Personal Data [ECHR]
Data reflecting Sexual Orientation
Drelon v. France concerned, first, the collection and retention, by the French blood donation service (EFS) of personal data reflecting the applicant’s presumed sexual orientation – together with the rejection of his criminal complaint for discrimination – and, second, the refusal of his offers to donate blood, together with the dismissal by the Conseil d’État of his judicial review application challenging an order of 5 April 2016 which amended the selection criteria for blood donors.
The Court held that there had been a violation of Article 8 of the Convention on account of the collection and retention of the personal data concerned. Whilst the collection and retention of personal data concerning blood donor candidates contributed to guaranteeing blood safety, it was nevertheless particularly important for the sensitive data involved to be accurate, up-to-date, pertinent and non-excessive in relation to the goals pursued; and the data retention period had to be limited to what was necessary.
The Court observed, first, that even though the applicant had refused to answer the questions about his sex life during the medical examination prior to the blood donation, the data included a contraindication to giving blood that was specific to men who had intercourse with other men. It concluded that the data in question was based on mere speculation without any proven factual basis.
Criminal Investigation
Ben Faiza v. France case concerned surveillance measures taken against the applicant in a criminal investigation into his involvement in drug-trafficking offences.
The Court held that there had been a violation of Article 8 of the Convention as regards the real-time geolocation of the applicant’s vehicle by means of a GPS device on 3 June 2010, finding that, in the sphere of real-time geolocation measures, French law (neither statute law nor case-law) did not at the relevant time indicate with sufficient clarity to what extent and how the authorities were entitled to use their discretionary power.
The Court further held that there had been no violation of Article 8 concerning the court order issued to a mobile telephone operator on 24 July 2009 to obtain the list of cell towers pinged by the applicant’s phone for subsequent tracking of his movements. It noted in particular that the court order had constituted an interference with the applicant’s private life but was in accordance with the law.
Further, the order had been aimed at establishing the truth in the context of criminal proceedings for the importing of drugs in an organised gang, criminal conspiracy and money laundering, and had thus pursued the legitimate aims of preventing disorder or crime or protecting public health. The Court also considered that the measure had been necessary in a democratic society because it was aimed at breaking up a major drug-trafficking operation. Lastly, the information obtained had been used in an investigation and a criminal trial during which the applicant had been guaranteed an effective review consistent with the rule of law.
Dragojević v. Croatia y concerned the secret surveillance of telephone conversations of a drug-trafficking suspect. The Court held that there had been a violation of Article 8 of the Convention. It found in particular that Croatian law, as interpreted by the national courts, did not provide reasonable clarity as to the authorities’ discretion in ordering surveillance measures and it did not in practice – as applied in the applicant’s case – provide sufficient safeguards against possible abuse.
In R.E. v. the United Kingdom the applicant, who was arrested and detained in Northern Ireland on three occasions in connection with the murder of a police officer, complained in particular about the regime for covert surveillance of consultations between detainees and their lawyers and between vulnerable detainees and “appropriate adults” The Court held that there had been a violation of Article 8 of the Convention as concerned the covert surveillance of legal consultations. The Court further held that there had been no violation of Article 8 as concerned the covert surveillance of consultations between detainees and their “appropriate adults”, finding in particular that they were not subject to legal privilege and therefore a detainee would not have the same expectation of privacy as for a legal consultation.
Employment
Florindo de Almeida Vasconcelos Gramaxo v. Portugal case concerned the applicant’s dismissal on the basis of data obtained from a geolocation system fitted in the car which his employer had made available to him for the purposes of his work as a medical representative. The Court held that there had been no violation of Article 8 of the Convention, finding that the national authorities had not failed to comply with their positive obligation to protect the applicant’s right to respect for his private life.
In the applicant’s case, the Court considered that the Court of Appeal had carried out a detailed balancing exercise between the applicant’s right to respect for his private life and his employer’s right to ensure the smooth running of the company, taking into account the legitimate aim pursued by the company, namely the right to monitor its expenditure. Hence, the State had not overstepped its margin of appreciation in the present case. The Court also held that there had been no violation of Article 6 § 1 (right to a fair trial) of the Convention, finding that the use in evidence of the geolocation data relating to the distances driven by the applicant in his company vehicle had not undermined the fairness of the proceedings in the present case.
Mass Surveillance
Roman Zakharov v. Russia case concerned the system of secret interception of mobile telephone communications in Russia. The Court held that there had been a violation of Article 8 of the Convention, finding that the Russian legal provisions governing interception of communications did not provide for adequate and effective guarantees against arbitrariness and the risk of abuse which was inherent in any system of secret surveillance, and which was particularly high in a system such as in Russia where the secret services and the police had direct access, by technical means, to all mobile telephone communications.
Szabó and Vissy v. Hungary concerned Hungarian legislation on secret anti-terrorist surveillance introduced in 2011.In this case the Court held that there had been a violation of Article 8 of the Convention. It accepted that it was a natural consequence of the forms taken by present-day terrorism that governments resort to cutting-edge massive monitoring of communications, in pre-empting impending incidents. However, the Court was not convinced that the legislation in question provided sufficient safeguards to avoid abuse..
The Court further held that there had been no violation of Article 13 (right to an effective remedy) of the Convention taken together with Article 8, reiterating that Article 13 could not be interpreted as requiring a remedy against the state of domestic law.
Mustafa Sezgin Tanrıkulu v. Turkey applicant complained about a domestic court decision of 2005 allowing the interception of communications of anyone in Turkey, including himself, for about a month and a half.The Court held that there had been a violation of Article 8 of the Convention, finding that the interception order in the present case was not in accordance with the law. The Court also held that there had been a violation of Article 13 (right to an effective remedy) of the Convention.
Benedik v. Slovenia concerned the Slovenian police’s failure to obtain a court order to access subscriber information associated with a dynamic IP address recorded by the Swiss law- enforcement authorities during their monitoring of users of a certain file-sharing networkThe Court held that there had been a violation of Article 8 of the Convention. The provision had lacked clarity, offered virtually no protection from arbitrary interference, had no safeguards against abuse and no independent supervision of the police powers involved.
Hambardzumyan v. Armenia alleged that the police had not had a valid court warrant to place her under secret surveillance during a criminal investigation. The Court held that there had been a violation of Article 8 of the Convention, finding that the surveillance measure used against the applicant had not had proper judicial supervision and had not been “in accordance with the law” within the meaning of the Convention.
Hacking
Privacy International and Others v. the United Kingdom The applicants believed that their equipment had been subject to interference, colloquially known as “hacking”, over an undefined period by the United Kingdom Government Communications Headquarters and/or the Secret Intelligence Service. The Court noted in particular the general arguments advanced by the applicants and also underlined in the interventions of the third parties that the surveillance complained of was particularly intrusive and that there was a need for safeguards in this domain. In that respect, it recalled the importance of examining compliance with the principles of Article 8 of the Convention where the powers vested in the State are obscure, creating a risk of arbitrariness especially where the technology available is continually becoming more sophisticated.
Big Brother Watch and Others v. the United Kingdom concerned complaints by journalists and human-rights organisations in regard to three different surveillance regimes: (1) the bulk interception of communications; (2) the receipt of intercept material from foreign governments and intelligence agencies; (3) the obtaining of communications data from communication service providers1
The Grand Chamber held: unanimously, that there had been a violation of Article 8 of the Convention in respect of the bulk intercept regime; unanimously, that there had been a violation of Article 8 in respect of the regime for obtaining communications data from communication service providers; by twelve votes to five, that there had been no violation of Article 8 in respect of the United Kingdom’s regime for requesting intercepted material from foreign Governments and intelligence agencies;
Centrum För Rättvisa v. Swedencase concerned the alleged risk that the applicant foundation’s communications had been or would be intercepted and examined by way of signals intelligence, as it communicated on a daily basis with individuals, organisations and companies in Sweden and abroad by email, telephone and fax, often on sensitive matters.
The Grand Chamber held, by fifteen votes to two, that there had been a violation of Article 8 of the Convention. It found, in particular, that although the main features of the Swedish bulk interception regime met the Convention requirements on quality of the law, the regime nevertheless suffered from three defects: the absence of a clear rule on destroying intercepted material which did not contain personal data; the absence of a requirement in the Signals Intelligence Act or other relevant legislation that, when making a decision to transmit intelligence material to foreign partners, consideration was given to the privacy interests of individuals; and the absence of an effective ex post facto review. As a result of these deficiencies, the system did not meet the requirement of “end-to-end” safeguards, it overstepped the margin of appreciation left to the respondent State in that regard, and overall did not guard against the risk of arbitrariness and abuse.
Monitoring of Employees’ Computer Use
Bărbulescu v. Romania concerned the decision of a private company to dismiss an employee – the applicant – after monitoring his electronic communications and accessing their contents. The Grand Chamber held, by eleven votes to six, that there had been a violation of Article 8 of the Convention, finding that the Romanian authorities had not adequately protected the applicant’s right to respect for his private life and correspondence.
In particular, the national courts had failed to determine whether the applicant had received prior notice from his employer of the possibility that his communications might be monitored; nor had they had regard either to the fact that he had not been informed of the nature or the extent of the monitoring, or the degree of intrusion into his private life and correspondence..
Libert v. France concerned the dismissal of an SNCF (French national railway company) employee after the seizure of his work computer had revealed the storage of pornographic files and forged certificates drawn up for third persons. The Court held that there had been no violation of Article 8 of the Convention. The Court noted in particular that the consultation of the files by the applicant’s employer had pursed a legitimate aim of protecting the rights of employers, who might legitimately wish to ensure that their employees were using the computer facilities which they had placed at their disposal in line with their contractual obligations and the applicable regulations.
Dragan Petrović v. Serbia concerned a police search of the applicant’s flat and the taking of a saliva sample from him for a DNA analysis during a murder investigation. The Court held that there had been no violation of Article 8 of the Convention as regards the police search of the applicant’s apartment, finding that the search warrant had been specific enough and had been attended by adequate and effective safeguards against abuse during the search itself. It held, however, that there had been a violation of Article 8 owing to the taking of a DNA saliva sample from the applicant, finding that the taking of the DNA saliva sample had not been “in accordance with the law” within the meaning of Article 8.
Antović and Mirković v. Montenegro case concerned an invasion of privacy complaint by two professors at the University of Montenegro’s School of Mathematics after video surveillance had been installed in areas where they taught. The Court held that there had been a violation of Article 8 of the Convention, finding that the camera surveillance had not been in accordance with the law. In this regard the Court noted in particular that it had previously found that private life might include professional activities and considered that was also the case with the applicants.
López Ribalda and Others v. Spain concerned the covert video-surveillance of employees which led to their dismissal. The applicants complained about the covert video-surveillance and the Spanish courts’ use of the data obtained to find that their dismissals had been fair. The Grand Chamber held that there had been no violation of Article 8 of the Convention in respect of the five applicants.
A key argument made by the applicants was that they had not been given prior notification of the surveillance, despite such a legal requirement, but the Court found that there had been a clear justification for such a measure owing to a reasonable suspicion of serious misconduct and to the losses involved, taking account of the extent and the consequences of the measure. In the present case the domestic courts had thus not exceeded their power of discretion (“margin of appreciation”) in finding the monitoring proportionate and legitimate. The Court also held that there had been no violation of Article 6 § 1 (right to a fair trial) of the Convention, finding in particular that the use of the video material as evidence had not undermined the fairness of the trial.
Sõro v. Estonia case concerned the applicant’s complaint about the fact that information about his employment during the Soviet era as a driver for the Committee for State Security of the USSR (the KGB) had been published in the Estonian State Gazette in 2004.
The Court held that there had been violation of Article 8 of the Convention, finding that in the applicant’s case this measure had been disproportionate to the aims sought. The Court noted in particular that, under the relevant national legislation, information about all employees of the former security services – including drivers, as in the applicant’s case – was published, regardless of the specific function they had performed.
Storage and use of personal data
Brunet v. France 2014 The applicant complained in particular of an interference with his private life as a result of being added to the police database STIC (system for processing recorded offences) – containing information from investigation reports, listing the individuals implicated and the victims – after the discontinuance of criminal proceedings against him.
The Court held that there had been a violation of Article 8 of the Convention, finding that the French State had overstepped its discretion to decide (“margin of appreciation”) on such matters: the retention could be regarded as a disproportionate breach of the applicant’s right to respect for his private life and was not necessary in a democratic society. The Court considered in particular that the applicant had not had a real possibility of seeking the deletion from the database of the information concerning him and that the length of retention of that data, 20 years, could be assimilated, if not to indefinite retention, at least to a norm rather than to a maximum limit.
Karabeyoğlu v. Turkey concerned a telephone surveillance operation in respect of the applicant, a public prosecutor, during a criminal investigation into an illegal organisation known as Ergenekon, and the use of the information thus obtained in the context of a separate disciplinary investigation.
The Court held that there had been no violation of Article 8 of the Convention as regards the telephone tapping in connection with the criminal investigation and a violation of Article 8 as regards the use in disciplinary proceedings of the information obtained by means of telephone tapping.. In the Court’s view, the interference with the applicant’s right to respect for his private life had been necessary in the interests of national security and for the prevention of disorder and crime.
Figueiredo Teixeira v. Andorra concerned the storage and communication to the judicial authority of data from telephone calls made by the applicant, who was suspected of the serious offence of drug trafficking.The Court held that there had been no violation of Article 8 of the Convention. It found in particular that since the impugned interference was prescribed in Andorran law under Article 87 of the Code of Criminal Procedure and Law No. 15/2003 on the protection of personal data, a person holding a prepaid mobile phone card could reasonably have expected those provisions to be applied in his case.
Aycaguer v. France The applicant alleged that there had been a breach of his right to respect for his private life on account of the order to provide a biological sample for inclusion in the national computerised DNA database (FNAEG) and the fact that his refusal to comply with that order had resulted in a criminal conviction.
The Court held that there had been a violation of Article 8 of the Convention. It observed in particular that on 16 September 2010 the Constitutional Council had given a decision to the effect that the provisions on the FNAEG were in conformity with the Constitution, subject inter alia to “determining the duration of storage of such personal data depending on the purpose of the file stored and the nature and/or seriousness of the offences in question”. The Court noted that, to date, no appropriate action had been taken on that reservation and that there was currently no provision for differentiating the period of storage depending on the nature and gravity of the offences committed.
The Court also ruled that the regulations on the storage of DNA profiles in the FNAEG did not provide the data subjects with sufficient protection, owing to its duration and the fact that the data could not be deleted. The regulations therefore failed to strike a fair balance between the competing public and private interests.
Catt v. the United Kingdom 2019 concerned the complaint of the applicant, a lifelong activist, about the collection and retention of his personal data in a police database for “domestic extremists”. The Court held that there had been a violation of Article 8 of the Convention. It found in particular that the data held on the applicant concerned his political views and that such information required particular protection. The Court also had regard to the applicant’s age (94), and the fact he had no history or prospect of committing acts of violence. The Court further noted that, while collecting the information on him had been justified, retaining it had not, particularly owing to a lack of safeguards, such as time-limits.
Gaughran v. the United Kingdom 2020 concerned a complaint about the indefinite retention of personal data (DNA profile, fingerprints and photograph) of a man who had a spent conviction for driving with excess alcohol in Northern Ireland.
The Court held that there had been a violation of Article 8 of the Convention, finding that the United Kingdom had overstepped the acceptable margin of appreciation and the retention at issue constituted a disproportionate interference with the applicant’s right to respect for private life, which could not be regarded as necessary in a democratic society.
The Court underlined in particular that it was not the duration of the retention of data that had been decisive, but the absence of certain safeguards. In the applicant’s case his personal data had been retained indefinitely without consideration of the seriousness of his offence, the need for indefinite retention and without any real possibility of review. Noting also that the technology being used had been shown to be more sophisticated than that considered by the domestic courts in this case, particularly regarding storage and analysis of photographs, the Court considered that the retention of the applicant’s data had failed to strike a fair balance between the competing public and private interests.
Algirdas Butkevičius v. Lithuania 2022 concerned a telephone conversation between the applicant – who, at the time, was the Prime Minister of Lithuania – and a mayor that was secretly recorded during a pre-trial investigation into possible corruption in connection with territorial planning and was made public at a hearing of the Lithuanian Parliament’s (Seima’s) Anti-Corruption Commission.
The applicant complained that the State authorities had breached his right to private life and correspondence by disclosing the telephone conversation to the media. He submitted in particular that the prosecutor and the Anti-Corruption Commission had not properly protected that information as they had been required to by law.
The Court held that there had been no violation of Article 8 (right to respect for private life and correspondence) of the Convention in respect of the applicant, finding that, even if his reputation among his colleagues had been dinted by the disclosure of his telephone conversation, there were no factual grounds, let alone evidence, to indicate that it had been affected to a disproportionate degree.
The Court noted in particular that the applicant had not pointed to any concrete and tangible repercussions which the media’s disclosure of the telephone conversation had had on his private life, all the more so as he had not been convicted of anything and the Chief Official Ethics Commission had established nothing untoward in the conversation. It also reiterated the importance of public scrutiny in cases of possible political corruption.
Haščák v. Slovakia 2022 concerned a surveillance operation (“the Gorilla operation”) carried out in 2005 and 2006 by the Slovak Intelligence Service (SIS) and the intelligence material obtained by it. The applicant – a prominent businessman associated with an influential finance group and a business partner of the applicant in the case of Zoltán Varga v. Slovakia (judgment of 20 July 2021) – complained, in particular, that there had been a lack of effective supervision and review of the implementation of two surveillance warrants issued by the Bratislava Regional Court in the mid-2000s, that the applicable framework provided no protection to individuals randomly affected by surveillance measures, and that the internal rules applicable to the retention of intelligence material were inadequate.
The Court held that there had been a violation of Article 8 (right to respect for private life) of the Convention concerning the implementation of the two warrants and the retention of the analytical material. It firstly stated that to a significant extent, the applicant’s complaints under Article 8 were identical and arose from an identical factual and procedural background to that examined in the case of Zoltán Varga. It therefore applied that case-law to the present case. While there had been a basis in law, the Court observed in particular that the operation had had numerous deficiencies, some of which had been recognised at the domestic level in response to complaints and actions of Mr Varga. Although the domestic courts made no such findings in the individual case ofthe applicant, they were relevant to the assessment of his case.
The Court reiterated that, as in Zoltán Varga, when implementing the surveillance warrants the SIS had practically enjoyed discretion amounting to unfettered power, which had not been accompanied by a measure of protection against arbitrary interference, as required by the rule of law. Furthermore, that situation had been aggravated by the uncontested fact that the applicant had not himself been the target of the surveillance under the first of the two warrants, in the light of his unchallenged argument that the law provided no protection to persons randomly affected by surveillance measures, and by the fundamental uncertainty around the practical and procedural status of the audio recording retrieved in 2018, presumably of SIS provenance. The Court lastly noted that it had previously held in Zoltán Varga that the storing of the analytical material obtained in the surveillance operation had been subject to confidential rules with no external oversight. The retention had therefore not been in accordance with the law. The Court ruled that that also applied in the present case.
Social Insurance Proceedings
Vukota-Bojić v. Switzerland 2016
The applicant had been involved in a road traffic accident, and subsequently requested a disability pension. Following a dispute with her insurer on the amount of disability pension and years of litigation later, her insurer requested that she undergo a fresh medical examination, in order to establish additional evidence about her condition. When she refused, the insurer hired private investigators to conduct secret surveillance of her. The evidence that they obtained was used in subsequent court proceedings, which resulted in a reduction of the applicant’s benefits. She complained that the surveillance had been in breach of her right to respect for private life, and that it should not have been admitted in the proceedings.
The Court held that there had been a violation of Article 8 of the Convention. It found in particular that the insurer’s actions engaged state liability under the Convention, since the respondent insurance company was regarded as a public authority under Swiss law. It also held that the secret surveillance ordered had interfered with the applicant’s private life, even though it had been carried out in public places, since the investigators had collected and stored data in a systematic way and had used it for a specific purpose.
Furthermore, the surveillance had not been prescribed by law, since provisions of Swiss law on which it had been based were insufficiently precise. In particular, they had failed to regulate with clarity when and for how long surveillance could be conducted, and how data obtained by surveillance should be stored and accessed. The Court further found that the use of the surveillance evidence in the applicant’s case against her insurer had not made the proceedings unfair and therefore held that there had been no violation of Article 6 (right to a fair trial) of the Convention. In this respect it noted in particular that the applicant had been given a fair opportunity to challenge the evidence obtained by the surveillance, and that the Swiss court had given a reasoned decision as to why it should be admitted.
Mehmedovic v. Switzerland 2018 concerned the surveillance of an insured person (the first applicant) and, indirectly, his wife, in public areas by investigators from an insurance company, with a view to ascertaining whether his claim for compensation, lodged following an accident, was justified.
The Court declared the application inadmissible as being manifestly ill-founded. In the first place, it noted that the insurance company’s investigations, which had been conducted from a public place and were confined to ascertaining the first applicant’s mobility, were aimed solely at protecting the insurer’s pecuniary rights. In this connection, the Court held that the domestic courts had found that the insurer had an overriding interest that meant that the interference with the applicant’s personality rights was lawful. Secondly, the Court noted that the sparse information concerning the second applicant, which had been gathered coincidentally and was of no relevance for the investigation, in no way constituted systematic or permanent gathering of data. In the Court’s view, there had therefore been no interference with this applicant’s private life.
Telecommunication Service providers’ Data
Breyer v. Germany 2020 In accordance with 2004 amendments to the German Telecommunications Act companies had to collect and store the personal details of all their customers, including users of pre-paid SIM cards, which had not previously been required. The applicants, civil liberties activists and critics of State surveillance, were users of such cards and therefore had to register their personal details, such as their telephone numbers, date of birth, and their name and address, with their service providers. They complained about the storage of their personal data as users of pre-paid SIM cards.
The Court held that there had been no violation of Article 8 of the Convention, finding that, overall, Germany had not overstepped the limits of its discretion (“margin of appreciation”) it had in applying the law concerned, when choosing the means to achieve the legitimate aims of protecting national security and fighting crime, and that the storage of the applicants’ personal data had been proportionate and “necessary in a democratic society”.
There had thus been no violation of the Convention. The Court considered in particular that collecting the applicants’ names and addresses as users of pre-paid SIM cards had amounted to a limited interference with their rights. It noted, however, that the law in question had additional safeguards while people could also turn to independent data supervision bodies to review authorities’ data requests and seek legal redress if necessary.
Mass Disclosure
Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland After two companies had published the personal tax information of 1.2 million people, the domestic authorities ruled that such wholesale publication of personal data had been unlawful under data protection laws, and barred such mass publications in future. The Grand Chamber held, by fifteen votes to two, that there had been no violation of Article 10 (freedom of expression) of the Convention.
It noted in particular that the ban had interfered with the companies’ freedom of expression. However, it had not violated Article 10 because it had been in accordance with the law, it had pursued the legitimate aim of protecting individuals’ privacy, and it had struck a fair balance between the right to privacy and the right to freedom of expression.
.
Standard Verlagsgesellschaft mbH v. Austria (No. 3) concerned court orders for the applicant media company to reveal the sign-up information of registered users who had posted comments on its website, derStandard.at, the website of the newspaper Der Standard. The Court held that there had been a violation of Article 10 (freedom of expression) of the Convention in the present case, finding that the court orders in question had not been necessary in a democratic society.
Health data
Radu v. the Republic of Moldova 2014 The applicant, a lecturer at the Police Academy, complained about a State-owned hospital’s disclosure of medical information about her to her employer. The information was widely circulated at the applicant’s place of work and, shortly afterwards, she had a miscarriage due to stress.The Court held that there had been a violation of Article 8 of the Convention, finding that the interference with the exercise of the right to respect for private life complained of by the applicant was not “in accordance with the law” within the meaning of Article 8.
L.H. v. Latvia (no. 52019/07) The applicant alleged in particular that the collection of her personal medical data by a State agency without her consent had violated her right to respect for her private life. It held that there had been a violation of Article 8 of the Convention in the applicant’s case, finding that the applicable law had failed to indicate with sufficient clarity the scope of discretion conferred on competent authorities and the manner of its exercise.
Y.G. v. Russia (no. 8647/12)19 concerned the collection of health data, including that of the applicant, who was HIV-positive and suffered from hepatitis, in a database that was made available for sale at a market. The Court held that there had been a violation of Article 8 of the Convention, finding that the Russian authorities had failed to comply with their positive obligation to ensure adequate protection of the applicant’s right to respect for his private life.