This report, prepared by foreign law specialists and analysts of the Law Library of Congress, offers a review of laws regulating the collection of intelligence in the European Union (EU) and selected EU Member States, namely Belgium, France, Germany, Netherlands, Portugal, Romania, Sweden, and the United Kingdom, and updates a report on the same topic issued by the Law Library of Congress in 2014. The previous survey of French legislation was substantially amended because of France’s new Law on Intelligence, which was passed in 2015. The most recent decisions of the European courts concerning mass surveillance and the validity of data retention activities undertaken by the European countries’ governments are reviewed in the EU survey, and measures aimed at the protection of personal data prescribed by a recently concluded US–EU agreement are analyzed. The individual country surveys also describe legislative proposals currently under consideration in the respective parliaments. These include the Investigatory Powers Bill in the United Kingdom, the Cybersecurity Law of Romania, and proposals to enhance the privacy of citizens’ communications in the Netherlands.
Because issues of national security are under the jurisdiction of individual EU Member States and are regulated by domestic legislation, individual country surveys provide examples of how the European nations control activities of their intelligence agencies and what restrictions are imposed on information collection. All EU Member States follow EU legislation on personal data protection, which is a part of the common European Union responsibility. The report concludes with a comprehensive overview of applicable EU legislation.
The surveys demonstrate efforts undertaken by individual countries to maintain a balance between law enforcement and national security needs on the one hand and rights to privacy and personal data protection on the other. There is no single, comprehensive legal regime that applies to matters of surveillance, interception of communications, and privacy protection in the countries surveyed. In all of the countries included in the report, intelligence functions are divided among general intelligence and security services, military and financial intelligence, and the police. While in some countries (Belgium, Netherlands, Portugal, and the United Kingdom) intelligence agencies work according to principles established by a comprehensive statute, in others (Germany, Romania, and Sweden) individual laws address specific issues for particular intelligence agencies, and separate legislative or regulatory acts authorize certain government institutions to conduct specific intelligence gathering activities. The report on France demonstrates the country’s ongoing transition to regulating the work of intelligence-collection agencies through a major law, as opposed to the prior approach of regulating such work through various executive decisions.
While the legislative bodies of the surveyed countries conduct general oversight of their respective intelligence agencies, parliamentary involvement varies greatly. Judicial oversight is generally limited to the consideration and issuance of warrants for surveillance. Special government bodies for reviewing the legality of interception surveillance and privacy issues have also been created. These special bodies focus on how information is stored, shared among security agencies within the country and abroad, destroyed, and made available to interested individuals. Limitations on intelligence collection are established by national constitutions, criminal procedure laws, and special legislation, and are aimed at the general defense of rights and freedoms. They include restrictions in terms of the scope, duration, and subject matter of surveillance activities. The use of special powers, including communications surveillance, requires express permission from the Minister of Interior (Netherlands), issuance of a judicial order (Romania), or an approval warrant authorized by the Secretary of State (United Kingdom).
All national laws of the surveyed countries provide for some checks to preserve individuals’ personal data and the privacy of electronic and telecommunications, and transpose European Union directives into domestic law. At the same time, these measures are not always effective with regard to privacy protection.
Prepared by Peter Roudik
Director of Legal Research
Last Updated: 12/30/2020