This week the Dutch minister of Safety and Justice Opstelten sent a letter to Parliament (see also the blog post of Oerlemans). In order to fight cyber crime more effectively Opstelten proposes the creation of far-reaching investigatory powers. One of the measures concerns the remote access to computer systems and the installation of technical devices (spyware) on computers. In this blog the focus will be on this particular measure and its compatibility with the safeguards developed in the case law of the European Court of Human Rights (ECtHR/the Court) in the context of the right of privacy as stated in Article 8 of the European Convention of Human Rights and Fundamental Freedoms (ECHR). I will not go into the proposed measures regarding the possibility of using cross border remote searches.
The use of secret technical devices has severe consequences for the private life of the persons involved. Especially when we compare the installation of technical devices on someone’s personal computer to the tapping of telephone conversations. The latter is limited to the conversation between the suspect and another person, whereas the infiltration in a personal computer involves numerous data. By applying this measure, the private life of the person involved is seriously interfered with.
The Court has created several (procedural) requirements in its case law in order to avoid abuse in this field. The ratio behind these requirements can be found in a decision of the ECtHR in the case of Weber and Saravia vs. Germany (dealing with telephone tapping) in which the Court stated as follows (par.94): ‘Moreover, since the implementation in practice of measures of secret surveillance of communications is not open to scrutiny by the individuals concerned or the public at large, it would be contrary to the rule of law for the legal discretion granted to the executive or to a judge to be expressed in terms of an unfettered power. Consequently, the law must indicate the scope of any such discretion conferred on the competent authorities and the manner of its exercise with sufficient clarity to give the individual adequate protection against arbitrary interference (…)’ From this paragraph it can be derived that rules need to be provided for in national law to ensure that the national authorities will not use their powers in an unlimited way and to avoid an arbitrary interference. Although the Weber and Saravia case dealt with telephone tapping, one could argue that this reasoning is also applicable in the field of the use of secret technical devices on personal computers. Indeed, in my opinion, procedural safeguards and requirements are needed even more in case the national authorities start using an instrument that is so far-reaching. As stated above, the application of this measure has severe consequences for the privacy of the person involved. In cases in which a fundamental right such as the right of respect for privacy is at stake the Court raises the required standard of carefulness in the procedure. Additionally, the Court stated in its earlier case law that an effective remedy (preferably judicial review) should be available since the person involved is not aware of the application of far-reaching secret surveillance measures. Moreover the Court differentiates between the nature and therefore the severity of the measures applied, but it is clear that the infiltration of a person’s computer seriously conflicts with the right to privacy.
In the context of Article 8 of the Convention in the Grand Chamber judgment in the case of S and Marper vs. the United Kingdom (dealing with the storage and use of obtained DNA material) the Court reiterated that regulation is needed in the national law of the Member States (par.99): ‘It reiterates that it is as essential, in this context, as in telephone tapping, secret surveillance and covert intelligence-gathering, to have clear, detailed rules governing the scope and application of measures, as well as minimum safeguards concerning, inter alia, duration, storage, usage, access of third parties, procedures for preserving the integrity and confidentiality of data and procedures for its destruction, thus providing sufficient guarantees against the risk of abuse and arbitrariness (…). Without these requirements in national law and the application thereof, an interference will probably not be in compliance with both the ‘lawfulness’ requirement of the second section of Article 8 ECHR nor with the ‘necessity’ test. So although Opstelten did mention a few safeguards which have to be complied with in cases in which covert technical devices are used, a thorough human rights analysis is needed when laying down the proposed new provisions in our Code of Criminal Procedure (WvSv). Both Opstelten, the police and the public prosecutor (Openbaar Ministerie) need to be aware of the (procedural) requirements developed in the case law of the ECtHR and should pay special attention to these requirements in order to maintain the protection of the right to privacy.