Jump to ContentJump to Main Navigation
Bulk CollectionSystematic Government Access to Private-Sector Data$

Fred H. Cate and James X. Dempsey

Print publication date: 2017

Print ISBN-13: 9780190685515

Published to Oxford Scholarship Online: October 2017

DOI: 10.1093/oso/9780190685515.001.0001

Show Summary Details
Page of

PRINTED FROM OXFORD SCHOLARSHIP ONLINE (www.oxfordscholarship.com). (c) Copyright Oxford University Press, 2019. All Rights Reserved. An individual user may print out a PDF of a single chapter of a monograph in OSO for personal use. date: 09 December 2019

Preventing the Police State

Preventing the Police State

International Human Rights Laws Concerning Systematic Government Access to Communications Held or Transmitted by the Private Sector

Chapter:
(p.355) 19 Preventing the Police State
Source:
Bulk Collection
Author(s):

Sarah St. Vincent

Publisher:
Oxford University Press
DOI:10.1093/oso/9780190685515.003.0019

Abstract and Keywords

This chapter is intended as a basic reference guide for lawyers, legislators, and advocates approaching the issue of mass surveillance—or surveillance more generally—through the lens of international human rights law for the first time. It focuses on the International Covenant on Civil and Political Rights and the human rights treaties that apply in Europe and the Americas, with a particular emphasis on the rights to privacy, freedom of expression and opinion, and an effective remedy for violations. Although the exact parameters of the right to privacy are still being decided, it appears increasingly clear that state interferences with any kind of communications data will generally be subject to a standard of strict necessity applied on an individualized basis, and there is presently a trend toward finding that mass surveillance—including systematic state access to data held or transmitted by the private sector—violates the human rights treaties.

Keywords:   human rights, privacy, UN, freedom of expression, treaty obligations, surveillance

The maintenance of … dossiers about citizens who have never been charged with any violation of law and who have no means of refuting misinformation that may have been collected concerning them is an invitation to abuses of the gravest sort. Secret dossiers are paraphernalia of a police state. They are not proper instruments of a democratic government …

It does not matter that these invasions of what were once deemed inalienable rights have been adopted for the sake of national security … Dictatorship always has its origin in the assumption that men supposed to be benevolent may be entrusted with arbitrary authority.

ALAN BARTH, critiquing the United States government’s Employees Loyalty Program, 19511

(p.356) Powers of secret surveillance of citizens, characterising as they do the police state, are tolerable under the Convention only in so far as strictly necessary for safeguarding the democratic institutions.

European Court of Human Rights2

I. Abstract

This chapter is intended as a basic reference guide for lawyers, legislators, and advocates approaching the issue of mass surveillance—or surveillance more generally—through the lens of international human rights law for the first time. It focuses on the International Covenant on Civil and Political Rights and the human rights treaties that apply in Europe and the Americas, with a particular emphasis on the rights to privacy, freedom of expression and opinion, and an effective remedy for violations. Although the exact parameters of the right to privacy are still being decided, it appears increasingly clear that state interferences with any kind of communications data will generally be subject to a standard of strict necessity applied on an individualized basis, and there is presently a trend toward finding that mass surveillance—including systematic state access to data held or transmitted by the private sector—violates the human rights treaties.

II. Introduction

In an era when fears of deadly public violence are running high in many parts of the world, some political leaders have made little secret of their belief that one crucial means of preventing destruction and disorder is the state’s systematic access to individuals’ communications and related data—colloquially, mass surveillance.3 However, despite the apparent enthusiasm for these practices in a number of powerful states, international human rights laws and jurisprudence currently suggest that this type of activity is permissible only in a vanishingly (p.357) small set of circumstances, if at all. Moreover, the case law and commentary appear to be evolving toward a conclusion that state interferences with private communications and/or related data on a systematic and indefinite basis will always violate the human rights treaties in the absence of a valid derogation4 from those instruments.

The discussion below is intended as a basic reference guide for lawyers, legislators, and advocates who are approaching the issue of mass surveillance—or surveillance more generally—through the lens of international human rights law for the first time. It focuses on the International Covenant on Civil and Political Rights (ICCPR) and the human rights treaties that apply in Europe and the Americas, as the regional courts in those parts of the globe have been the most active in addressing surveillance-related matters. The chapter’s concern is with legal rather than policy considerations, and it adopts a relatively formalist approach, treating the various human rights instruments (and the jurisprudence of the regional courts) as strictly binding only upon the relevant states parties, although otherwise constituting persuasive authority. Similarly, it treats the views of the UN treaty bodies and Special Rapporteurs as persuasive but not conclusive. Additionally, it assumes that a state’s treaty obligations are binding (p.358) upon that state’s agents regardless of the purpose of the activity in question (e.g., “intelligence” or “law enforcement”).5

In the interest of brevity, this analysis does not address the question of whether a state’s obligations under any of the human rights treaties apply extraterritorially.6 It also does not address the human-rights-related responsibilities of the private-sector entities that transmit or store communications, although this is an important area of inquiry.7

Section III below examines the right to privacy as it applies to government efforts to acquire or monitor indiscriminately, or order the systematic retention of, Internet or telephone communications (and/or related data) that individuals have generated or transmitted using the services of corporate entities. Section IV examines the right to freedom of expression and opinion in this context, and also touches briefly upon the rights to freedom of thought, conscience, and religion; freedom of association; and freedom of assembly. Section V discusses the right to a remedy for violations of the foregoing rights as well as the right to freedom from discrimination in the enjoyment of these rights.

At the time of writing, several major cases concerning the application of human rights laws to mass surveillance remained pending before the European regional courts. The European Court of Human Rights (ECtHR), which is a Council of Europe8 institution and adjudicates claims that a state has violated (p.359) its obligations under the European Convention on Human Rights (ECHR), was considering three challenges to the United Kingdom’s surveillance practices.9 Readers are advised to consult the judgments in these cases when they become available, as they are likely to include landmark findings. Additionally, just as this chapter was being finalized, the Court of Justice of the European Union (CJEU)—which, inter alia, answers questions that the domestic courts of the EU Member States refer to it regarding how they should interpret and apply EU law—handed down its judgment in the joined cases of Tele2 Sverige AB and Watson and others, which concern the legality of state data-retention mandates.10

III. The Right to Private Life and Correspondence

As the discussion below demonstrates, privacy rights are a common thread that runs through the human rights instruments addressed in this chapter—a fact that serves as a powerful reminder that these rights are indeed rights and not mere considerations to be bartered away easily in the name of state security. Where government monitoring of communications is concerned, the gravity with which the international human rights bodies view any prospective intrusions on these rights is perhaps best captured by the early statement of the UN Human Rights Committee (HRC)—the body charged with monitoring states’ implementation of the ICCPR—in its General Comment on the right to privacy that communications surveillance in any form “should be prohibited.”11 Although the regional human rights courts have adopted a more qualified position (and even the HRC itself no longer appears to take such an absolutist stance),12 it is clear that the (p.360) right to privacy reflects a core set of concerns about human dignity and the position of the individual vis-à-vis the state. Thus, as the Inter-American Court of Human Rights (IACtHR) has stated, the evolution of technology in recent years does not mean that individuals should now necessarily find themselves in “a situation of vulnerability” where the possibility of government monitoring of communications is concerned: instead, “the State must increase its commitment to adapt the traditional forms of protecting the right to privacy to current times.”13

Although the exact parameters of the right remain the subject of ongoing debate before the human rights courts and treaty bodies, a number of aspects of state privacy obligations as they apply in the digital age appear to be crystallizing (although further confirmation remains necessary). One is that virtually any type of data the user of modern communications technology may generate will fall within the scope of the privacy rights found in the treaties; another is that state interferences with this data will generally be subject to a standard of strict necessity applied on an individualized basis. For these and other reasons, there is presently a trend toward finding that mass surveillance—including systematic state access to data held or transmitted by the private sector—violates the treaties.

The focus of the discussion below is on large-scale monitoring; however, the same treaty laws and norms will apply to any state interference with privacy rights.

A. The Nature of the Privacy Right(s) Articulated in the Human Rights Instruments

Although analyses of human rights law often begin with the Universal Declaration of Human Rights (UDHR), that document was in fact preceded by the American Declaration of the Rights and Duties of Man (American Declaration), a text the Inter-American Commission on Human Rights (IACHR) views as binding upon the members of the Organisation of American States even though it is not a treaty as such.14 (Thus, as far as the IACHR is concerned, the American (p.361) Declaration places binding obligations upon the United States of America—a state whose surveillance practices have been the subject of particular scrutiny since former National Security Agency contractor Edward Snowden disclosed a cache of classified documents in 2013.)15 Meanwhile, scholarly opinions regarding the precise legal status of the UDHR vary, although at least some of the document’s provisions are or may be expressive of customary international law (i.e., norms that states so commonly follow in practice, and that are supported by such a significant body of legal opinion, that they have become binding even upon those states that have not formally committed to them).16 In any event, both declarations show that privacy rights are a foundational concern at the international level: the American Declaration announces that “[e]‌very person has the right to the protection of the law against abusive attacks upon … his private and family life” as well as to “the inviolability and transmission of his correspondence,” whereas the UDHR states that no one may be “subjected to arbitrary interference with his privacy, family, home or correspondence” and that “[e]veryone has the right to the protection of the law against such interference.”17

In the years following their finalization, these two declarations gave rise to several human rights treaties that also contain rights to privacy. The ICCPR, an instrument open to signature by virtually any state, establishes such a right at Article 17 in terms nearly identical to those of the UDHR, save for the addition of “or unlawful” following “arbitrary.”18 The American Convention on Human Rights (ACHR), which members of the Organisation of American States may join, broadly echoes these provisions in mandating that “[n]‌o one may be the object of arbitrary or abusive interference with his private life, his family, his home, or his correspondence” and that individuals must enjoy the protection of the law in this regard; it also includes a right to the recognition of one’s “dignity” as part of the same article.19

(p.362) Meanwhile, in Europe, the ECHR and the Charter of Fundamental Rights of the European Union (EU Charter) both include privacy rights.20 The ECHR contains the most detailed provision on the right to privacy among all the instruments mentioned herein, establishing first that “[e]‌veryone has the right to respect for his private and family life, his home and his correspondence,” and subsequently that a public authority cannot engage in any

interference … with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.21

Among the 28 EU Member States, the EU Charter also requires that an individual must enjoy a “right to respect for his or her private and family life, home and communications” and adds an explicit “right to the protection of personal data.”22 The Charter demands that any limitation the state wishes to place upon these rights be “provided for by law,” “respect the essence” of the rights, be “necessary,” and “genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.”23

As a general matter, the treaty texts quoted above all require the same basic inquiry to determine whether a state has committed a violation of the right to privacy:

  1. (1) Does the right apply to the information or behavior in question?

  2. (2) Did the state’s action interfere with the right?

  3. (3) Was this interference done in accordance with the law?

  4. (4) Was the interference necessary (or, to the extent that there may be a genuine difference in meaning between the terms, “non-arbitrary” or “non-abusive”)?24

(p.363) B. The Scope of the Right to Privacy and the Occurrence of an Interference

In the relevant case law and commentary, the questions of whether a particular type of data falls within the scope of the right to privacy and whether the state has interfered with that right are sometimes conflated.25 However, in light of current debates about the sensitivity of various categories of data and whether it may be more acceptable for the state to have systematic access to some types rather than others, it is useful to begin by identifying those that international courts and Special Rapporteurs have specifically described as protected by the right, as well as state behaviors these entities have found to constitute an interference.

1. The Scope of the Right

As then-UN Special Rapporteur on the right of freedom of opinion and expression Frank La Rue has pointed out, the texts of the human rights treaties are largely silent about which types of data may fall within the ambit of the right to privacy, aside from “correspondence” (which is mentioned in the ICCPR, ACHR, and ECHR; the EU Charter refers to “communications”).26 The UN HRC’s lone General Comment on the right to privacy, adopted in 1988, fails to clarify matters, mentioning only communications and “personal information” of the kind that may be susceptible to storage in electronic form.27 Moreover, as La Rue also highlights, the evolution of information technology in recent decades has “irreversibly affected our understandings of the boundaries between private and public spheres,” meaning that the question of whether a certain type of information—such as a statement on a social media website—falls within the scope of the right will often be a contested one.28

La Rue’s commentary can be read to suggest that the ICCPR right to privacy applies very broadly where data is concerned, attaching to any form of communication between individuals that is intended to take place without intervention or observation by others, as well as to information that other parties hold concerning an individual.29 The jurisprudence of the regional courts, as well as recent recommendations of the UN HRC and the IACHR, indicate that the privacy rights found in the treaties attach to telephone and electronic communications, with the jurisprudence suggesting that location data and biometric data such as fingerprints and (p.364) DNA are covered as well.30 According to the ECtHR, the right may also attach to at least some extent where an individual interacts with others “in a public context,” especially where a “systematic or permanent record” of this interaction is created.31 This latter finding suggests that the right may apply, for example, to an individual’s posts on social media websites even where a casual observer might characterize those posts as “public.”

Although policymakers and scholars continue to debate the sensitivity of metadata (that is, data that describes a communication, such as the date, time, sender, and recipient of an email message),32 by now there is little question at the international level that the treaty rights to privacy attach to such data. The ECtHR and IACtHR have both explicitly concluded that telephone metadata, such as the number a caller has dialed, is subject to the protection of the right; the ECtHR has also extended this reasoning to “e-mail and Internet usage,” and although the IACtHR has not yet addressed the matter of Internet-based communications, there is no reason to believe it would decline to follow the ECtHR’s lead.33 The CJEU has also concluded that the imposition of a blanket requirement that communications service providers retain certain types of metadata and subscriber data, as well as the authorities’ ability to gain access to such data, implicate the EU Charter rights to private life and the protection of personal data; according to the Court, this is true regardless of whether the metadata in question is “sensitive.”34 Similarly, the Office of the UN High Commissioner for (p.365) Human Rights (OHCHR), the body within the UN Secretariat that takes the lead on promoting and protecting human rights, has affirmed that the ICCPR right to privacy attaches to metadata, and the HRC has implied its agreement in recommendations to several states.35

Thus, it does not appear that the international courts or bodies are in any way inclined to adopt what in the United States is known as the “third-party doctrine”: that is, the presumption that individuals do not have an expectation of privacy in their metadata, as they have voluntarily conveyed this information to the provider of the communications service.36 Indeed, the OHCHR has pointedly questioned the notion that consumers make such a “conscious compromise” when using modern communications technologies.37 Particularly in the era of “big data,” the High Commissioner’s assertion that consumers may not in fact be “truly aware of what data they are sharing, how and with whom, and to what use [the data] will be put” is a compelling one.38

2. Establishing an Interference

After determining that a particular type of data is protected by the right to privacy, the next step is to inquire whether the government action at issue interferes with that right. Since its seminal 1978 judgment in Klass and others v. Germany, the ECtHR has maintained that even the “mere existence” of legislation permitting secret surveillance measures constitutes an interference.39 (Although the Court’s Grand Chamber finessed this finding to some extent in 2015 in its combined analyses of victim status and the existence of an interference in Zakharov v. Russia, its overall approach appears to remain effectively intact at least insofar as legislation may allow mass surveillance, although further discussion by the Court will be necessary to clarify this point.)40 Additionally, the Court has previously found that the acquisition, retention, use, and dissemination of communications or other personal information all (p.366) constitute interferences (with acquisition or retention amounting to interferences even without subsequent use), and the IACtHR has reached similar results.41 The CJEU, for its part, has indicated that an interference with the relevant EU Charter rights may occur even where the individual concerned does not suffer any adverse consequences, and it has further established that data-retention mandates interfere with these rights.42

Where the UN bodies are concerned, the HRC’s 1988 General Comment on the right to privacy states flatly that “[c]‌orrespondence should be delivered to the addressee without interception and without being opened or otherwise read.”43 Drawing upon this conclusion (although evidently taking a more qualified position), the OHCHR, like the ECtHR, maintains that “even the mere possibility of communications information being captured creates an interference with privacy.”44 La Rue’s 2013 report on state surveillance implies that interception, data-retention mandates, access to stored content or metadata, location tracking, social media monitoring, the invasion of private devices through hacking, and the individualized or mass monitoring of Internet browsing should all be considered interferences with the ICCPR right, although La Rue likely did not intend for this list to be exclusive.45 Regarding mass surveillance specifically, the current UN Special Rapporteur on human rights and counterterrorism, Ben Emmerson, has provided a detailed list of some of the means by which states today may gain “bulk access” to metadata and/or content that the private sector holds, concluding that such activities “amount[] to a systematic interference” with the right to privacy as found in the Covenant.46

Thus, as far as the international and regional human rights institutions are concerned, there appears to be little doubt that when a state’s acquisition of or access to private-sector data—including metadata—is systematic, this practice constitutes an interference with the privacy rights established in the treaties.

(p.367) C. The Lawfulness of the Interference

1. Elements of the Requirement

Once a complainant at the international level has established that a state activity has interfered with his or her right to privacy, he or she will need to demonstrate that the interference was unlawful.

The HRC’s General Comment on the right to privacy interprets the legality requirement found in the relevant article of the ICCPR as meaning that “no interference [with the right] can take place except in cases envisaged by the law”—specifically, the state’s own legislation, “which itself must comply with the provisions, aims and objectives of the Covenant.”47 In other words, the state entity concerned must stay within the bounds of domestic law, and that law must in turn be consistent with the treaty. The OHCHR has elaborated on this interpretation by stating (in language echoing that of the ECtHR jurisprudence described below) that “the law must be sufficiently accessible, clear and precise” that an individual may, by reading it, “ascertain who is authorised to conduct data surveillance and under what circumstances.”48 Regarding the ICCPR’s textually separate requirement that individuals must enjoy “the protection of the law” where this right is concerned, the OHCHR has further stated (again drawing upon ECtHR case law) that

[t]‌he State must ensure that any interference with the right to privacy, family, home or correspondence is authorised by laws that (a) are publicly accessible; (b) contain provisions that ensure that collection of, access to and use of communications data are tailored to specific legitimate aims; (c) are sufficiently precise, specifying in detail the precise circumstances in which any such interference may be permitted, the procedures for authorising, the categories of persons who may be placed under surveillance, the limits on the duration of surveillance, and procedures for the use and storage of the data collected; and (d) provide for effective safeguards against abuse.49

Additionally, citing HRC observations concerning the United States, the OHCHR emphasizes that “secret” rules and legal interpretations—that is, those that are not made available to the public—lack “the necessary qualities of ‘law’ ” for the purposes of the legality requirement.50

The ECtHR’s jurisprudence is even more specific on this point insofar as the legal basis for state surveillance activities is concerned. According to the Court, (p.368) surveillance measures must have a “basis in domestic law” and must further adhere to public international law as well as “the rule of law” more generally.51 The domestic law in question must be binding (that is, not simply a statement of policy) as well as “sufficiently clear in its terms to give citizens an adequate indication as to the circumstances” in which the surveillance might take place—meaning, inter alia, that at least the following elements must be set out by statute:

  1. (1) the type and scope of the measures;

  2. (2) limits on how long the measures may last;

  3. (3) the grounds on which the authorities may order the measures;

  4. (4) which authorities are entitled to authorize, oversee, or carry out the measures;

  5. (5) the requisite procedures for “examining, using and storing” the data, as well as the scheme for ultimately destroying it;

  6. (6) the safeguards that apply to the sharing of the data with other entities; and

  7. (7) the remedies available for violations of these strictures.52

The IACtHR agrees that “the general conditions and circumstances” under which a state may conduct surveillance must be set out in “a law in the formal and substantial sense,” and that this law must provide “clear and detailed rules, such as the circumstances in which this measure can be adopted, the persons authorised to request it, to order it and to carry it out, and the procedure to be followed.”53

Additionally, the ECtHR and OHCHR concur that, in the High Commissioner’s words, “laws or rules that give the executive authorities, such as security and intelligence services, excessive discretion” to conduct surveillance will not be sufficient to meet the legality requirement.54

When determining whether state surveillance measures are “done in accordance with the law,” the ECtHR has also grappled with the difficult question of whether individuals whose communications have been monitored are entitled to be notified of that fact. In its analysis of the matter in the early case of Klass and others, the Court adopted a position that was deferential to the state, accepting that “[s]‌ubsequent notification to each individual affected by a suspended measure might well jeopardise the long-term purpose that originally prompted the surveillance,” and concluding that a state’s decision not to provide notification, (p.369) even after the fact, “cannot itself be incompatible” with the ECHR.55 However, one reason the Court was willing to take this view was that the applicable German law in fact required the government to provide notification to monitored persons “as soon as notification [could] be made without jeopardising the purpose” of the surveillance.56 In more recent judgments, the Court has shifted toward stating that domestic law “should” contain this type of post hoc notification requirement and finding violations of the Convention where states have failed to provide for notification under any circumstances.57 The Court’s choice of the term “should” instead of “must” is likely due to its conclusion in Kennedy v. the United Kingdom that the respondent state complied with the Convention by providing a tribunal that could examine allegations of unlawful government surveillance even where the complainant had not received notification of any monitoring—that is, where an individual’s standing was not dependent upon his or her possession of evidence that surveillance had in fact taken place.58 It is to be hoped that other human rights courts and bodies will address these key issues of notice and standing in the near future.59

In any event, several aspects of the jurisprudence and commentary described above weigh against the notion that systematic government interferences with private-sector data may be “lawful” for the purposes of the human rights treaties. First, a number of the elements that the ECtHR and IACtHR have identified as necessary for any surveillance statute—namely, the enumeration of grounds upon which the authorities may order the surveillance and the potential scope and duration of the measures—along with the notification requirement (to the extent that it applies under the relevant treaty) would essentially be moot if state authorities were entitled to interfere with data concerning anyone at any time.60

2. Authorization and Oversight

In addition to complying with domestic law (which must itself meet the criteria described above), state surveillance measures must be subject to adequate (p.370) authorization and oversight regimes. As indicated above, it is arguable that systematic government access to private-sector data necessarily violates other elements of the legality requirement—a defect that even an exceptionally strong oversight system would not cure. Speaking generally, however, the UN General Assembly has called upon states to “establish or maintain existing independent, effective, adequately resourced and impartial judicial, administrative and/or parliamentary domestic oversight mechanisms capable of ensuring transparency, as appropriate, and accountability for State surveillance of communications, their interception and the collection of personal data.”61

Regarding the initial authorization of communications surveillance measures, the ECtHR has indicated that although authorization does not necessarily need to be judicial in order for the process to conform to the Convention, the entity responsible for granting the authorization must be independent of the entities carrying out the monitoring.62 Any nonjudicial authorizing body should, in turn, ultimately be subject to some form of judicial control, as supervision by a judge provides “the best guarantees of independence, impartiality and a proper procedure.”63 Perhaps due to a reluctance to overturn its holding on this point in Klass and others, in which it approved of the nonjudicial German oversight scheme, the Court has stopped short of insisting upon judicial review as such (if only post hoc) in all circumstances.64 However, it has warned that oversight of surveillance measures by “a judge with special expertise[] should be the rule and substitutions the exception, warranting close scrutiny”—thus arguably limiting Klass and others to its facts and rendering judicial supervision at some stage de rigeur for all or nearly all other systems.65 Future judgments will show whether the Court indeed intends to take such an approach. Meanwhile, although the IACtHR has ruled on the compliance of a particular judicial authorization system with the ACHR, it has not yet addressed the requisite nature of surveillance authorization or oversight systems in general.66

While the regional human rights courts continue to wrestle with the form that surveillance decision-making bodies must take, the HRC has indicated that regardless of who precisely is responsible for authorizing these types of measures, the authorization must be done on a case-by-case basis.67 The Committee has yet to (p.371) clarify precisely what it means by “case-by-case”; however, there appears to be little reason to question Emmerson’s interpretation, which is that the scrutiny must be individualized.68 As Emmerson points out, this requirement—insofar as it is indeed a requirement under the applicable treaties—effectively forecloses the possibility that a mass surveillance program could comply with the right to privacy.69

D. The Necessity or Non-arbitrariness of the Interference

The texts of the human rights instruments vary in their descriptions of the qualities a lawful interference with privacy rights must possess in order to avoid the state’s excessive use of what are, after all, capabilities that create an immense differential between the government and the governed. At present, none of the human rights courts or bodies appear to question the notion that states are entitled to monitor communications and related data in at least some circumstances; however, they have demonstrated a deep concern with determining, and thus limiting, exactly what those circumstances are.

Both the ICCPR and ACHR require that interferences with privacy must not be “arbitrary,” whereas the ECHR opts for “necessary in a democratic society in the interest of” certain specified aims, and the EU Charter (as noted above) states that limitations on the right must be proportionate as well as “necessary” and “genuinely meet[ing] objectives of general interest recognised by the Union.”70 Meanwhile, the HRC’s General Comment 31, which concerns the overall nature of the legal obligations the ICCPR imposes, maintains that any restriction a state places on a Covenant right must be necessary as well as “proportionate to the pursuance of legitimate aims.”71 Likewise, the IACtHR has construed the ACHR as mandating that any state interference with the right to privacy must “serve a legitimate purpose[] and meet the requirements of suitability, necessity, and proportionality which render it necessary in a democratic society.”72 Thus, although the language of the treaty provisions concerning restrictions on the right to privacy are not identical, and although some scholars view them as differing in substance,73 there is every indication that the texts, jurisprudence, and analyses by UN experts are gradually converging around a standard that could be described as “necessary and proportionate to the pursuit of a legitimate aim.”74 As the (p.372) human rights courts and bodies rarely have difficulty in determining that a state surveillance measure pursues a legitimate aim such as preventing serious crime, this discussion will focus on the concepts of necessity and proportionality.75

Although these two concepts are unquestionably related, the proper distinction between the two (and, for that matter, whether they are distinguishable at all) has not yet been clearly or consistently articulated by the relevant international bodies. Helpfully, the opinion of the Advocate General in Tele2 Sverige AB and Watson and others has set forth the concept of “proportionality stricto sensu,” suggesting that even surveillance that is “necessary” to achieve a legitimate aim can still be disproportionate in the sense of being beyond the bounds of what is tolerable in a democratic society.76 Such a theory might indicate, for example, that even if the constant video surveillance of a classroom is regarded as “necessary” to ensure students’ safety at every moment, such a measure may nevertheless be disproportionate in the sense that the harms to fundamental rights outweigh the advantages to society.77

In any case, regarding the necessity requirement, ECtHR jurisprudence appears to be evolving toward a conclusion that mass surveillance cannot be compliant with this criterion. The Court has long maintained that the term “necessary,” as employed in the relevant ECHR provision, means “strictly necessary for safeguarding the democratic institutions.”78 Prior to 2015, its findings concerning potentially large-scale surveillance programs were admittedly unclear at best. In Klass and others, for example, the Court found that a state surveillance regime did not violate the Convention right to privacy even though the authorities had broad powers to monitor postal and telephone communications; however, the text of the judgment suggests that legal restrictions on these powers made interferences targeted rather than systematic.79 In its later admissibility decision in Weber and Saravia, the Court accepted the necessity of a program in which the use of “catchwords” during satellite telephone conversations triggered surveillance of those conversations; yet, the use of satellite telephones was relatively unusual at the time, and the Court’s treatment of the precise nature (p.373) and scope of the interference is brief and opaque.80 Muddying the waters even further, the Court’s Grand Chamber found just two years later in S. and Marper v. the United Kingdom that the “blanket and indiscriminate” retention of DNA samples and fingerprints by English and Welsh authorities—a practice arguably analogous to mass surveillance—was an unnecessary and disproportionate interference with privacy rights.81

With the Grand Chamber’s judgment in Zakharov, however, the Court seems to have sent a clear signal that mass communication surveillance programs do not comply with the Convention.82 The Fourth Section’s subsequent judgment in Szabó and Vissy v. Hungary further found that the requirement of strict necessity has two mandatory elements: a state surveillance measure must not only be strictly necessary for safeguarding the democratic institutions (as indicated above) but must also be “strictly necessary, as a particular consideration, for the obtaining of vital intelligence in an individual operation.”83 The latter criterion, with its references to “vital intelligence” and “individual operation,” suggests—as the author has argued elsewhere84—that the Court means to indicate that surveillance regimes entailing systematic state access to private data necessarily violate the Convention. In this respect, it seems highly significant that the Court indicated in Szabó and Vissy that it would not have ruled in favor of the respondent government in Kennedy v. the United Kingdom if the monitoring in that case had involved “indiscriminate capturing of vast amounts of communications.”85

The CJEU appeared to reach a similar conclusion in Digital Rights Ireland, invalidating EU Directive 2006/24 (popularly known as the Data Retention Directive) in part because that legislation required, within the scope of its application, the retention of data concerning all persons in all locations at all times for at least six months and up to two years.86 Additionally, in its judgment in (p.374) Schrems, the Court found that legislation allowing government authorities to enjoy “access on a generalised basis” to electronic communications must, at least insofar as this generalized access applies to content, “be regarded as compromising the essence of the fundamental right to private life.”87

Where the ICCPR is concerned, the relevant UN experts continue to grapple with the question of whether mass surveillance can ever comply with the requirement of non-arbitrariness. As noted above, General Comment 16 rejects altogether the idea that secret communications surveillance of any kind may comply with Article 17, although the HRC and the OHCHR appear to have shifted to a less absolutist position over the years.88 In its 2014 report, the OHCHR drew upon the HRC’s 1999 General Comment on the right to freedom of movement in maintaining that in order to be necessary and proportionate, state surveillance must adopt the “least intrusive” approach possible. Applying this logic, the High Commissioner concluded that “[m]‌ass or ‘bulk’ surveillance programmes may thus be deemed to be arbitrary, even if they serve a legitimate aim and have been adopted on the basis of an accessible legal regime.”89

Meanwhile, after suggesting that some states are employing data-mining techniques to search through vast quantities of electronic communications, thus surveilling very large numbers of individuals who are not suspected of having engaged in any wrongdoing, Emmerson notes that “[t]‌he hard truth is that the use of mass surveillance technology effectively does away with the right to privacy of communications on the Internet altogether.” Without directly stating that mass surveillance can never be compliant with human rights, Emmerson goes on to indicate that “[t]he sheer scale of the interference with privacy rights calls for a competing public policy justification of analogical magnitude”—a statement that is perhaps best read as raising serious doubts as to whether such a justification could ever in fact exist.90

IV. The Freedoms of Expression, Religion, Assembly, and Association

Although assessments of mass surveillance under the international human rights framework have tended to focus on the implications for the right to privacy, the impact of these practices on the freedom of expression (which includes the right to receive and impart information); the non-derogable freedoms of opinion, thought, conscience, and religion; and the freedoms of association and (p.375) peaceful assembly may be equally serious.91 Each of these rights is found in the UDHR, ICCPR, ACHR, ECHR, and EU Charter; the American Declaration does not contain an explicit freedom of thought but otherwise generally tracks the other human rights instruments in these respects.92 While the UN General Assembly and at least two UN Special Rapporteurs have depicted the right to privacy as a type of gateway for the enjoyment of free-expression (and presumably other) rights, these latter entitlements stand on an equal footing with the right to privacy and merit far more scrutiny in the surveillance context than they have received to date.93

The ECtHR has seldom addressed cases involving both communications surveillance—particularly on a large scale—and free-expression rights, although two communicated cases against the United Kingdom that remain pending at the time of writing raise these issues.94 At present, the Court’s main observations on this point remain those found in its admissibility decision in Weber and Saravia, in which the Third Section (based on the text of the ECHR, in which the provision concerning the right to free expression broadly mirrors that concerning the right to respect for private life) effectively proceeded through a compressed version of the four-step analysis outlined above in examining the impact of an arguably mass surveillance program on a journalist.95 The Court began by referring to “the vital public-watchdog role of the press” and finding that the existence of legislation allowing secret surveillance constituted an interference with the journalist’s right to free expression, as the threat of surveillance might reveal her sources or deter them from speaking with her.96 After finding that the interference was lawful and had a legitimate aim, the Court turned to the question of whether the surveillance was necessary in a democratic society, noting its (p.376) own long-established rule that a state’s interference with a journalist’s exercise of free-expression rights will violate the Convention unless the action is “justified by an overriding requirement in the public interest.”97 In the Court’s view, the German regime at issue was subject to strict safeguards; the fact that the surveillance was not “aimed at monitoring journalists” was also a deciding factor for the judges, as they believed this meant that the interference could not be characterized as a “particularly serious” one.98 Ultimately, the Court concluded that Germany’s surveillance activities had not violated the right.99

Aside from Weber (whose persuasiveness, as a single admissibility decision, is debatable), international jurisprudence concerning these issues is scant. The ECtHR found in a succinct 2013 judgment against Serbia that the state had failed to comply with domestic law in refusing to disclose, upon request by a nongovernmental organization, the number of individuals it had subjected to secret surveillance; thus, the state violated the right to receive information, which is part of the Convention right to free expression (and has been further explicated in non-binding form in the Global Principles on National Security and the Right to Information, known as the Tshwane Principles).100 Regrettably, the CJEU did not reach the issue of free-expression rights in Digital Rights Ireland despite the fact that the referring court had presented it with an opportunity to do so.101

Notwithstanding this lag on the part of the international courts, the Special Rapporteurs of the UN and IACHR who focus on the freedom of expression have been addressing electronic surveillance issues proactively since at least 2011.102 The most recent UN Special Rapporteurs in this area have focused on the importance of online anonymity for facilitating the exercise of the right, especially (p.377) where controversial topics are concerned;103 they have also encouraged state respect for individuals’ use of strong encryption technologies, as encryption, like anonymity, “create[s]‌ a zone of privacy to protect opinion and belief.”104 As current UN Special Rapporteur on free expression David Kaye has written: “The ability to search the web, develop ideas and communicate securely may be the only way in which many can explore basic aspects of identity, such as one’s gender, religion, ethnicity, national origin or sexuality.”105 It is easy to imagine that systematic government access to private-sector data, whether through real-time interception, data-retention laws, or some other means, may burden the freedoms of thought, opinion, religion, and/or expression in a manner that does not comply with the treaties. Indeed, shortly after the Snowden disclosures, La Rue and his IACHR counterpart Catalina Botero released a joint declaration stating that “indiscriminate access to information on communication between persons can have a chilling effect on the free expression of thought and the search for and distribution of information,” and emphasizing that “the law must authorise access to communications and personal information only under the most exceptional circumstances defined by legislation.”106

Meanwhile, the effect of mass surveillance on the freedoms of opinion; thought, conscience, and religion; assembly; and association appear to remain unaddressed in international case law. However, Kaye has pointed out that both mass and targeted surveillance “may undermine the right to form an opinion, as the fear of unwilling disclosure of online activity, such as search and browsing, likely deters individuals from accessing information, particularly where such surveillance leads to repressive outcomes.”107 The same observation likely applies to the chilling effect on individuals’ ability to explore and form religious views; indeed, in Europe, systematic government access to private data may necessarily entail violations of what the ECtHR has described as an individual’s right “not to be obliged to disclose his or her religion or beliefs,”108 as these will often be obvious from communications, browsing histories, and so on. Moreover, it is easy to imagine that a government’s systematic surveillance of communications and/or related data (such as location information) could have an impermissible (p.378) deterrent effect upon individuals’ right to assemble and associate with others—for example, at political protests, union meetings, or religious study groups.

V. Remedies and Freedom from Discrimination in the Enjoyment of Rights

A. The Right to a Remedy for Violations of the Foregoing Rights

Each of the human rights instruments described herein manifests a concern with ensuring that states cannot violate their legal obligations with impunity. In the earlier instruments, this concern takes the form of requiring states to provide individuals with a remedy for acts violating constitutional or other legal rights.109 The later-developed ICCPR, ACHR, and ECHR make it clear that the obligation to provide a remedy extends to violations of the rights found in these treaties as such.110 This requirement is formally distinct from, although closely related to, the oversight- and notification-related obligations identified in the case law and commentary described above.

The salient provision of the American Declaration refers explicitly and exclusively to accountability through the courts, whereas the ACHR refers to the need for a “court or tribunal,” the EU Charter uses the term “tribunal,” and the ECHR refers to a “national authority.”111 Meanwhile, the ICCPR suggests that redress for rights violations may be provided by “judicial, administrative or legislative authorities, or by any other competent authority provided for by the legal system of the State,” but specifically requires states parties to undertake to “develop the possibilities of judicial remedy.”112 Thus, whether the redress in question must necessarily be judicial will likely depend upon the instrument(s) by which a state is bound as well as the case law of the international human rights bodies.

The ECtHR, for its part, has developed a substantial body of findings on this subject, thus far declining to find that a remedy must be judicial but emphasizing the need for the pertinent body—whatever form it takes—to be independent and effective.113 Although the Court once adopted the stance that the availability of a remedy in the surveillance context is only required after the interference has been disclosed, it now appears to demand at least a limited remedy while the surveillance (whether confirmed or alleged) remains underway. Such a limited remedy might include, for example, “one where the proceedings are secret and (p.379) where no reasons are given, and the persons concerned are not apprised whether they have in fact been monitored—even at this stage.”114 The remedial body must nevertheless be able to “grant appropriate relief.”115

B. Discrimination in Respect of Treaty Rights

As a final point where state obligations are concerned, the human rights instruments are uniform in demanding that government authorities uphold the rights contained in those instruments in a manner that does not discriminate on the basis of, for example, race, color, religion, sex, language, or political or other opinion.116 Thus, if a state were to seek access to private-sector data (thus interfering with privacy rights) on a discriminatory basis, or use data-mining techniques to identify individuals who may belong to a certain religion or hold a certain opinion (again interfering with privacy and potentially other rights), these practices would presumably run afoul of the state’s non-discrimination obligations. Where a state is a party to the International Convention on the Elimination of All Forms of Racial Discrimination, its commitments under that instrument will also be salient.117

Although this chapter does not address the question of whether ICCPR or other human rights treaty obligations apply extraterritorially, the OHCHR has recently taken the novel approach of applying the anti-discrimination principles to suggest that a state must respect privacy and other human rights “regardless of the nationality or location” of the individual who is being monitored.118 It remains to be seen whether the regional human rights courts will follow the UN entities’ lead in this respect.

VI. Conclusion

As state demands for systematic access to communications held or transmitted by the private sector increase, it is crucial to recall the danger against which the ECtHR and other commentators have so bluntly warned: the creation of legal regimes in which fundamental rights are traded away in the name of crime prevention and national security—in other words, police states. The consistency with which the international human rights treaties, courts, and experts have (p.380) identified and interpreted the relevant rights, as well as their increasing criticisms of mass surveillance, should serve as a reminder that state interferences with private data are not necessarily legal simply because they may currently be ubiquitous. Both states and individuals should take the long view by following the apparent trend among the international bodies and concluding that mass surveillance violates human rights—and that, for all of us, those rights are too valuable to relinquish.

Notes:

(*) I am grateful to James X. Dempsey for inviting me to contribute a chapter to this volume and to Lara Ballard, Tamir Israel, Maria McFarland Sánchez-Moreno, Dinah PoKempner, Amie Stepanovich, Amos Toh, and Cynthia Wong for reviewing the draft. The views expressed herein are my own and do not necessarily reflect those of Human Rights Watch or the individuals acknowledged above.

Sections of this chapter closely track, and at times draw directly from, a brief guide I created in the early days of my acquaintance with the subject as a fellow at the Center for Democracy & Technology: Sarah St.Vincent, International Law and Secret Surveillance: Binding Restrictions upon State Monitoring of Telephone and Internet Activity, (September 4, 2014), https://cdt.org/files/2014/09/CDT-IL-surveillance.pdf.

(1.) Alan Barth, The Loyalty of Free Men (1951), pp. 129–30 (quoted in Jay Feldman, Manufacturing Hysteria: A History of Scapegoating, Surveillance, and Secrecy in Modern America (2011), p. 197).

(2.) Klass and others v. Germany, Application no. 5029/71, Judgment (Plenary) (September 6, 1978) ¶ 42. The same or similar language appears in, for example, Rotaru v. Romania, Application no. 28341/95, Judgment (Grand Chamber)( May 4, 2000), ¶ 47; Segerstedt-Wiberg and others v. Sweden, Application no. 62332/00, Judgment (June 6, 2006), ¶ 88; Szabó and Vissy v. Hungary, Application no. 37138/14, Judgment (January 12, 2016), ¶ 54.

(3.) See, for example, Theresa May, Oral Statement to Parliament: Publication of Draft Investigatory Powers Bill (November 4, 2015), https://www.gov.uk/government/speeches/home-secretary-publication-of-draft-investigatory-powers-bill (asserting that the state requires the powers to intercept communications and acquire communications data in bulk in order to address terrorism and other crimes); “Tony Abbott National Security Statement to Parliament,” Sydney Morning Herald (September 22, 2014), http://www.smh.com.au/federal-politics/political-news/tony-abbott-national-security-statement-to-parliament-20140922-10kccx.html (depicting data-retention mandates as necessary to countering terrorism).

Although “mass surveillance” remains an informal term rather than a legal one at the international level, this chapter uses it as shorthand for state interferences with communications and related data to which privacy rights attach under the applicable treaties, where those interferences are or may be carried out on a large scale without being based on an individualized suspicion of wrongdoing. As there is broad agreement among the human rights courts and experts mentioned herein that the retention of data constitutes an interference with the right to privacy (see below), this chapter treats blanket data-retention mandates—that is, obligations on Internet or telecommunications companies to retain certain data describing communications, such as the dates, times, senders, and recipients of emails—as one form of mass surveillance. Others include, for example, the indiscriminate and large-scale interception of the content of communications.

(4.) A derogation is a state’s temporary suspension of one or more of its commitments under a treaty. The human rights instruments typically provide that states are only permitted to derogate from their obligations under those instruments during an emergency so severe that it poses a threat to “the life of the nation.” See, for example, International Covenant on Civil and Political Rights, 999 U.N.T.S. 171 (1966), art. 4 (hereinafter ICCPR); Convention for the Protection of Human Rights and Fundamental Freedoms, E.T.S. 5 (1950), art. 15 (also known as the European Convention on Human Rights; hereinafter ECHR); American Convention on Human Rights, 1144 U.N.T.S. 123 (1969), art. 27 (hereinafter ACHR).

(5.) See, for example, Office of the United Nations High Commissioner for Human Rights, The Right to Privacy in the Digital Age, U.N. Doc. A/HRC/27/37 (June 30, 2014) (hereinafter OHCHR report), and G. Alex Sinha, “NSA Surveillance since 9/11 and the Human Right to Privacy,” 59 Loy. L. Rev. 861 (2013), both of which assume that the ICCPR applies to state intelligence activities. For a presentation of other views, see Ashley S. Deeks, “Confronting and Adapting: Intelligence Agencies and International Law,” 102 Va. L. Rev. 599 (2016).

(6.) For a treatment of this issue, see, among many others, Harold Hongju Koh, Memorandum Opinion on the Geographic Scope of the International Covenant on Civil and Political Rights, (October 19, 2010), https://www.documentcloud.org/documents/1053853-state-department-iccpr-memo.html; Sinha, above note 5, pp. 900–03; Ashley Deeks, “An International Legal Framework for Surveillance,” 55 Va. J. Int’l L. 291, 307–12 (2015).

(7.) See, for example, Human Rights Council, Report of the Special Rapporteur on the Right to Privacy, Joseph A. Cannataci, U.N. Doc. A/HRC/31/64 (March 8, 2016), ¶ 9; Human Rights Council, Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, U.N. Doc. A/HRC/32/38 (May 11, 2016), ¶¶ 56–62. See also Office of the United Nations High Commissioner for Human Rights, Guiding Principles on Business and Human Rights (2011), http://www.ohchr.org/Documents/Publications/GuidingPrinciplesBusinessHR_EN.pdf.

(8.) The Council of Europe is a regional body with 47 Member States; its purpose is to “promote democracy and protect human rights and the rule of law in Europe.” Council of Europe, Do Not Get Confused, http://www.coe.int/en/web/about-us/do-not-get-confused (last visited April 29, 2017). The European Union is a separate economic and political entity to which 28 Member States belonged at the time of writing; its goals include promoting peace, establishing an internal market, and ensuring the free movement of persons among the Member States. European Union, The EU in Brief, https://europa.eu/european-union/about-eu/eu-in-brief_en (last visited April 29, 2017); Consolidated version of the Treaty on European Union, 2010 O.J. C 83/01, art. 2.

(9.) Big Brother Watch and others v. the United Kingdom, Application no. 58170/13 (communicated January 7, 2014); Bureau of Investigative Journalism and Ross v. the United Kingdom, Application no. 62322/14 (communicated January 5, 2015); and 10 Human Rights Organisations v. the United Kingdom, Application no. 24960/15 (communicated November 24, 2015).

(10.) Tele2 Sverige AB v. Post- och telestyrelsen (Case C-203/15) and Secretary of State for the Home Department v. Watson and others (Case C-698/15), Judgment of the Court (Grand Chamber) of 21 December 2016, http://curia.europa.eu/juris/liste.jsf?num=C-203/15.

(11.) United Nations Human Rights Committee, General Comment No. 16: Article 17 (Right to privacy) (April 8, 1988), ¶ 8. Regrettably, this currently remains the HRC’s only General Comment on the right to privacy, despite the enormous changes that have occurred in communications technology since the time of its publication.

(12.) See, for example, Human Rights Committee, Concluding Observations on the Sixth Periodic Report of New Zealand, U.N. Doc. CCPR/C/NZL/CO/6 (April 28, 2016), ¶ 16 (referring to the need for adequate judicial safeguards where the “interception of communications and metadata collection, processing and sharing” are concerned, without suggesting that those practices per se constitute violations of the Covenant); Human Rights Committee, Concluding Observations on the Initial Report of South Africa, U.N. Doc. CCPR/C/ZAF/CO/1 (April 27, 2016), ¶ 43 (similarly, referring to a need to “ensure that interception of communications by law enforcement and security services is carried out only according to the law and under judicial supervision” without suggesting that the Covenant prohibits all surveillance).

(13.) Escher et al. v. Brazil, Judgment, July 6, 2009, ¶ 115.

(14.) Universal Declaration of Human Rights, U.N. Doc A/810 (1948) (hereinafter UDHR); American Declaration of the Rights and Duties of Man (1948) (hereinafter American Declaration). As per articles 34 et seq. of the ACHR, above note 4, the IACHR is a body charged with promoting and defending human rights, including by receiving and examining complaints that a state party to the Convention has violated its obligations under that instrument. In conformity with a process set out in the Convention, the Commission may then submit a case to the IACtHR; see ACHR, art. 61. The IACHR has found that the American Declaration is binding upon the members of the Organization of American States in Res. no. 3/87, Case 9647, Roach and Pinkerton (United States), September 22, 1987, ¶ 48.

(15.) See ibid., at ¶¶ 47–48; for a brief summary of some of the Snowden revelations, see Sinha, above note 5, pp. 892–99. The United States disagrees with the IACHR’s conclusion that the American Declaration is binding upon it; see Christina M. Cerna, “Reflections on the Normative Status of the American Declaration of the Rights and Duties of Man Anniversary Contributions—International Human Rights,” 30 J. Int’l L. 1211, 1220 (2009).

(16.) See, for example, Hurst Hannum, “The Status of the Universal Declaration of Human Rights in International Law,” 25 Ga. J. Int’l & Comp. L. 287, 289 (1995); Jochen von Bernstorff, “The Changing Fortunes of the Universal Declaration of Human Rights: Genesis and Symbolic Dimensions of the Turn to Rights in International Law,” 19 Eur. J. Int’l L. 903, 913 (2008). On the nature of customary international law, see North Sea Continental Shelf Cases (Federal Republic of Germany v. Denmark; Federal Republic of Germany v. Netherlands), Judgment, 1969 I.C.J. 72, ¶ 38.

(17.) American Declaration, above note 14, arts. 5 and 10; UDHR, above note 14, art. 12.

(18.) ICCPR, above note 5, arts. 17 and 48(1).

(19.) ACHR, above note 4, arts. 11 and 74(1); references to “dignity” also appear in articles 5 and 6 of the instrument.

(20.) ECHR, above note 4, art. 8; Charter of Fundamental Rights of the European Union, 2000/C 364/01, arts. 7–8 (hereinafter EU Charter).

(21.) ECHR, above note 4, art. 8.

(22.) EU Charter, above note 20, arts. 7–8. As this chapter is only intended to provide a brief introduction to some of the major human rights instruments that apply to communications surveillance, it does not address “data protection” laws aside from Article 8 of the Charter. However, readers may wish to be aware of the Council of Europe’s Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, E.T.S. No. 108 (1981); for an introduction to that instrument, see Electronic Privacy Information Center, Council of Europe Privacy Convention, https://epic.org/privacy/intl/coeconvention/ (last visited April 29, 2017).

(23.) EU Charter, above note 20, art. 52(1).

(24.) Cf. Jordan J. Paust, “Can You Hear Me Now?: Private Communication, National Security, and the Human Rights Disconnect,” 15 Chi. J. Int’l L. 612, 627 (2015).

(25.) See, for example, Uzun v. Germany, Application no. 35623/05, Judgment, September 2, 2010, ¶¶ 43 et seq.

(26.) Human Rights Council, Report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, Frank La Rue, U.N. Doc. A/HRC/23/40 (April 17, 2013), ¶ 21 (hereinafter La Rue report).

(27.) General Comment No. 16, above note 11, ¶¶ 8 and 10.

(28.) La Rue report, above note 26.

(29.) Ibid., at ¶¶ 22–23.

(30.) See, for example, Copland v. the United Kingdom, Application no. 62617/00, Judgment, April 3, 2007; Uzun, above note 25; S. and Marper v. the United Kingdom, Application no. 30562/04, Judgment (Grand Chamber), December 4, 2008; Digital Rights Ireland Ltd v. Minister for Communications, Marine and Natural Resources et al., Case C-293/12, Judgment, April 8, 2014; Escher, above note 13, ¶ 114; Human Rights Committee, Concluding Observations on the Fourth Periodic Report of the United States of America, U.N. Doc. CCPR/C/USA/CO/4 (April 23, 2014), ¶ 22; Inter-American Commission on Human Rights, Report on the Situation of Human Rights Defenders in the Americas (2006), p. 84 (recommendation 13). Although this chapter focuses on communications surveillance, biometric data is often of interest to activists in this area and is therefore mentioned briefly here. The list of types of data found in this sentence should not by any means be understood as exhaustive where the forms of “personal data” to which treaty privacy rights can attach are concerned.

(31.) P.G. and J.H. v. the United Kingdom, Application no. 44787/98, Judgment, September 25, 2001, ¶¶ 56–60; Shimovolos v. Russia, Application no. 30194/09, Judgment, June 21, 2011, ¶ 65.

(32.) See Electronic Frontier Foundation and Article 19, Background and Supporting International Legal Analysis for the International Principles on the Application of Human Rights to Communications Surveillance (May 2014), pp. 10–14, https://necessaryandproportionate.org/files/2016/03/29/background_and_supporting_legal_analysis_en.pdf.

(33.) Escher, above note 13, ¶ 114; Malone v. the United Kingdom, Application no. 8691/79, Judgment (Plenary), August 2, 1984, ¶¶ 83–84; Copland, above note 30, ¶¶ 43–44.

(34.) Digital Rights Ireland, above note 30, ¶¶ 29–34; see also Schrems v. Data Protection Commissioner, Case C-362/14, Judgment(October 6, 2015), ¶ 87.

(35.) OHCHR report, above note 5, ¶¶ 19–20; Human Rights Committee, above note 12 (New Zealand); Human Rights Committee, above note 32 (United States); Human Rights Committee, Concluding Observations on the Seventh Periodic Report of the United Kingdom of Great Britain and Northern Ireland, U.N. Doc. CCPR/C/GBR/CO/7 (August 17, 2015), ¶ 24.

(36.) See Smith v. Maryland, 442 U.S. 735 (1979); see also Electronic Frontier Foundation and Article 19, above note 32, pp. 11–13.

(37.) OHCHR report, above note 5, ¶ 18.

(38.) Ibid.

(39.) Klass and others, above note 2, ¶ 41; Weber and Saravia v. Germany, Application no. 54934/00, Decision, June 29, 2006, ¶ 78; Liberty and others v. the United Kingdom, Application no. 58243/00, Judgment, July 1, 2008, ¶ 56.

(40.) Zakharov v. Russia, Application no. 47143/06, Judgment (Grand Chamber), December 4, 2015, ¶¶ 171–179.

(41.) Amann v. Switzerland, Application no. 27798/95, Judgment (Grand Chamber), February 16, 2000, ¶ 45; Weber and Saravia, above note 39, ¶ 79; Rotaru, above note 2, ¶ 46; Leander v. Sweden, Application no. 9248/81, Judgment, March 26, 1987, ¶ 48; S. and Marper, above note 30, ¶ 67 (confirming that the storage of data concerning private life constitutes an interference even in the absence of use); Escher, above note 13, ¶ 118.

(42.) Digital Rights Ireland, above note 30, ¶¶ 33–36; Schrems, above note 34.

(43.) General Comment No. 16, above note 11, ¶ 8.

(44.) OHCHR report, above note 5, ¶ 20.

(45.) La Rue report, above note 26, ¶¶ 34 et seq.

(46.) United Nations General Assembly, Report of the Special Rapporteur on the Promotion and Protection of Human Rights and Fundamental Freedoms while Countering Terrorism, U.N. Doc. A/69/397 (September 23, 2014), ¶¶ 8–9 (hereinafter Emmerson report).

(47.) General Comment No. 16, above note 11, ¶¶ 2–3.

(48.) OHCHR report, above note 5, ¶ 23.

(49.) Ibid. at ¶ 28; see also Human Rights Committee, above note 30 (United States) and note 35 (United Kingdom).

(50.) OHCHR report, above note 5, ¶ 29, citing Human Rights Committee, above note 30 (United States).

(51.) See St.Vincent, above at *, p. 10, and sources cited therein; Kennedy v. the United Kingdom, Application no. 26839/05, Judgment, May 18, 2010, ¶ 151; Zakharov, above note 40, ¶ 228.

(52.) St.Vincent, above at *, p. 10, and sources cited therein; Malone, above note 33, ¶ 67; Zakharov, above note 40, ¶ 231.

(53.) Escher, above note 13, ¶ 131 (internal citation omitted); cf. Donoso v. Panamá, Judgment, January 27, 2009, ¶ 77.

(54.) OHCHR report, above note 5, ¶ 29; Zakharov, above note 40, ¶ 230; Amann, above note 41, ¶ 56 (quoting Malone, above note 33, ¶¶ 67–68).

(55.) Klass and others, above note 2, ¶ 58.

(56.) Ibid.; see also Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria, Application no. 62540/00, Judgment, June 28, 2007, ¶ 90 (depicting this fact as a key element of the Court’s willingness to reach its holding in Klass and others) (hereinafter “Association for European Integration”).

(57.) Szabó and Vissy, above note 2, ¶¶ 86–87; Association for European Integration, above note 56.

(58.) Kennedy, above note 51, ¶ 167.

(59.) See OHCHR report, above note 5, ¶ 40 (stating that notice and standing are “critical issues in determining access to effective [sic] remedy”).

(60.) See FDN et al. c/ Gouvernement, Conseil d’État, Contentious Section, Third-Party Intervention: Center for Democracy & Technology and Privacy International, undated, ¶¶ 32–34, https://cdt.org/files/2016/02/LQN-case_FINAL-2_CLEAN.pdf.

(61.) United Nations General Assembly, The right to privacy in the digital age, U.N. Doc. A/RES/69/166 (December 18, 2014), ¶ 4(d).

(62.) Klass and others, above note 2, ¶ 56; cf. Kennedy, above note 51, ¶¶ 166–167. The Court’s Grand Chamber recently reiterated this point in Zakharov, above note 40, ¶¶ 275 et seq.

(63.) Szabó and Vissy, above note 2, ¶ 77.

(64.) Ibid.; Klass and others, above note 2.

(65.) Szabó and Vissy, above note 2, ¶ 77.

(66.) Escher, above note 13, ¶¶ 132 et seq.

(67.) General Comment No. 16, above note 11, ¶ 8.

(68.) Emmerson report, above note 46, ¶ 51.

(69.) Ibid., at ¶¶ 18, 51–52.

(70.) Above notes 18–23.

(71.) Human Rights Committee, General Comment No. 31: The Nature of the General Legal Obligation Imposed on States Parties to the Covenant, U.N. Doc. CCPR/C/21/Rev.1/Add.13 (May 26, 2004), ¶ 6.

(72.) Donoso, above note 53, ¶ 56.

(73.) For example, Sinha, above note 5, pp. 905–08.

(74.) Cf. International Principles on the Application of Human Rights to Communications Surveillance (2014), https://necessaryandproportionate.org/principles; OHCHR report, above note 5, ¶¶ 23–27; Human Rights Committee, Concluding Observations on the Fifth Periodic Report of France, U.N. Doc. CCPR/C/FRA/CO/5, August 17, 2015, ¶ 12.

(75.) See, for example, Digital Rights Ireland, above note 30, ¶¶ 41–44; Zakharov, above note 40, ¶ 237; Kennedy, above note 51, ¶ 155.

(76.) Tele2 Sverige AB v. Post- och telestyrelsen (Case C-203/15) and Secretary of State for the Home Department v. Watson and others (Case C-698/15), Opinion of Advocate General Øe, July 19, 2016, ¶¶ 247–248.

(77.) See ibid. for this balancing test. At the time of writing, the compliance of constant video surveillance of a classroom with Article 8 of the ECHR was at issue in the communicated ECtHR case of Antović and Mirković v. Montenegro, Application no. 70838/13 (communicated December 3, 2014).

(78.) Above note 2.

(79.) Klass and others, above note 2, ¶ 17.

(80.) See Center for Democracy & Technology and Privacy International, above note 62, ¶ 36.

(81.) S. and Marper, above note 32, ¶¶ 125–126; see also Center for Democracy & Technology and Privacy International, above note 62, ¶ 38.

(82.) Zakharov, above note 40.

(83.) Szabó and Vissy, above note 2, ¶ 73.

(84.) Sarah St.Vincent, Did the European Court of Human Rights Just Outlaw ‘Massive Monitoring of Communications’ in Europe? (January 13, 2016), https://cdt.org/blog/did-the-european-court-of-human-rights-just-outlaw-massive-monitoring-of-communications-in-europe/.

(85.) Szabó and Vissy, above note 2, ¶ 69 (quoting Kennedy, above note 51, ¶ 160)

(86.) Digital Rights Ireland, above note 30, ¶¶ 58–59; Directive 2006/24/EC on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks, art. 6. But see Tele2 Sverige AB and Watson and others, Opinion of the Advocate General, above note 76, ¶¶ 116 and 126 et seq., which interprets the Digital Rights Ireland judgment as permitting EU Member States to impose data-retention mandates if other requirements of EU law (including the Charter) are met.

(87.) Schrems, above note 34, ¶ 94.

(88.) Above notes 11–12 and accompanying text.

(89.) OHCHR report, above note 5, ¶ 25.

(90.) Emmerson report, above note 46, ¶¶ 12–13.

(91.) Cf. generally OHCHR report, above note 5, ¶ 14. On the non-derogability of the freedom of opinion, see Human Rights Committee, General Comment No. 34: Article 19: Freedoms of Opinion and Expression, U.N. Doc. CCPR/C/GC/34, September 12, 2011, ¶ 5.

(92.) UDHR, above note 14, arts. 18–20; ICCPR, above note 4, arts. 18–19, 21–22; ACHR, above note 4, arts. 12–13, 15–16; ECHR, above note 4, arts. 9–11; EU Charter, above note 20, arts. 10–12; American Declaration, above note 14, arts. 3–4, 21–22.

(93.) General Assembly, above note 61, preamble (“recognizing that the exercise of the right to privacy is important for the realization of the right to freedom of expression and to hold opinions without interference and the right to freedom of peaceful assembly and association”); United Nations General Assembly, The Right to Privacy in the Digital Age, U.N. Doc. A/RES/68/167 (December 18, 2013), preamble (containing similar language concerning the right to freedom of opinion and expression); Human Rights Council, Report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, David Kaye, U.N. Doc. A/HRC/29/32 (May 22, 2015), ¶ 16 (deploying the “gateway” concept; hereinafter Kaye report); La Rue report, above note 26, ¶ 24.

(94.) 10 Human Rights Organisations v. the United Kingdom and Bureau of Investigative Journalism and Ross v. the United Kingdom, above note 9.

(95.) Weber and Saravia, above note 39, ¶¶ 143 et seq.

(96.) Ibid., at ¶¶ 143–146.

(97.) Ibid., at para. 149 (citing Goodwin v. the United Kingdom, Application no. 17488/90, Judgment (Grand Chamber), March 27, 1996, ¶¶ 39–40).

(98.) Ibid., at ¶¶ 147–152.

(99.) Ibid., at ¶ 153.

(100.) Youth Initiative for Human Rights v. Serbia, Application No. 48135/06, Judgment, June 25, 2013, ¶¶ 24–26; Global Principles on National Security and the Right to Information (Tshwane Principles) (2013), https://www.opensocietyfoundations.org/sites/default/files/global-principles-national-security-10232013.pdf. The Tshwane Principles posit, inter alia, that “[n]‌o restriction on the right to information on national security grounds may be imposed unless the government can demonstrate that: (1) the restriction (a) is prescribed by law and (b) is necessary in a democratic society (c) to protect a legitimate national security interest; and (2) the law provides for adequate safeguards against abuse, including prompt, full, accessible, and effective scrutiny of the validity of the restriction by an independent oversight authority and full review by the courts” (Principle 3).

(101.) Digital Rights Ireland, above note 30, ¶¶ 18, 70.

(102.) See Human Rights Council, Report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, Frank La Rue, U.N. Doc. A/HRC/17/27 (May 16, 2011), ¶¶ 53 et seq.

(103.) Ibid., at ¶¶ 53 and 55; Kaye report, above note 93, ¶ 12.

(104.) Kaye report, above note 93; cf. Human Rights Council, above note 102, ¶ 55 (implying that states should allow individuals to use encryption).

(105.) Kaye report, above note 93, ¶ 12.

(106.) United Nations Special Rapporteur on the protection and promotion of the right to freedom of opinion and expression and the Special Rapporteur for freedom of expression of the Inter-American Commission on Human Rights, Joint Declaration on Surveillance Programmes and Their Impact on Freedom of Expression (June 21, 2013), http://www.oas.org/en/iachr/expression/showarticle.asp?artID=926&lID=1.

(107.) Kaye report, above note 93, ¶ 21.

(108.) Işik v. Turkey, Application no. 21924/05, Judgment, February 2, 2010, ¶ 41.

(109.) UDHR, above note 14, art. 8; American Declaration, above note 14, art. 18.

(110.) ICCPR, above note 4, art. 2(3); ACHR, above note 4, art. 25; ECHR, above note 4, art. 13.

(111.) American Declaration, above note 14, art. 18; ACHR, above note 4, art. 25; ECHR, above note 4, art. 13; EU Charter, above note 20, art. 47.

(112.) ICCPR, above note 4, art. 2(3)(b).

(113.) See, for example, Leander, above note 41, ¶¶ 81, 83–84; P.G. and J.H., above note 31, ¶ 88.

(114.) Association for European Integration and Human Rights and Ekimdzhiev, above note 56, ¶ 100.

(115.) P.G. and J.H., above note 31, ¶ 85.

(116.) UDHR, above note 14, art. 2; American Declaration, above note 14, art. 2; ICCPR, above note 4, art. 2(1); ACHR, above note 4, art. 1; ECHR, above note 4, art. 14; EU Charter, above note 20, art. 21

(117.) International Convention on the Elimination of All Forms of Racial Discrimination, 660 U.N.T.S. 195 (1965).

(118.) OHCHR report, above note 4, ¶¶ 35–36.