Case of Roman Zakharov v. Russia: The Strasbourg follow up to the Luxembourg Court’s Schrems judgment

By Paul De Hert and Pedro Cristobal Bocos (Vrije Universiteit Brussels)

The judgment of the Grand Chamber of the European Court of Human Rights in Roman Zakharov v. Russia last December 4, 2015 is part of the growing concern that some international human rights protection bodies have developed in the area of digital rights. This has been reflected at the European level with the judgment of the Court of Justice of the European Union that cancels the Safe Harbor decision – Maximillian Schrems v. Data Protection Commissioner – and the European Parliament resolution of 29 October on the mass surveillance of European citizens that recognizes, among other things, the important role played by Edward Snowden. The case comes also amid the growing concern of the United Nations (UN) on the matter that has resulted in resolution 68/167 of the General Assembly, in the reports and remarks of the High Commissioner for Human Rights (OHCHR), for example in September 2013 and in February 2014, and in the creation in July 2015 of a special rapporteur on the right to privacy.

Facts

Roman Zakharov was the editor-in-chief of a publishing company and of an aviation magazine. He was also the chairperson of the Saint Petersburg branch of the Glasnost Defence Foundation, an NGO monitoring the state of media freedom in Russia. On 23 December 2003 he brought judicial proceeding against three mobile network operators, claiming that there had been a violation of his right to the privacy of his communications.

On 5 December 2005 the Vasileostrovskiy District Court of St Petersburg dismissed the applicant’s claims. It found that the applicant had not proved that the mobile network operators had transmitted any protected information to unauthorised persons or permitted the unrestricted or unauthorised interception of communications. The applicant appealed. He claimed that the District Court had refused to accept several documents as evidence. Those documents had included two judicial orders authorising the interception of mobile telephone communications retrospectively and an addendum to the standard service provider agreement issued by one of the mobile network operators. The latter informed the subscriber that if his number were used to make terrorist threats, the mobile network operator might suspend the provision of the telephone service and transfer the collected data to the law-enforcement agencies. In the applicant’s opinion, the judicial orders and the addendum proved that the mobile network operators and law-enforcement agencies were technically capable of intercepting all telephone communications without obtaining prior judicial authorisation.

On 26 April 2006 the St Petersburg City Court upheld the judgment on appeal. It supported the District Court’s finding that Mr. Zakharov had failed to prove that his telephone communications had been intercepted. Nor had he shown that there was a danger of violation of his right to the privacy of his telephone communications. At this stage, the City Court decided that the refusal to admit the judicial orders of 8 October 2002 and 18 July 2003 as evidence had been lawful, as the judicial orders were irrelevant to the applicant’s case. However, the City Court further decided to admit as evidence the addendum to the service provider agreement, but found that it did not contain any information relevant for the City Court’s judgment.

The story doesn’t finish here as Mr. Zakharov got access to documents from an NGO “Civilian Control”, which in 2007, asked the Prosecutor General’s office to carry out an inspection of the Ministry of Communications’ Orders in the sphere of interception of communications in order to verify their compatibility with federal laws. In February 2007 an official from the Prosecutor General’s office telephoned “Civilian Control” and asked for copies of the unpublished attachments, saying that the prosecutor’s office had been unable to obtain them from the Ministry of Communications. In April 2007 the Prosecutor General’s office refused to carry out the requested inspection.

Reasoning of the Grand Chamber

The Court found that Zakharov was entitled to claim to be a victim of a violation of the European Convention, even though he was unable to allege that he had been the subject of a concrete measure of surveillance (see below).

Given the secret nature of the surveillance measures as set up by the law and the fact that they affected all users of mobile telephone communications, the Court considered it justified to have examined the relevant legislation not from the point of view of a specific instance of surveillance of which Zakharov had been the victim, but in the abstract. Therefore, the whole surveillance system was analysed.

Furthermore, the Court considered that Zakharov did not need to prove that he was even at risk of having his communications intercepted. Indeed, given that the domestic system did not provide an effective remedy to the person who suspected that he or she was subject to secret surveillance, the very existence of the contested legislation amounted in itself to an interference with Zakharov’s rights under Article 8.

The Court noted, at a request of the Russian government legal defense, that the interception of communications pursued the legitimate aims of protection of national security and public safety, prevention of crime and protection of the economic well-being of the country.

However, in view of the risk that a system of secret mass surveillance could be used to undermine or even destroy democracy under the cloak of defending it, the Court had to be satisfied that there were adequate and effective guarantees against abuse.

The Court concluded that the Russian legal provisions governing communications surveillance did not provide enough safeguards against mismanagements in the use of the system, such as arbitrariness or abuse. This risk is particularly high in a system such as the one in Russia where the secret services and the police had direct access, by technical means, to all mobile telephone communications.

In particular, the Court found shortcomings in the legal framework in the following areas: the supervision of the interception; the duration of such measures, notably the circumstances in which they should be discontinued; the circumstances in which public authorities in Russia are empowered to resort to secret surveillance measures; the procedures for authorising interception as well as for storing and destroying the intercepted data. Moreover, the effectiveness of the remedies available to challenge the interception of communications was under question by the fact that they were available only to persons who were able to submit proof of interception. The problem appears because obtaining such proof is impossible in the absence of any notification system.

Regarding the dissenting opinions, Judge Ziemele just makes reference to the Court’s decision not to award any compensation to Mr. Zakharov for the non-pecuniary damage sustained. The concurring judge was the Russian one, Mr. Dedov. He criticizes the judgment and defends Russia on four grounds:

1. Competence of the Court to examine the domestic law in abstracto. In this regard, he argues that the Court cannot analyze a law in abstracto without the applicant’s victim status being established and without determining that there had been interference with his right to respect for his private life in practice, and not merely theoretically.
2. Legislature and judiciary: the Court should respect differences as Mr. Dedov considers that the examination of a case in abstracto is similar to an expert report, but not to a judgment. Therefore, the Parliamentary Assembly of the Council of Europe is the institution that should take initiatives in this area.
3. The “reasonable likelihood” approach should be developed as he considers that the assumption that Mr. Zakharov is a victim does not hold according to previous decisions of the Court.
4. Role of the judiciary in civil society. Nevertheless he voted for the admission of the case because the judgment could serve as a basis for improving the legislation in the sphere of operational and search activities and for establishing an effective system of public control over surveillance.

The Kennedy Doctrine

The European Court of Human Rights is increasingly dealing with mass surveillance frameworks. Following the Snowden revelations on American mass surveillance, the question would be whether the Court would take a hard line defending privacy rights. This question is understandable as it is also asked to other institutions, such as the United Nations or the European Union.

The Court already gave an answer in the Kennedy case. Indeed, it accepted the principle that legislation can be challenged subject to two conditions. First, the law is broadly enough as to affect the citizens due to their membership to a group targeted by the law. Second, national law does not offer an effective remedy to an individual who suspects that her or his communications were intercepted. The Court took the opportunity that the Zakharov case offered to reinforce its approach stating clearly that indiscriminate acquisition of vast amounts of data should not be permissible.

In Zakharov we find the previous conditions. The Court did not find necessary for Zakharov to show how his privacy had actually been violated – the Court found it was enough that the framework was in place, and that there was no way to know whether a violation had taken place, as there is no authorization and no oversight. This continues the trend created in the Schrems case where the different Courts analyse the whole surveillance system of a country in order to discover if it follows the principles of the European Charter of Fundamental Rights. There is hardly any mass surveillance law in Europe or elsewhere that will pass this filter. The hunting has started.

The Article 8 paragraph 2 check by the Court and the role of notification

The judgment clarifies the second paragraph of Article 8. In particular, it explains the legitimate basis laid down by the law that allows data processes conducted by governments in the area of law surveillance. Indeed, the Court considered whether the surveillance framework that Zakharov suffered could be justified. Reiterating the well-established principles that, to be justified, any interference must be in accordance with the law, pursue a legitimate aim and be necessary in a democratic society, the Court considered the balance between necessity and legality.

In this regard, the Court considered the principles for assessing whether the intrusion was “necessary in a democratic society”, highlighting the tension between the consequences on that society of the measures taken to protect it and security. The Court pointed out that it must be satisfied that there are adequate and effective guarantees against abuse. In this regard, judicial authorisation is not fulfilled merely with some kind of involvement. On the contrary, judges must be sufficiently empowered to verify the existence of reasonable suspicion against a citizen. Moreover, the judicial power must also have the capacity to assess the proportionality and necessity of the surveillance.

Regarding the role of notification, this judgment follows previous decisions from the European Court of Human Rights. Indeed, “the jurisprudence of the European Court of Human Rights shows a clear tendency towards the establishment of a right to be informed. Already in 1987, the Council of Europe issued Recommendation R (87) 15 requiring the notification of individuals after they had been subject of surveillance measures.”[1] In particular, very relevant seems Principle 2.2 of the 1987 Recommendation regulating the use of personal data in the police sector that requires the notification of the individuals subjected to surveillance. From the point of view of the Court, the surveillance frameworks should guarantee a way of independent ex post control to enable individuals subjected to surveillance measures to retrospectively enact an infringement proceeding to challenge the lawfulness of the measure. Therefore, it is the opinion of the Court that citizens must enjoy a right to notification and it is clear that Zakharov is a reaffirmation of this safeguard.

Indeed, in the case we are analysing, when Mr. Zakharov or other NGOs tried to get access to the data of the interceptions, the government didn’t release any information. This produced that Mr. Zakharov’s objections were rejected several times at the Russian level because he couldn’t provide proof of the interceptions. This means that the effectiveness of the Russian remedies available to Mr. Zakharov to challenge the surveillance of its communications were undermined by the fact that he could only get judicial protection when obtaining proof of the interceptions he had suffered. The Court took a clear position and stated that a system like this doesn’t guarantee human rights.

Combining Zakharov and Schrems

The Zakharov case guarantees the rights to the citizens of Europe. First, Europeans have the rights to defend their rights when they consider that they have been violated by the state and the state should always guarantee a way to lodge this complaint.

Second, the Zakharov case is very relevant as the Court has shown its willingness not only in defence of Article 8, but also because the Court has raised questions about the validity of a whole surveillance system. Indeed, the four principles created by the court referring to the circumstances in which authorities are empowered to resort to secret surveillance measures, the duration of such measures, the procedures for authorising interception as well as for storing and destroying the intercepted data and the supervision of the interception, could be used as a blueprint to analyse if other systems respect fundamental values.

In the framework of a connected world with data flows going in and out of Europe, and with European legislation making difficult data transfers to third parties that do not respect the European Charter of Fundamental Rights, this case could become another problem for companies based in China, Russia and the USA after the invalidation of the Safe Harbour decision. Indeed, combining the principles of the Zakharov and Schrems cases, it seems difficult to find a third party that could enjoy the advantages of being chosen as a partner by the European Commission through a decision for data transfers. Even more relevant for European citizens, we may argue that the Court will start to scrutinize the surveillance practices and legislation of European states, as cases against them come before it. Moreover, it will be necessary to see how the Court will evaluate systems of bulk collection and mass surveillance conducted by the involvement of third states.

The timing of the case is also significant as it comes amid recent significant actions in the legal world. Indeed, Zakharov was ruled as the British draft Investigatory Powers Bill was published. It follows the ECJ’s ruling in Schrems, with Davis (along with the Swedish Tele2 reference) now pending before it. Moreover, the ECtHR noted the Digital Rights Ireland case in its summary of applicable law. We will need to wait for the Court’s decisions to get answers to our questions.

[1] De Hert, P. & Boehm, F., “Notification, an important safeguard against the improper use of surveillance – finally recognized in case law and EU law”, European Journal of Law and Technology , 2012, vol. 3, No. 3.