prescribed by Article 290 hereof.
2. Where records on the conduct of covert investigative (detective) actions contain information on private (personal or family) life of other persons, defence counsel and other individuals entitled to review such records shall be warned about criminal liability for disclosing information obtained in respect of other persons.
3. Making copies of records on conducting covert investigative (search) actions and appendices to them before making a decision on their declassification in the manner prescribed by law is not allowed.
Article 255. Measures to protect information, which is not used in criminal proceedings
1. Information, objects and documents obtained as a result of the conduct of covert investigative (detective) actions which, in public prosecutor’s opinion, are not necessary for subsequent pre-trial investigation, shall be destroyed immediately based on public prosecutor’s decision, except in cases specified in part 3 of this Article and Article 256 hereof.
2. The use of records referred to in part 1 of this Article for purposes not related to the criminal proceedings, or reviewing such records by the participants to criminal proceedings shall be prohibited.
3. Where the holder of any objects or documents obtained as a result of covert investigative (detective) actions may be interested in recovering them, the public prosecutor shall serve him/her a notice of such objects or documents being in the possession of the prosecutor and find out whether such person would want to recover them. When deciding on the admissibility of actions provided under this part as well as on the time of conducting such, the public prosecutor shall have regard to the need to secure the rights and legitimate interests of persons, as well as the necessity to prevent any prejudice to the criminal proceedings.
4. Destruction of information, objects and documents shall be conducted under supervision of public prosecutor.
5. Destruction of information, objects and documents obtained as a result of covert investigative (detective) actions shall not exempt the public prosecutor from his duty of notification under Article 253 of this Code.
Article 256. Using results of covert investigative (detective) actions as evidence
3. Whenever results of covert investigative (detective) actions are used for proving, persons in respect of whose actions or contacts such investigative action was conducted, may be interrogated. Such persons shall be notified of the conduct of covert investigative (detective) actions only in their respect, within a time limit specified in Article 253 of this Code, and the scope affecting their rights, freedoms, or interests.
Article 517. Protection of state secrets during criminal proceedings
7. Conducting a criminal proceeding that contains a state secret is not a reason to limit the rights of its participants, except for cases provided by law and conditioned by the need to ensure the protection of state secrets.
2) Law of Ukraine "On Intelligence"
Article 25. Observance of human rights and freedoms during intelligence activities
1. Confidential information about a person that became known to intelligence agencies during the performance of the tasks assigned to these agencies and the performance of functions defined by this Law shall not be disclosed, except in cases defined by law.
2. The persons specified in the first part of this article have the right to receive from the intelligence agency information on the restriction of their rights, freedoms and legitimate interests and to challenge the actions that led to to such a limitation, in accordance with the procedure established by law, taking into account the specifics defined by this Law and the legislation on the protection of state secrets.
The intelligence agency provides information regarding the restriction of the rights, freedoms and legitimate interests of a person only after the completion of the intelligence activities to which such restriction was related, and on the condition that the provision of this information will not pose a threat to the national security of Ukraine.
United Kingdom
The IPT has power to award compensation and may make orders for the destruction of information and records of information and for the cancellation of warrants. Rights of appeal to the Court of Appeal are also provided for. The IPT is a judicial body entirely independent of Parliament and Government. Judicial independence is itself enshrined in the Constitutional Reform Act 2005 and no organisation can intervene in any IPT investigation or influence its decisions.
United States of America
Post-surveillance notification systems do exist in the California legal system. CalECPA has notice requirements pre-surveillance and post-surveillance in cases of delayed notification or emergencies. CalECPA requires government entities, seeking to obtain information through a warrant, to provide contemporaneous notice with a copy of the warrant to identified targets. If the government entity is seeking information through an emergency order, they must notify the targeted individual within three days of receiving the information. Government entities may provide a delayed notice (with court approval) and must provide a court statement detailing the court’s determination and either a copy or summary of the electronic information collected. When an individual cannot be notified, CalECPA requires government entities to provide notice and delayed notice information to the California Department of Justice (CaDOJ). Within ninety days of receiving that information, the CaDOJ must publish their reports on their website.
Available Remedies
FISA provides for individual remedies for the unlawful acts of individual government officers against data subjects. If said officer conducts surveillance on a data subject without obtaining official authorization and/or the data collected is misused or disclosed, the said officer may be subject to suit in US court by the victim. Under Section 702, “a data subject who succeeds in suing an individual for conducting unauthorized surveillance may receive actual damages of not less than $1,000 USD, statutory damages of $100 USD per day of unlawful surveillance, and the award of additional punitive damages and attorney’s fees where appropriate."
Under the ECPA, a suppression remedy is available when there is an interception of wire and oral communications. Individuals may also sue U.S. companies for remedies if said companies engage in activity that violates federal and/or state privacy laws and said lawsuits are available notably under the SCA or Wiretap Act. Under the SCA, victims may bring a claim for damages against a service provider if they violated the act in disclosing their communications data and did not act in good faith.
As mentioned above, the Data Protection Review Court (DPRC) is another avenue where individuals can submit complaints of alleged violations of the US government’s surveillance activity in collecting or handling an individual's data. The DPRC is a part of a two-level redress mechanism working alongside the ODNI’s CLPO. To be reviewed by the court, the complainant must be verified by the appropriate public authority, be from a designated country, and satisfy the criteria for a complaint. Once the criteria are satisfied, the public authority submits the complaint to the CLPO for review. If the complaint qualifies, the CLPO
investigates if a violation occurred and what the remedy should be. The CLPO then informs the complainant of its complete review. If the individual is not satisfied with the results, they can request a DPRC review. The CLPO or the DPRC can take appropriate remediation measure including: (1) administrative measures to remedy procedural or technical violations relating to
otherwise lawful access; (2) terminating acquisition of data where collection is not lawfully authorized; (3) deleting data acquired without lawful authorization; (4) deleting results of inappropriate queries on lawfully collected data; and (5) restricting access to data.
California’s CalECPA makes available remedies for victims, including that “any person in a trial, hearing, or proceeding may move to suppress any electronic information obtained or retained in violation of the Fourth Amendment to the United States Constitution or of [CalECPA]." CalECPA also allows, “individuals, service providers, and others involved in investigations to petition the issuing courts to ‘order the destruction of any information obtained in violation of [CalECPA], or the California Constitution, or the United States Constitution."