Surveillance of communications, including by introducing bulk interception regimes, has been to the forefront of legal developments on the issue of surveillance in recent years. Not only the increased data flow online, but also the technical sophistication of surveillance tools increases the risk of citizens, including journalists, becoming \u201ctransparent persons\u201d[footnote]This term, which was originally used the debates around the 1982 German census law, describes the extensive collection of personal data by public authorities.[\/footnote] for state authorities. According to the UN Special Rapporteur on freedom of expression:<\/p>\n\n\n\n
\n\u201cTechnological advancements mean that the State\u2019s effectiveness in conducting surveillance is no longer limited by scale or duration. [\u2026] As such, the State now has greater capability to conduct simultaneous, invasive, targeted and broad-scale surveillance than ever before.\u201d[footnote]UN Human Rights Council, Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression (17 April 2013), para 33, A\/HRC\/23\/40, (accessible at https:\/\/www.ohchr.org\/sites\/default\/files\/Documents\/HRBodies\/HRCouncil\/RegularSession\/Session23\/A.HRC.23.40_EN.pdf).[\/footnote]<\/p>\n<\/blockquote>\n\n\n\n
What is bulk data interception?<\/strong><\/h2>\n\n\n\n
Bulk data interception is defined as \u201cthe gathering of large chunks of internet traffic from around the world\u201d in situations where the target is unknown, and the intent of the measure is to discover rather than to investigate.[footnote]Big Brother Watch, Interception (undated) (accessible at https:\/\/www.bigbrotherwatch.org.uk\/wp-content\/uploads\/2016\/03\/Interception.pdf).[\/footnote] The data gathered can include, besides the content of the communication, the circumstances of its transmission, including the \u201cwho\u201d, \u201cwhen\u201d and \u201cwhere\u201d.[footnote]N\u00f3ra N\u00ed Loide\u00e1in, Bulk Surveillance: Europe\u2019s Recent Landmark Judgements (5 July 2021), (accessible at https:\/\/digitalfreedomfund.org\/bulk-surveillance-europes-recent-landmark-judgements\/).[\/footnote] It is closely linked to mass surveillance, which \u201cinvolves the acquisition, processing, generation, analysis, use, retention or storage of information about large numbers of people, without any regard to whether they are suspected of wrongdoing.\u201d[footnote]Privacy International, Mass Surveillance (undated), (accessible at https:\/\/privacyinternational.org\/learn\/mass-surveillance),[\/footnote]<\/p>\n\n\n\n
Such practices \u2013 as well as targeted surveillance measures \u2013 infringe on the right to privacy (Article 17 ICCPR, Article 8 ECHR), as authorities gain access to intimate private and professional data. In addition, the knowledge \u2013 or even suspicion \u2013 of being surveilled undermines the right to freedom of expression (Article 19 ICCPR, Article 10 ECHR), as the fear of unwillingly disclosing online activity or the identity of journalistic sources creates a chilling effect and leads to self-censorship, in particular in repressive environments.<\/p>\n\n\n\n
International legal standards<\/strong><\/h2>\n\n\n\n
Various UN bodies have expressed concern over the human rights impact of surveillance measures. For instance, the UN Human Rights Committee has stated that \u201c[s]urveillance, whether electronic or otherwise, interceptions of telephonic, telegraphic and other forms of communication, wire-tapping and recording of conversations should be prohibited.\u201d[footnote]UN Human Rights Committee, General Comment No. 16: Article 17 (The right to respect of privacy, family, home and correspondence, and protection of honour and reputation) (1988), para 8, HRI\/GEN\/1\/Rev.1 (accessible at https:\/\/tbinternet.ohchr.org\/_layouts\/15\/treatybodyexternal\/Download.aspx?symbolno=INT\/CCPR\/GEC\/6624&Lang=en).[\/footnote] It further stated that to comply with the requirements of Article 17 ICCPR, the right to privacy, the \u201cintegrity and confidentiality of correspondence should be guaranteed de jure and de facto.\u201d[footnote]Ibid.<\/em>[\/footnote]<\/p>\n\n\n\n
Communications surveillance has been described as a \u201chighly intrusive act\u201d which can only be justified in the most exceptional circumstances and must be accompanied by sufficient safeguards.[footnote]UN Human Rights Council, Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression (17 April 2013), para 81, A\/HRC\/23\/40, (accessible at https:\/\/www.ohchr.org\/sites\/default\/files\/Documents\/HRBodies\/HRCouncil\/RegularSession\/Session23\/A.HRC.23.40_EN.pdf) available at[\/footnote] Beyond this \u2013 as criticised by the UN Special Rapporteur on counter-terrorism in 2014 \u2013 \u201c[b]ulk access technology is indiscriminately corrosive of online privacy and impinges on the very essence of the right guaranteed by article 17 [ICCPR]\u201d[footnote]Special Rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism, Promoting and protecting human rights and fundamental freedoms while countering terrorism (23 September 2023), A\/69\/397, paras 47 and 59.[\/footnote] as it \u201ceradicates the possibility of any individualized proportionality analysis.\u201d[footnote]Ibid. para 12.[\/footnote] Aligned with this assessment, the UN Office of the High Commissioner for Human Rights (OHCHR) has also stressed that indiscriminate mass surveillance, and communications interception, collecting, storing and analysing of all users, is \u201cnot permissible under international human rights law, as an individualized necessity and proportionality analysis would not be possible in the context of such measures.\u201d[footnote]UN OHCHR, Report on best practices and lessons learned on how protecting and promoting human rights contribute to preventing and countering violent extremism (21 July 2016), A\/HRC\/33\/29, para 58, (accessible at https:\/\/documents.un.org\/doc\/undoc\/gen\/g16\/162\/55\/pdf\/g1616255.pdf?token=7ZE6OZPumcc3EEN1ef&fe=true) available at; see also: UN OHCHR, The right to privacy in the digital age (3 August 2018), A\/HRC\/39\/29, para 17, (accessible at https:\/\/documents.un.org\/doc\/undoc\/gen\/g18\/239\/58\/pdf\/g1823958.pdf?token=vHBHl8grgdBvUurNtZ&fe=true).[\/footnote] According to the OHCHR, \u201cthe mere possibility of communications information being captured\u201d and thus the very existence of a mass surveillance programme, interferes with the right to privacy.[footnote]UN OHCHR, The right to privacy in the digital age (30 June 2014), A\/HRC\/27\/37, para 20,(accessible at https:\/\/documents.un.org\/doc\/undoc\/gen\/g14\/088\/54\/pdf\/g1408854.pdf?token=fFdsUu2JQmijfG6MYr&fe=true)[\/footnote]<\/p>\n\n\n\n
Regional standards: EU<\/strong><\/h2>\n\n\n\n
For almost a decade, mass surveillance measures have been subject to interpretation by European courts. The Court of Justice of the European Union (CJEU), in particular, has dealt with the topic of data retention measures extensively in a number of landmark judgments, raising concerns about, inter alia, the fact that the retained data allows authorities to draw very precise conclusions about the private life of the individuals concerned.[footnote]See for instance CJEU, Judgment of the Court (Grand Chamber) concerning SpaceNet AG and Telekom Deutschland GmbH v Bundesrepublik Deutschland (20 September 2022), paras 117 and 184.[\/footnote]<\/p>\n\n\n\n
\n
- In its judgment regarding the case Digital Rights Ireland\/Seitlinger and Others<\/a> (2014), the CJEU invalidated the Data Retention Directive (EU Directive 2006\/24\/EC), which, inter alia, required telecommunications providers to retain all users\u2019 traffic and location data for prolonged periods. The CJEU invalidated the Directive on the basis that it interfered with the right to respect for private and family life and the protection of personal data in a \u201cparticularly serious\u201d and disproportionate manner.[footnote]CJEU, Judgment of the Court (Grand Chamber) concerning Digital Rights Ireland Ltd v Minister of Communications, Marine and Natural Resources and Others and K\u00e4rtener Landesregierung and Others, Joined Cases C-293\/12 and C-594\/12 (8 April 2014), paras 37 and 69.[\/footnote]<\/li>\n<\/ul>\n\n\n\n
\n
- Two years later, in Tele2 Sverige AB\/Watson and Others<\/a> (2016), the CJEU built on these findings, holding that EU law precluded domestic legislation imposing an obligation on electronic communications services to generally and indiscriminately retain traffic and location data for the purpose of fighting crime.[footnote]CJEU, Judgment of the Court (Grand Chamber) concerning Tele2 Sverige AB v Post- ich telestyrelsen and Secretary of State for the Home Department v Tom Watson and Others, Joined Cases C-203\/15 and C-698\/15 (21 December 2016), para 112.[\/footnote] The CJEU at the same time clarified that the targeted retention of data, limited to what is strictly necessary, and imposed by clear and precise legislation containing sufficient safeguards is not precluded by EU law.[footnote]Ibid. para 108.[\/footnote]<\/li>\n<\/ul>\n\n\n\n
\n
- In the case of Privacy International<\/a> (2020), the CJEU reiterated the prohibition of general and indiscriminate retention of data. The case required it to consider the application of EU law to domestic legislation requiring communications service providers to retain data and\/or forward it to national security and intelligence services.[footnote]CJEU, Judgment of the Court (Grand Chamber) concerning Privacy International v Secretary of State for Foreign and Commonwealth Affairs and Others, Case C-623\/17 (6 October 2020), para 82.[\/footnote] The CJEU expanded on its findings in the Tele2 case, holding that EU law precludes domestic legislation which requires electronic communication service providers to generally and indiscriminately transmit traffic and location data to security and intelligence agencies<\/em> for the purpose of safeguarding national security.[footnote]Ibid. para 49; see for an analysis for instance Monika Zalnieriute, A Dangerous Convergence: The Inevitability of Mass Surveillance in European Jurisprudence (4 June 2021), (accessible at https:\/\/www.ejiltalk.org\/a-dangerous-convergence-the-inevitability-of-mass-surveillance-in-european-jurisprudence\/)and Juraj Sajfert, Bulk data interception\/retention judgments of the CJEU \u2013 A victory and a defeat for privacy (26 October 2020), (accessible at https:\/\/europeanlawblog.eu\/2020\/10\/26\/bulk-data-interception-retention-judgments-of-the-cjeu-a-victory-and-a-defeat-for-privacy\/).[\/footnote] In the joined case of La Quadrature du Net and Others<\/a> (2020), the CJEU held that an order requiring general and indiscriminate location and traffic data retention can be justified where the state is facing a serious, genuine and present or foreseeable threat to national security.[footnote]CJEU, Judgment of the Court (Grand Chamber) concerning La Quadrature du Net and Others v Premier minister and Others, Joined Cases C-511\/18, C-512\/18 and C-520\/18 (6 October 2020), para 168.[\/footnote] While this order must be limited in time to what is strictly necessary, it may be extended if the threat persists.[footnote]Ibid.<\/em>[\/footnote]<\/li>\n<\/ul>\n\n\n\n
Additionally, the CJEU clarified requirements for targeted retention as well as retention of IP addressed and other data allowing the identification of users, classifying some types of data as \u201cless sensitive\u201d.[footnote]Ibid<\/em>. paras 152, 168.[\/footnote]<\/p>\n\n\n\n