26 Jan Legal flaws in the legal protections of secret surveillance led to a violation of Article 8 of the Convention

In the case of Ekimdzhiev and Others v. Bulgaria (application no. 70078/12, 11.01.2022) the European Court of Human Rights held, unanimously, that there had been a violation of Article 8 (right to respect for private life and correspondence) of the European Convention on Human Rights, in respect of secret surveillance, and a violation of Article 8 in respect of retention and accessing of communication data.

The case concerned secret surveillance and the system of retention and subsequent accessing of communications data in Bulgaria. The applicants alleged that under the system of secret surveillance in Bulgaria the communications of anyone in the country could be intercepted, and that under the system of retention and subsequent accessing of communications data in Bulgaria the communications data of anyone in the country could be accessed by the authorities. 

Under the main relevant pieces of legislation (the Special Surveillance Means Act 1997 and Articles 172 to 176 of the Code of Criminal Procedure), covert surveillance is legal in Bulgaria. This includes, among other methods, visual surveillance, interception of telephone and electronic communications and eavesdropping.

The Court found it established that the grounds for surveillance set out in law met the Convention requirements, with the exception of the term “objects”, which was insufficiently clear within the meaning of section 12(1) of the Special Surveillance Means Act 1997. It found that there was a lack of proper judicial oversight over decisions to issue warrants. In terms of storing, accessing and destroying data, the Court found that the lack of clear regulation had led to a situation where secret surveillance data could be used for nefarious purposes.  Regarding oversight by the authorities, the Court considered that the specific body’s (the National
Bureau for Control of Special Means of Surveillance) independence could not be guaranteed.

In terms of the process for accessing data, the Court noted that requests did not have to give supporting material, and the decisions themselves did not have to be reasoned. Overall, it did not effectively guarantee that access was granted only when genuinely necessary and proportionate in each case. 

In terms of notification, the Government had not provided sufficient information on the new data- protection procedures. In the absence of such information, the Court had to consider the notification procedure inadequate. As the laws governing retention and accessing communications data did not meet the quality of-law requirement of the Convention, they were incapable of limiting such retention and accessing to what was necessary, leading to a violation of Article 8.

References from the official website of the European Court of Human Rights