Communicated on 2 May 2019
Application no. 70078/12
Mihail Tiholov EKIMDZHIEV and others
against Bulgaria
lodged on 19 October 2012
1.
The applicants are two lawyers in private practice and two non-governmental organisations related to them.
2.
The first applicant, Mr Mihail Ekimdzhiev, was born in 1964 and lives in Plovdiv. He is a lawyer whose practice includes acting as counsel in various domestic cases and representing applicants before this Court.
3.
The second applicant, Association for European Integration and Human Rights, was formed in 1998 and has its registered office in Plovdiv. The first applicant, Mr Ekimdzhiev, is the chairman of its board.
4.
The third applicant, Mr Aleksandar Kashamov, was born in 1971 and lives in Sofia. He is also a lawyer whose practice includes acting as counsel in various domestic cases and representing applicants before this Court.
5.
The fourth applicant, Access to Information Foundation, was set up in 1997 and has its registered office in Sofia. The third applicant, Mr
Kashamov, is the head of its in-house legal team.
6.
The first and second applicants are represented before the Court by Ms S. Stefanova and Ms G. Chernicherska, lawyers practicing in Plovdiv. The fourth applicant is represented by the third applicant.
A.
The circumstances of the case
7.
The facts of the case, as submitted by the applicants, may be summarised as follows.
8.
The applicants say that the nature of their activities puts all of them at risk of both secret surveillance and acquisition of their communications data under the laws authorising this in Bulgaria. They do not allege that they have in fact had their communications intercepted or their communications data acquired by the authorities.
B.
Relevant domestic law and practice
1.
Special means of surveillance
9.
The law governing special means of surveillance is chiefly set out in the Special Means of Surveillance Act 1997, as amended, Articles 172-177 of the Code of Criminal Procedure, as amended, sections 304-310 of the Electronic Communications Act 2007, as amended, and the internal rules of the National Bureau for Control of Special Means of Surveillance, whose most recent version was adopted in October 2016.
10.
In December 2008, following the Court’s judgment in
Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria
(no. 62540/00, 28 June 2007), the 1997 Act was extensively amended. The explanatory notes to the amendment bill referred to the judgment and the need to bring the Act into line with the requirements of the Convention. Along with a host of other changes, the amendment created a National Bureau for Control of Special Means of Surveillance, an independent body whose five members were to be elected by Parliament and whose task was to oversee the use of special means of surveillance and the storing and destruction of material obtained through such means, and protect individuals against the unlawful use of such means.
11.
In October 2009, however, before the Bureau could start operating, Parliament enacted further amendments to the 1997 Act, abolishing the Bureau and replacing it with a special parliamentary committee. The amendments came into effect in November 2009. For further details on these amendments and the committee’s work in 2011, see
Hadzhiev v.
Bulgaria
(no. 22373/04, §§ 26-28, 23 October 2012), and
Lenev v.
Bulgaria
(no. 41452/07, §§ 81-83, 4 December 2012).
12.
A further amendment to the 1997 Act that came into effect in August 2013 re-established the Bureau, and it was set up and began operating in late 2013. The special parliamentary committee continued to exist alongside the Bureau (section 34h of the 1997 Act, as worded since August 2013, and Rule 18 §§ 1 (4)(a) and 2 (1) of the current Parliament’s Standing Rules).
13.
The Bureau has so far published and laid before Parliament annual reports for 2014, 2015, 2016, and 2017. In April 2017 the Sofia City Court also published an
ad hoc
report on its activities in relation to secret surveillance.
14.
The 1997 Act underwent further amendments in each of the years between 2010 and 2019.
15.
A detailed description of the amendments until February 2013 can be found in a memorandum drawn up by the Department for the Execution of the Judgments and Decisions of the Court at that time (
CM/Inf/DH(2013)7
).
2.
Liability for unlawful use of special means of surveillance
16
.
Section 2(1)(7) of the State and Municipalities Liability for Damage Act 1988, added in March 2009, provides that the State is liable for damage which the investigating and prosecuting authorities or the courts have caused to individuals through the unlawful use of special means of surveillance.
17.
There is already some case-law under that provision.
18
.
The courts have clarified that:
(a)
it applies only prospectively (see реш. № 61 от 05.03.2012 г. по гр.
д. № 536/2011 г., ВтАС, appeal on points of law not admitted by опр.
№ 1435 от 15.12.2012 г. по гр. д. № 815/2012 г., ВКС, III г. о.); and
(b)
a claim for damages under that provision cannot be brought against the court which has issued the surveillance warrant but, as the case may be, against (i) the authority which has applied for the warrant, if it has been issued; (ii) the authority which has deployed special means of surveillance, if no warrant has been applied for or has been refused, or the authority has unlawfully proceeded without a warrant (under the provision of the 1997
Act, section 18, which authorises this in urgent cases); or (iii) the authority which has used the intercept material (see опр. № 3658 от 10.08.2015 г. по гр. д. № 126/2015 г., ОС-Благоевград, upheld by опр. №
2987 от 28.10.2015 г. по в. ч. гр. д. № 3999/2015 г., САС, appeal on points of law not admitted by опр. № 89 от 01.04.2016 г. по ч. гр. д. №
240/2016 г., ВКС, I г. о.; опр. № 240 от 28.03.2016 г. по в. ч. гр. д. №
171/2016 г., ОС-Перник, appeal on points of law not admitted by опр.
№ 344 от 19.09.2016 г. по ч. гр. д. № 3228/2016 г., ВКС, III г. о.; опр.
от
06.01.2017 г. по гр. д. № 5567/2016 г., СГС, upheld by опр.
№
1284 от 12.04.2017 г. по в. ч. гр. д. № 1349/2017 г., САС, appeal on points of law not admitted by опр. № 303 от 22.08.2017 г. по ч. гр. д. № 2731/2017 г., ВКС, III г. о.; and реш. № 203 от 27.02.2019 г. по гр. д. № 5061/2017 г., ВКС, III г. о.).
19
.
The courts have so far awarded damages ranging between 2,000 and
6,000 Bulgarian levs (BGN) in respect of various instances of unlawful use of special means of surveillance:
(a)
use of such means in relation to offences in respect of which this is not authorised by the law and in the absence of sufficient factual justification in the application for a warrant (see реш. № 1811 от
21.07.2017 г. по в. гр. д. № 615/2017 г., САС, upheld by реш. № 166 от 03.08.2018 г. по гр. д. № 4454/2017 г., ВКС, IV г. о.);
(b)
application for a warrant for renewed surveillance without fresh justification and surveillance outside the relevant time-limits (see реш.
№
2808 от 04.05.2018 г. по гр. д. № 11366/2016 г., СГС, not clear whether final);
(c)
obtaining a warrant for renewed surveillance without providing enough factual data in the renewal application (see реш. № 6303 от
10.10.2018 г. по гр. д. № 11689/2016 г., СГС (final), rectified with реш. № 3 от 02.01.2019 г. по гр. д. № 11689/2016 г., СГС)
(d)
obtaining a warrant solely on the basis of an anonymous signal and without detailing the previous, if any, steps in the investigation (see реш.
№
7225 от 20.11.2018 г. по в. гр. д. № 16408/2017 г., СГС (final)).
(e)
use of special means of surveillance outside the relevant time-limit (see реш. № 8690 от 21.12.2017 г. по гр.д.№ 6213/2017 г., СГС, upheld by реш. № 1536 от 01.06.2018 г. по в. гр. д. № 1509/2018 г., САС, appeal on points of law still pending (гр. д. № 3963/2018 г., ВКС, IV г. о.)).
(f)
intercepting telephone communications to trace a fugitive, which is not among the situations in which the 1997 Act permits that (see реш.
№
1360 от 12.01.2017 г. по гр. д. № 781/2015 г., РС-Перник, upheld by реш. № 173 от 23.06.2017 г. по в. гр. д. № 237/2017 г., ОС-Перник, upheld, with an increase of the award of damages, by реш. № 203 от
27.02.2019 г. по гр. д. № 5061/2017 г., ВКС, III г. о.).
20
.
In all of those cases, the claimants had been notified by the National Bureau for Control of Special Means of Surveillance that they had been subjected to unlawful secret surveillance, and the courts had before them information from the Bureau.
3.
Retention and acquisition of communications data
21
.
The retention and subsequent acquisition of communications data for law-enforcement purposes was first introduced in Bulgarian law when the Electronic Communications Act 2007, specifically section 251, came into force in May 2007, and then the Minister of Internal Affairs and the head of the State Agency for Information Technologies and Communications issued, based on a statutory delegation in section 251(2), Regulations no. 40 of
7
January 2008 “on the categories of data and the manner in which they are to be retained and made available by enterprises offering public communications networks or services for national-security purposes and the uncovering of offences”.
22
.
Those provisions were put in place with a view to transposing into Bulgarian law Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks (the “Data Retention Directive”) (paragraph 4 of the Regulations’ transitional and concluding provisions).
23
.
Regulation 5 of those Regulations was quashed by the Supreme Administrative Court in December 2008 following a challenge by the fourth applicant, the Access to Information Foundation (see реш. № 13627 от
11.12.2008 г. на ВАС по адм. д. № 11799/2008 г., ВАС, петчл. с-в, ДВ, бр. 108/2008 г.).
24
.
With effect from March 2009, Parliament amended section 251 of the 2007 Act, removing the statutory delegation enabling the issuing of regulations pursuant to it. The status of Regulations no. 40 of 7 January 2008, which have not been formally repealed, is hence unclear.
25
.
In early 2010 Parliament added new sections 250a-250f, 251a, 261a
‑
261b, 327(4)-(7), and 332a to the 2007 Act, and amended section 251. This was again done with a view to transposing the Data Retention Directive (paragraph 10 of the additional provisions of the February 2010 Act for the amendment of the 2007 Act).
26
.
Following a legal challenge brought by the Ombudsman of the Republic in April 2014, in the wake of the judgment of the Court of Justice of the European Union (“CJEU”) in
Digital Rights Ireland v. Minister for Communications, Marine and Natural Resources and Others and Seitinger and Others
, cases C-293/12 and C-594/12, ECLI:EU:C:2014:238
, in which the CJEU declared the Data Retention Directive invalid, on 12 March 2015 the Constitutional Court declared sections 250a-250f, 251 and 251a of the 2007 Act unconstitutional as a whole (see реш. № 2 от 12.03.2015 г. по к.
д.
№
8/2014 г., КС, обн. ДВ, бр. 23/2015 г.).
27
.
In reaction to that judgment, in late March 2015 Parliament added new sections 251b-251i to the 2007 Act, and also a new Article 159a to the Code of Criminal Procedure. They have been amended several times since then: in late 2015, late 2016 and early 2018. In 2016, a new section 251d
1
was added.
28
.
In short, the law as it stands at present provides for the retention of all communications data (as opposed to the content of communications) of all users of communications services for a period of six months, with a view to making them available to the authorities for (a) national-security purposes; (b) the prevention, detection or investigation of serious crime (including, following a January 2018 amendment, the prevention of “serious offences” of corruption by a special commission); and (c) the carrying out of search-and-rescue operations with respect to people in distress. The retained data can be acquired by certain law-enforcement and investigating authorities on the basis of a judicial warrant. In urgent cases relating to terrorist crime, the authorities can at first proceed without a warrant, but must then obtain one within twenty-four hours.
29
.
There are two bodies overseeing the application of those provisions: the Commission for Protection of Personal Data, which oversees the communications service providers (section 261a of the 2007 Act), and the Parliamentary Committee for Control of the Security Services, of the Application and Use of Special Means of Surveillance, and of Access to the Data under the Electronic Communications Act, which oversees not only the communications service providers, but also the authorities entitled to acquire communications data and the procedures whereby they seek and obtain such data (section 261b of the 2007 Act and Rule 18 §§ 1 (4)(b) and
2 (2) of the current Parliament’s Standing Rules).
30
.
As required by section 261a(5) of the 2007 Act, in its annual reports the Commission for Protection of Personal Data includes data about the total number of cases in which the authorities have acquired retained communications data, the average amount of time between the retention of the data and its acquisition by the authorities, and the number of cases in which the data could not be provided by the communications service provider. The report for 2016 said, at pp. 91-92, that the number of access requests had been 73,326, and that 70,543 of those, or about 96%, had been met by the communications service providers. The report for 2017 said, at p.
104, that the number of access requests had been 65,505, and that only
546 of those, or 0.86%, had remained unmet. The report for 2018 said, at p. 99, that the number of access requests had been 65,420, and that
65,073, or about 99%, of those had been met.
31
.
The annual report of the Parliamentary Committee for Control of the Security Services, of the Application and Use of Special Means of Surveillance, and of Access to the Data under the Electronic Communications Act for 2017 also contained, at pp. 4-8, statistical data. It recorded, in particular, at pp. 4-5, that according to data made available by the Supreme Judicial Council the overall number of access requests received by the courts in 2017 in connection with pending criminal proceedings had been 25,252, with 23,895 warrants issued and 1,449 refusals (compared to 24,758 requests, 23,352 warrants and 1,395 refusals in 2016), and the overall number of access requests made outside the context of already pending criminal proceedings had been 13,233, with 14,597 warrants issued and 1,313 refusals (compared to 15,805 requests, 16,638 warrants and 2,084
refusals in 2016).
[1]
The report also set forth, pp. 8-12, various issues noted during the course of 302 inspections carried out by experts employed by the Committee during the course of 2017, and highlighted, at p. 13, three specific recommendations by the Committee: (a) uniformity of practice in relation to requests for access to retained data and warrants when they concern more than one communications service provider; (b) more effective control over the destruction of irrelevant data obtained by the prosecuting and investigating authorities; and (c) uniformity of practice in relation to the registration of requests for access and warrants granted by the courts. The report went on to say that the same recommendations had been made in 2016 but had remained unheeded.
C.
Relevant decisions of the Committee of Ministers
32
.
The Committee of Ministers has so far examined twice the execution of the Court’s judgment in
Association for European Integration and Human Rights and Ekimdzhiev
(cited above): first in March 2013 (see
CM/Del/Dec(2013)1164/8
) and then again in June 2017 (see
CM/Del/Dec(2017)1288/H46-7
). In February 2013 the Department for the Execution of the Judgments and Decisions of the Court prepared a memorandum meant to enable the Committee to assess the measures taken by the Bulgarian authorities and to identify the issues which remained outstanding (see
CM/Inf/DH(2013)7
).
33.
The applicants complain that (a) the laws authorising the use of special means of surveillance, as amended following the Court’s judgment in
Association for European Integration and Human Rights and Ekimdzhiev
(cited above), and (b) the laws authorising the retention and acquisition of communications data do not provide enough safeguards against disproportionate and abusive interferences with their rights under Article 8 of the Convention.
34.
The applicants further complain under Article 13 of the Convention that they do not have effective domestic remedies in respect of those matters.
1.
Can the applicants claim to be victims of a breach of Article 8 of the Convention and that there has been an interference with their rights under that provision owing to the mere existence in Bulgaria of legislation permitting (a) the interception of communications (see
Roman Zakharov
v.
Russia
[GC], no. 47143/06, §§ 170-72, ECHR 2015, and
Szabó and Vissy
v.
Hungary
, no. 37138/14, §§ 37-39, 12 January 2016), and (b) the retention of communications data and its subsequent acquisition by the authorities?
1.1.
In particular, in relation to (a), was it open to the applicants to seek information from the National Bureau for Control of Special Means of Surveillance about whether special means of surveillance had been used with respect to them? How does their apparent failure to do so affect their victim status in the light of the principles laid down in
Roman Zakharov
(cited above, § 171)?
1.2.
In relation to (b), was it open to the applicants to seek information from the Parliamentary Committee for Control of the Security Services, of the Application and Use of Special Means of Surveillance, and of Access to the Data under the Electronic Communications Act about whether communications data relating to them had been acquired by the authorities? How does their apparent failure to do so affect their victim status? Also, what bearing, if any, does the legally-mandated retention of all the communications data of all users of communications services in Bulgaria have on that point?
2.
If the applicants can claim that they are victims, and that there has been an interference with their rights under Article 8 of the Convention in relation to (a) and (b), were these interferences “in accordance with the law” and “necessary in a democratic society” within the meaning of Article 8 § 2 (see, in relation to (a),
Roman Zakharov
, cited above, §§ 227-34)?
In answering this question, the parties are requested to address separately:
(a)
the surveillance of communications under the Special Surveillance Means Act 1997 and Articles 172-177 of the Code of Criminal Procedure; and
(b)
the retention and acquisition of communications data under sections
251b-251i of the Electronic Communications Act 2007 and Article
159a of the Code of Criminal Procedure.
2.1.
In relation to (a), the parties are requested to comment on, more specifically, whether the relevant legal provisions, as applied in practice, ensure effective compliance with the minimum safeguards flowing from the Court’s case-law in this domain (see
Roman Zakharov
, §§ 231-34, and
Szabó and Vissy
, §§ 56-57, both cited above). The parties are requested to address in particular, though not exclusively, the following points:
–
the effectiveness of (i) the judicial authorisation procedure, in particular with regard to surveillance on national-security grounds and surveillance in relation to offences against national security or terrorism-related offences, and of (ii) the post-surveillance control by the judge who has issued the surveillance warrant;
–
the accessibility and degree of precision of the rules governing the screening, processing, storage and destruction of surveillance materials and of secondary materials and evidence prepared on their basis, in particular when such materials fall outside the scope of the initial warrant;
–
the independence and effectiveness of the main oversight body, the National Bureau for Control of Special Means of Surveillance, in particular with regard to its membership and its inspection powers;
–
the effectiveness of the post-surveillance notification arrangements; and
–
the effectiveness of the remedy under section 2(1)(7) of the State and Municipalities Liability for Damage Act 1988, in particular in cases in which the claimants have not learned that they have been placed under surveillance during the course of criminal proceedings or by way of a notification by the National Bureau for Control of Special Means of Surveillance.
2.2.
In relation to (b), the parties are requested to comment on, more specifically, whether the relevant legal provisions, as amended following the judgment of the Constitutional Court of 12 March 2015 and applied in practice, are proportionate and ensure sufficient protection against arbitrary and indiscriminate interference and misuse and illegal access to data.
3.
Do the applicants have at their disposal effective domestic remedies with respect to the alleged breaches of their rights under Article 8 of the Convention detailed above, as required by Article 13 of the Convention?
[1]
.
The report specified that the overall number of warrants and refusals did not add up to the overall number of requests because in some cases the courts had issued more than one warrant pursuant to one request and in other cases they had issued partial warrants or refusals.