EKIMDZHIEV AND OTHERS v. BULGARIA

Primul reclamant, dl. Mihail Ekimdzhiev, s-a născut în 1964 și locuiește în Plovdiv. Este avocat și practica sa include reprezentarea în diverse dosare civile și reprezentarea reclamanților în fața acestei Curți.

Al doilea reclamant, Asociația pentru Integrare Europeană și Drepturi Omului, s-a înființat în 1998 și are sediul înregistrat în Plovdiv. Primul reclamant, dl. Ekimdzhiev, este președintele consiliului de administrație.

Al treilea reclamant, dl. Aleksandar Kashamov, s-a născut în 1971 și locuiește în Sofia. Este, de asemenea, avocat și practica sa include reprezentarea în diverse dosare civile și reprezentarea reclamanților în fața acestei Curți.

Al patrulea reclamant, Fundația de Acces la Informații, a fost înființată în 1997 și are sediul înregistrat în Sofia. Al treilea reclamant, dl. Kashamov, este șeful echipei sale juridice interne.

Primul și al doilea reclamant sunt reprezentați în fața Curții de doamna S. Stefanova și doamna G. Chernicherska, avocați care practică în Plovdiv. Al patrulea reclamant este reprezentat de al treilea reclamant. A. Circumstanțele dosarului

Faptele dosarului, conform versiunii prezentate de reclamații, pot fi rezumate după cum urmează.

Reclamații susțin că natura activităților lor îi pune pe toți la risc de supraveghere secretă și achiziție a datelor lor de comunicații în baza legilor care autorizează aceasta în Bulgaria. Ei nu susțin că au avut de fapt comunicații interceptate sau date de comunicații achiziție de către autoritățile. B. Legislația și practica internă relevante 1. Mijloace speciale de supraveghere

Legislația care reglementează mijloacele speciale de supraveghere este stabilită în principal în Legea privind Mijloacele Speciale de Supraveghere din 1997, în forma sa modificată, Articolele 172-177 din Codul de Procedură Penală, în forma sa modificată, secțiunile 304-310 din Legea Comunicațiilor Electronice din 2007, în forma sa modificată, și regulamentele interne ale Biroului Național de Control al Mijloacelor Speciale de Supraveghere, a cărui versiune cea mai recentă a fost adoptată în octombrie 2016.

În decembrie 2008, urmând sentinței acestei Curți în cauza Asociația pentru Integrare Europeană și Drepturi Omului și Ekimdzhiev împotriva Bulgariei (nr. 62540/00, 28 iunie 2007), Legea din 1997 a fost considerabil modificată. Notele explicative la proiectul de modificare s-au referit la sentință și la necesitatea armonizării Legii cu cerințele Convenției. Alături de o multitudine de alte modificări, amendamentul a creat Biroul Național de Control al Mijloacelor Speciale de Supraveghere, organism independent ai cărui cinci membri urmau să fie aleși de Parlament și a cărui sarcină era supraveghea utilizarea mijloacelor speciale de supraveghere și depozitarea și distrugerea materialului obținut prin asemenea mijloace, și proteja indivizii împotriva utilizării ilegale a acestor mijloace.

În octombrie 2009, cu toate acestea, înainte ca Biroul să poată începe să funcționeze, Parlamentul a adoptat modificări suplimentare la Legea din 1997, desființând Biroul și înlocuindu-l cu o comisie parlamentară specială. Modificările au intrat în vigoare în noiembrie 2009. Pentru detalii suplimentare privind aceste modificări și munca comisiei în 2011, a se vedea Hadzhiev împotriva Bulgariei (nr. 22373/04, §§ 26-28, 23 octombrie 2012), și Lenev împotriva Bulgariei (nr. 41452/07, §§ 81-83, 4 decembrie 2012).

O altă modificare la Legea din 1997 care a intrat în vigoare în august 2013 a restabilit Biroul, iar acesta a fost creat și a început să funcționeze la sfârșitul anului 2013. Comisia parlamentară specială a continuat să existe alături de Birou (secțiunea 34h din Legea din 1997, în forma sa din august 2013, și Regula 18 §§ 1 (4)(a) și 2 (1) din Regulamentele permanente actuale ale Parlamentului).

Biroul a publicat și prezentat în fața Parlamentului rapoarte anuale pentru 2014, 2015, 2016 și 2017. În aprilie 2017, Curtea de Stat din Sofia a publicat, de asemenea, un raport ad hoc asupra activităților sale în legătură cu supravegherea secretă.

Legea din 1997 a fost supusă unor modificări suplimentare în fiecare din anii 2010 și 2019.

O descriere detaliată a modificărilor până în februarie 2013 poate fi găsită într-un memorandum întocmit de către Departamentul pentru Executarea Sentințelor și Deciziilor acestei Curți din acea perioadă (CM/Inf/DH(2013)7). 2. Răspundere pentru utilizarea ilegală a mijloacelor speciale de supraveghere

Secțiunea 2(1)(7) din Legea privind Răspunderea Statului și Autorităților Locale pentru Daunuri din 1988, adăugată în martie 2009, prevede că Statul este răspunzător pentru daune pe care autoritățile investigative și acuzante sau instanțele le-au provocat indivizilor prin utilizarea ilegală a mijloacelor speciale de supraveghere.

Există deja o oarecare jurisprudență în baza acestei prevederi.

Instanțele au clarificat că: (a) aceasta se aplică numai prospectiv; (b) o pretenție de despăgubire în baza acestei prevederi nu poate fi adusă împotriva instanței care a emis mandatul de supraveghere, dar, după caz, împotriva (i) autorității care a solicitat mandatul, dacă acesta a fost emis; (ii) autorității care a implicat mijloace speciale de supraveghere, dacă niciun mandat nu a fost solicitat sau a fost refuzat, sau autoritatea a procedat ilegal fără mandat (în baza prevederii din Legea din 1997, secțiunea 18, care autorizează aceasta în cazuri de urgență); sau (iii) autorității care a utilizat material de interceptare.

Instanțele au acordat până în prezent despăgubiri variind între 2.000 și 6.000 de leva bulgare (BGN) în privința diferitelor cazuri de utilizare ilegală a mijloacelor speciale de supraveghere.

The first applicant, Mr Mihail Ekimdzhiev, was born in 1964 and lives in Plovdiv. He is a lawyer whose practice includes acting as counsel in various domestic cases and representing applicants before this Court.

The second applicant, Association for European Integration and Human Rights, was formed in 1998 and has its registered office in Plovdiv. The first applicant, Mr Ekimdzhiev, is the chairman of its board.

The third applicant, Mr Aleksandar Kashamov, was born in 1971 and lives in Sofia. He is also a lawyer whose practice includes acting as counsel in various domestic cases and representing applicants before this Court.

The fourth applicant, Access to Information Foundation, was set up in 1997 and has its registered office in Sofia. The third applicant, Mr Kashamov, is the head of its in-house legal team.

The first and second applicants are represented before the Court by Ms S. Stefanova and Ms G. Chernicherska, lawyers practicing in Plovdiv. The fourth applicant is represented by the third applicant. A. The circumstances of the case

The facts of the case, as submitted by the applicants, may be summarised as follows.

The applicants say that the nature of their activities puts all of them at risk of both secret surveillance and acquisition of their communications data under the laws authorising this in Bulgaria. They do not allege that they have in fact had their communications intercepted or their communications data acquired by the authorities. B. Relevant domestic law and practice 1. Special means of surveillance

The law governing special means of surveillance is chiefly set out in the Special Means of Surveillance Act 1997, as amended, Articles 172-177 of the Code of Criminal Procedure, as amended, sections 304-310 of the Electronic Communications Act 2007, as amended, and the internal rules of the National Bureau for Control of Special Means of Surveillance, whose most recent version was adopted in October 2016.

In December 2008, following the Court’s judgment in Association for European Integration and Human Rights and Ekimdzhiev v. Bulgaria (no. 62540/00, 28 June 2007), the 1997 Act was extensively amended. The explanatory notes to the amendment bill referred to the judgment and the need to bring the Act into line with the requirements of the Convention. Along with a host of other changes, the amendment created a National Bureau for Control of Special Means of Surveillance, an independent body whose five members were to be elected by Parliament and whose task was to oversee the use of special means of surveillance and the storing and destruction of material obtained through such means, and protect individuals against the unlawful use of such means.

In October 2009, however, before the Bureau could start operating, Parliament enacted further amendments to the 1997 Act, abolishing the Bureau and replacing it with a special parliamentary committee. The amendments came into effect in November 2009. For further details on these amendments and the committee’s work in 2011, see Hadzhiev v. Bulgaria (no. 22373/04, §§ 26-28, 23 October 2012), and Lenev v. Bulgaria (no. 41452/07, §§ 81-83, 4 December 2012).

A further amendment to the 1997 Act that came into effect in August 2013 re-established the Bureau, and it was set up and began operating in late 2013. The special parliamentary committee continued to exist alongside the Bureau (section 34h of the 1997 Act, as worded since August 2013, and Rule 18 §§ 1 (4)(a) and 2 (1) of the current Parliament’s Standing Rules).

The Bureau has so far published and laid before Parliament annual reports for 2014, 2015, 2016, and 2017. In April 2017 the Sofia City Court also published an ad hoc report on its activities in relation to secret surveillance.

The 1997 Act underwent further amendments in each of the years between 2010 and 2019.

A detailed description of the amendments until February 2013 can be found in a memorandum drawn up by the Department for the Execution of the Judgments and Decisions of the Court at that time ( CM/Inf/DH(2013)7 ). 2. Liability for unlawful use of special means of surveillance 16 . Section 2(1)(7) of the State and Municipalities Liability for Damage Act 1988, added in March 2009, provides that the State is liable for damage which the investigating and prosecuting authorities or the courts have caused to individuals through the unlawful use of special means of surveillance.

There is already some case-law under that provision. 18 . The courts have clarified that: (a) it applies only prospectively (see реш. № 61 от 05.03.2012 г. по гр. д. № 536/2011 г., ВтАС, appeal on points of law not admitted by опр. № 1435 от 15.12.2012 г. по гр. д. № 815/2012 г., ВКС, III г. о.); and (b) a claim for damages under that provision cannot be brought against the court which has issued the surveillance warrant but, as the case may be, against (i) the authority which has applied for the warrant, if it has been issued; (ii) the authority which has deployed special means of surveillance, if no warrant has been applied for or has been refused, or the authority has unlawfully proceeded without a warrant (under the provision of the 1997 Act, section 18, which authorises this in urgent cases); or (iii) the authority which has used the intercept material (see опр. № 3658 от 10.08.2015 г. по гр. д. № 126/2015 г., ОС-Благоевград, upheld by опр. № 2987 от 28.10.2015 г. по в. ч. гр. д. № 3999/2015 г., САС, appeal on points of law not admitted by опр. № 89 от 01.04.2016 г. по ч. гр. д. № 240/2016 г., ВКС, I г. о.; опр. № 240 от 28.03.2016 г. по в. ч. гр. д. № 171/2016 г., ОС-Перник, appeal on points of law not admitted by опр. № 344 от 19.09.2016 г. по ч. гр. д. № 3228/2016 г., ВКС, III г. о.; опр. от 06.01.2017 г. по гр. д. № 5567/2016 г., СГС, upheld by опр. № 1284 от 12.04.2017 г. по в. ч. гр. д. № 1349/2017 г., САС, appeal on points of law not admitted by опр. № 303 от 22.08.2017 г. по ч. гр. д. № 2731/2017 г., ВКС, III г. о.; and реш. № 203 от 27.02.2019 г. по гр. д. № 5061/2017 г., ВКС, III г. о.). 19 . The courts have so far awarded damages ranging between 2,000 and 6,000 Bulgarian levs (BGN) in respect of various instances of unlawful use of special means of surveillance: (a) use of such means in relation to offences in respect of which this is not authorised by the law and in the absence of sufficient factual justification in the application for a warrant (see реш. № 1811 от 21.07.2017 г. по в. гр. д. № 615/2017 г., САС, upheld by реш. № 166 от 03.08.2018 г. по гр. д. № 4454/2017 г., ВКС, IV г. о.); (b) application for a warrant for renewed surveillance without fresh justification and surveillance outside the relevant time-limits (see реш. № 2808 от 04.05.2018 г. по гр. д. № 11366/2016 г., СГС, not clear whether final); (c) obtaining a warrant for renewed surveillance without providing enough factual data in the renewal application (see реш. № 6303 от 10.10.2018 г. по гр. д. № 11689/2016 г., СГС (final), rectified with реш. № 3 от 02.01.2019 г. по гр. д. № 11689/2016 г., СГС) (d) obtaining a warrant solely on the basis of an anonymous signal and without detailing the previous, if any, steps in the investigation (see реш. № 7225 от 20.11.2018 г. по в. гр. д. № 16408/2017 г., СГС (final)). (e) use of special means of surveillance outside the relevant time-limit (see реш. № 8690 от 21.12.2017 г. по гр.д.№ 6213/2017 г., СГС, upheld by реш. № 1536 от 01.06.2018 г. по в. гр. д. № 1509/2018 г., САС, appeal on points of law still pending (гр. д. № 3963/2018 г., ВКС, IV г. о.)). (f) intercepting telephone communications to trace a fugitive, which is not among the situations in which the 1997 Act permits that (see реш. № 1360 от 12.01.2017 г. по гр. д. № 781/2015 г., РС-Перник, upheld by реш. № 173 от 23.06.2017 г. по в. гр. д. № 237/2017 г., ОС-Перник, upheld, with an increase of the award of damages, by реш. № 203 от 27.02.2019 г. по гр. д. № 5061/2017 г., ВКС, III г. о.). 20 . In all of those cases, the claimants had been notified by the National Bureau for Control of Special Means of Surveillance that they had been subjected to unlawful secret surveillance, and the courts had before them information from the Bureau. 3. Retention and acquisition of communications data 21 . The retention and subsequent acquisition of communications data for law-enforcement purposes was first introduced in Bulgarian law when the Electronic Communications Act 2007, specifically section 251, came into force in May 2007, and then the Minister of Internal Affairs and the head of the State Agency for Information Technologies and Communications issued, based on a statutory delegation in section 251(2), Regulations no. 40 of 7 January 2008 “on the categories of data and the manner in which they are to be retained and made available by enterprises offering public communications networks or services for national-security purposes and the uncovering of offences”. 22 . Those provisions were put in place with a view to transposing into Bulgarian law Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks (the “Data Retention Directive”) (paragraph 4 of the Regulations’ transitional and concluding provisions). 23 . Regulation 5 of those Regulations was quashed by the Supreme Administrative Court in December 2008 following a challenge by the fourth applicant, the Access to Information Foundation (see реш. № 13627 от 11.12.2008 г. на ВАС по адм. д. № 11799/2008 г., ВАС, петчл. с-в, ДВ, бр. 108/2008 г.). 24 . With effect from March 2009, Parliament amended section 251 of the 2007 Act, removing the statutory delegation enabling the issuing of regulations pursuant to it. The status of Regulations no. 40 of 7 January 2008, which have not been formally repealed, is hence unclear. 25 . In early 2010 Parliament added new sections 250a-250f, 251a, 261a ‑ 261b, 327(4)-(7), and 332a to the 2007 Act, and amended section 251. This was again done with a view to transposing the Data Retention Directive (paragraph 10 of the additional provisions of the February 2010 Act for the amendment of the 2007 Act). 26 . Following a legal challenge brought by the Ombudsman of the Republic in April 2014, in the wake of the judgment of the Court of Justice of the European Union (“CJEU”) in Digital Rights Ireland v. Minister for Communications, Marine and Natural Resources and Others and Seitinger and Others , cases C-293/12 and C-594/12, ECLI:EU:C:2014:238 , in which the CJEU declared the Data Retention Directive invalid, on 12 March 2015 the Constitutional Court declared sections 250a-250f, 251 and 251a of the 2007 Act unconstitutional as a whole (see реш. № 2 от 12.03.2015 г. по к. д. № 8/2014 г., КС, обн. ДВ, бр. 23/2015 г.). 27 . In reaction to that judgment, in late March 2015 Parliament added new sections 251b-251i to the 2007 Act, and also a new Article 159a to the Code of Criminal Procedure. They have been amended several times since then: in late 2015, late 2016 and early 2018. In 2016, a new section 251d 1 was added. 28 . In short, the law as it stands at present provides for the retention of all communications data (as opposed to the content of communications) of all users of communications services for a period of six months, with a view to making them available to the authorities for (a) national-security purposes; (b) the prevention, detection or investigation of serious crime (including, following a January 2018 amendment, the prevention of “serious offences” of corruption by a special commission); and (c) the carrying out of search-and-rescue operations with respect to people in distress. The retained data can be acquired by certain law-enforcement and investigating authorities on the basis of a judicial warrant. In urgent cases relating to terrorist crime, the authorities can at first proceed without a warrant, but must then obtain one within twenty-four hours. 29 . There are two bodies overseeing the application of those provisions: the Commission for Protection of Personal Data, which oversees the communications service providers (section 261a of the 2007 Act), and the Parliamentary Committee for Control of the Security Services, of the Application and Use of Special Means of Surveillance, and of Access to the Data under the Electronic Communications Act, which oversees not only the communications service providers, but also the authorities entitled to acquire communications data and the procedures whereby they seek and obtain such data (section 261b of the 2007 Act and Rule 18 §§ 1 (4)(b) and 2 (2) of the current Parliament’s Standing Rules). 30 . As required by section 261a(5) of the 2007 Act, in its annual reports the Commission for Protection of Personal Data includes data about the total number of cases in which the authorities have acquired retained communications data, the average amount of time between the retention of the data and its acquisition by the authorities, and the number of cases in which the data could not be provided by the communications service provider. The report for 2016 said, at pp. 91-92, that the number of access requests had been 73,326, and that 70,543 of those, or about 96%, had been met by the communications service providers. The report for 2017 said, at p. 104, that the number of access requests had been 65,505, and that only 546 of those, or 0.86%, had remained unmet. The report for 2018 said, at p. 99, that the number of access requests had been 65,420, and that 65,073, or about 99%, of those had been met. 31 . The annual report of the Parliamentary Committee for Control of the Security Services, of the Application and Use of Special Means of Surveillance, and of Access to the Data under the Electronic Communications Act for 2017 also contained, at pp. 4-8, statistical data. It recorded, in particular, at pp. 4-5, that according to data made available by the Supreme Judicial Council the overall number of access requests received by the courts in 2017 in connection with pending criminal proceedings had been 25,252, with 23,895 warrants issued and 1,449 refusals (compared to 24,758 requests, 23,352 warrants and 1,395 refusals in 2016), and the overall number of access requests made outside the context of already pending criminal proceedings had been 13,233, with 14,597 warrants issued and 1,313 refusals (compared to 15,805 requests, 16,638 warrants and 2,084 refusals in 2016). [1] The report also set forth, pp. 8-12, various issues noted during the course of 302 inspections carried out by experts employed by the Committee during the course of 2017, and highlighted, at p. 13, three specific recommendations by the Committee: (a) uniformity of practice in relation to requests for access to retained data and warrants when they concern more than one communications service provider; (b) more effective control over the destruction of irrelevant data obtained by the prosecuting and investigating authorities; and (c) uniformity of practice in relation to the registration of requests for access and warrants granted by the courts. The report went on to say that the same recommendations had been made in 2016 but had remained unheeded. C. Relevant decisions of the Committee of Ministers 32 . The Committee of Ministers has so far examined twice the execution of the Court’s judgment in Association for European Integration and Human Rights and Ekimdzhiev (cited above): first in March 2013 (see CM/Del/Dec(2013)1164/8 ) and then again in June 2017 (see CM/Del/Dec(2017)1288/H46-7 ). In February 2013 the Department for the Execution of the Judgments and Decisions of the Court prepared a memorandum meant to enable the Committee to assess the measures taken by the Bulgarian authorities and to identify the issues which remained outstanding (see CM/Inf/DH(2013)7 ). COMPLAINTS 33. The applicants complain that (a) the laws authorising the use of special means of surveillance, as amended following the Court’s judgment in Association for European Integration and Human Rights and Ekimdzhiev (cited above), and (b) the laws authorising the retention and acquisition of communications data do not provide enough safeguards against disproportionate and abusive interferences with their rights under Article 8 of the Convention. 34. The applicants further complain under Article 13 of the Convention that they do not have effective domestic remedies in respect of those matters.