68 http://www.utrechtlawreview.org/ Volume 1, Issue 1 (September) 2005
Balancing security and liberty within the European human rights
framework. A critical reading of the Court’s case law in the light
of surveillance and criminal law enforcement strategies after
9/11
Paul De Hert*
Post-September 11 changes in the public discourse and policy making on security
After the events of September 11 the US government immediately took steps to
strengthen security through a range of ambitious intelligence-gathering programmes
using mass surveillance systems, such as the Terrorism Information Awareness
Network, which employs data search and recognition pattern technologies within
joined-up databases to uncover terrorist and other threats to the infrastructure, and the
Computer Assisted Passenger Pre-Screening System (CAPPS II). Most EU countries
also responded to the events of September 11 by implementing a variety of
operational and legislative measures aimed at raising their levels of security.
Legislative measures were taken with a view to strengthening judicial mechanisms
and (special) investigative powers in the Member States and harmonizing anti-
terrorism policing procedures across Member States.1 Needless to say, this evolution
gained a new impetus after the March 11, 2004 terrorist attacks in Madrid.
It is important to note however that many of the intrusive security measures were
already under discussion prior to September 11. Hence, the terrorist attacks should be
regarded as a catalyst rather than as a trigger2 in the still ongoing shift from a reactive
* P.J.A. De Hert, associate-Professor at Leiden University; Professor at the Free University of Brussels and Fellow to the
research groups ‘Securing the Rule of Law in a World of Multilevel Jurisdiction’ and ‘Trias Europa’ at the Faculty of Law,
Leiden, e-mail: p.j.a.dehert@law.leidenuniv.nl
1 This description of post 9/11 is based on a report, in which the author participated, of the Institute for Prospective Technological
Studies – Joint Research Centre, Security and Privacy for the Citizen in the Post-September 11 Digital Age. A prospective
overview. Report to the European Parliament Committee on Citizens’ Freedoms and Rights, Justice and Home Affairs (LIBE),
July 2003, IPTS-Technical Report Series, EUR 20823 EN, particularly pages 8-9 and 94-98. See also:
<ftp://ftp.jrc.es/pub/EURdoc/eur20823en.pdf>. See also the contributions in Emmanuelle Bribosia & Anne Weyembergh (eds.),
Lutte contre le terrorisme et droits fondamentaux, Brussels, Bruylant, 2002, 305p.
2 Institute for Prospective Technological Studies – Joint Research Centre, o.c., 95-96 : “September 11 both accelerated the rate of
existing change processes and also created the opportunity for a changed security agenda: a) it brought about a more supportive
public mandate for security – In addition to ‘real time’ information flow analysis and security hardening to increase protection
against attack, public reaction also became more supportive of a range of pan-European ‘policing’ initiatives planned before
September 11 in response to pre-existing concerns over threats to security, e.g. the Council of Europe’s Cybercrime Convention
was signed by EU and G8 countries; the European arrest warrant replaces in 2004 the current system of extradition; Eurojust, set
up to assist the co-ordination, investigation and prosecution of serious cross-border crime and improve judicial co-operation; and
the cross-border Joint Investigation Teams. The willingness to co-operate within the EU and with the US over terrorist finance
(including regulation of professionals), extradition and intelligence sharing was facilitated by sympathetic EU reactions to
Balancing security and liberty within the European human rights framework. A critical reading of the
Court’s case law in the light of surveillance and criminal law enforcement strategies after 9/11
69
to a pro-active security and crime policy. September 11 indeed accelerated and
deepened this process, notwithstanding the vehement and worldwide resistance of
pro-privacy groups like Electronic Privacy Information Centre (EPIC), Privacy
International (PI) and Statewatch. In short, the result has been a widening of the use of
data mining and post-hoc behavioural pattern analysis systems, whereby the use of
ICT-based systems facilitates data collection and sharing between multiple sources in
support of intelligence gathering. In addition, the measures taken have also reinforced
the powers of governments and law enforcement bodies to access individuals’
personal data for purposes different from those for which the data were originally
gathered, supplied and processed.3 Of course, such forms of permanent and automated
surveillance are also affecting the power economy of our societies for they shape and
steer the behavior of individuals: under surveillance an individual will act differently
than without, even if he/she does not act or intend to act illegitimately. This evolution
seems to turn into hard reality what the American sociologist Gary Marx in 1988
already called the maximum security society.4 This ‘maximum security society’ relies
on a refined technological framework to influence and even ‘programme’ the daily
lives of citizens.5 Harsh investigation techniques are replaced by softer versions that
can be applied without knowledge of the persons observed. Large databases are
established and linked containing data on the people at large, suspect or not. The data
is gathered not occasionally, but via routinized discovery systems.6 Actions are taken
on the basis of concrete information and profiles. Data collecting and surveillance
methods are entrusted to various public and private actors. Recent studies confirm
Marx’s critical analysis of contemporary law enforcement and surveillance methods.
Robert O’Harrow’s No Place to Hide actually supplements some of Marx’s theses, by
emphasizing the more aggressive and dominant role of private data hunters in
America’s security policy today.7 Also, older technologies, such as national ID cards,
‘September 11’. b) it increased intelligence gathering through ICTs – The changing public discourse towards securitization has
also increased the use of surveillance to gather intelligence to forewarn against attacks and continuous threats from traffickers in
arms, drugs and people (many of the latter being economic migrants), plus the money laundering that is a routine component of
all major crimes involving financial gain. Schemes that seek to generate trust through the application of advanced technologies
are being introduced. Increased threat has been used to justify reliance upon ICT-based systems to facilitate data collection and
sharing, authentication and identity.”
3 Ibid., 9 : “In fact, normal access to many commercial and governmental services is now conditional upon the citizen’s
providing more comprehensive personal data than would have been the case previously. There can be little doubt therefore that
the combined effect of the operational and legislative measures described has been to tip the security/privacy balance in favor of
security interests. That they are principally based on the massive application of different technologies leads us to raise the
question of how efficient and effective these technologies are in achieving their aims.”
4 Gary T. Marx., ‘La société de sécurité maximale’, Déviance et société, 1988, 147-166. For a discussion of this concept and
similar concepts by Michel Foucault, Stanley Cohen and Gilles Deleuze: see Serge Gutwirth, Privacy and the information age,
Lanham, Rowman & Littlefield Publ., 2002, 71-78 (“Controlling societies”).
5 “Dans la société de sécurité maximale, il n’y a pas de distinction entre public et privé: nous sommes sous observation
permanente, tout est transcrit dans un dossier définitif, et beaucoup de ce que nous disons, faisons et même pensons est connu et
enregistré par d’autres que nous ne connaissons pas, que nous le voulions ou non, et même que nous le sachions ou non. On peut
grouper et analyser des informations receuillies de régions, d’organismes et d’époques chronologiques trés éloignés les uns des
autres. Le contröle préventif est imprégné d’un systþme où les informateurs, les dossiers et la classification prédominent. En
même temps qu’elle pénétre comme un laser, la surveillance absorbe comme une éponge. On regroupe et on entend à la société
en général la surveillance intensive qui normalement ne s’applique qu’ à l’investigation des suspects criminels, des cas
d’espionnage ou des prisoniers” (Gary T. Marx., ‘La société de sécurité maximale’, Déviance et société, 1988, 150).
6 G.T. Marx & N. Reichman, ‘Routinizing the Discovery of Secrets’, American Behavioral Scientist, 1984, 423-452.
7 Robert O’Harrow jr., No Place to Hide. Behind the Scenes of of our Emerging Surveillance Society, Free Press, 2005, 368p.
Compare with ‘Your Identity, Open to All‘, Wired, consulted May 2005,
http://www.wired.com/news/privacy/0,1848,67407,00.html: “A search for personal data on ZabaSearch.com – one of the most
comprehensive personal-data search engines on the net – tends to elicit one of two reactions from first-timers: terror or curiosity.
Which reaction often depends on whether you are searching for someone else’s data, or your own. ZabaSearch queries return a
PAUL DE HERT
70
now under vote in the last Western countries that have refrained from introducing
them, combined with newer technologies such as biometrics and facial recognition by
CCTV software, allow for massive identification schemes.8 The combination of these
technological measures threatens people’s ability to remain ‘anonymous’ and enable
tracking people where they are, where they’ve been and where they are going. To
believe O’Harrow this was exactly what admiral John Poindexter, father of the US
Total Information Awareness project, had in mind, but the admiral’s dream plan was
subsequently modified (though not abandoned) because of public upheaval. The
negative reactions were based on the feeling that this use of surveillance technology
has implications for human rights in general, and privacy in particular, as its potential
to exploit people or exert social control is unregulated.
European feelings concerning the superior legal protection
Some commentators argue that these ‘American stories’ do not apply to decision
making in Europe. Apart from differences in temper and approaches towards violence,
eloquently but controversially identified by Robert Kagan,9 there are differences in
constitutionalism that suggest superior legal and judicial protection in Europe.
Authors such as Schulhofer, Poullet and Goemans and Dumortier argue convincingly
that unchecked law enforcement powers will not pass the Convention test.10 One of
the arguments by some of these authors is the existence of a solid framework for
privacy protection in Europe. The protection of individual privacy at the EU level is
mainly governed by Article 8 of the European Convention for the Protection of
Human Rights and Fundamental Freedoms (ECHR) and Article 7 of the Charter of
Fundamental Rights of the European Union. In parallel, data protection in the EU is
governed by Directive 95/46/EC (24 October 1995) on the protection of individuals
with regard to the processing of personal data and on the free movement of such data,
Directive 2002/58/EC (12 July 2002) on privacy and electronic communications, by
Article 8 of the Charter of Fundamental Rights of the European Union11 and by the
Council of Europe Convention for the Protection of Individuals with regard to
Automatic Processing of Personal Data. In the United States there is no express right
to privacy guaranteed by the Constitution and no specific act exists that regulates the
protection of personal data. Although in certain situations the US Supreme Court has
interpreted the Constitution to protect the privacy of individuals, and several highly
specific regulations have been introduced, there is still no general recognized right to
wealth of info sometimes dating back more than 10 years: residential addresses, phone numbers both listed and unlisted, birth
year, even satellite photos of people’s homes”.
8 P. De Hert, Biometrics: legal issues and implications, Background paper for the Institute of Prospective Technological Studies,
DG JRC – Sevilla, European Commission, January 2005, 39p. via
http://cybersecurity.jrc.es/pages/ProjectlibestudyBiometrics.htm
9 R. Kagan, Of Paradise and Power: America and Europe in the New World Order, Alfred a Knopf Inc, February 2003. Dutch
translation: Robert Kagan, Balans van de Macht. De kloof tussen Amerika en Europa, Bezige Bij, 2003.
10 See the references to their work below. The arguments of Schulhofer based on the regulations with regard to emergency
situations such as terrorism will be discussed below.
11 “Everyone has the right to the protection of personal data concerning him or her. Such data must be processed fairly for
specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law.
Everyone has the right of access to data that has been collected concerning him or her, and the right to have it rectified.
Compliance with these rules shall be subject to control by an independent authority”.
Balancing security and liberty within the European human rights framework. A critical reading of the
Court’s case law in the light of surveillance and criminal law enforcement strategies after 9/11
71
privacy. Some even hold that it is precisely this patchwork of court rulings and
regulations that poses threats to privacy.12
The basic document of the European human rights framework is undeniably the
European Convention for the Protection of Human Rights. Concluded in 1950 within
the framework of the Council of Europe,13 it was designed to protect individuals’
fundamental rights and freedoms in a novel way. The Preamble to the Convention
reflects the determination of its drafters “to take the first steps for the collective
enforcement of certain of the rights stated in the Universal Declaration”. The Council
of Europe therefore instituted a judicial procedure allowing individuals to bring
actions against governments, if they consider that they are the victims of a violation of
the Convention. After the exhaustion of national remedies, individual complainants
have direct access to an international court, the European Court of Human Rights in
Strasbourg. Before discussing the status and the interpretative work of this Court, it is
worthwhile to recall some of the basic features of the European Convention.14
Firstly, the Convention is not a Constitution but a Treaty. After ratification it does not
automatically form part of the domestic legal orders of a Member State. Countries
such as the United Kingdom have ratified the Convention, but the Convention does
not form part of the law of the land. Although the Court has referred to the Conven-
tion as “a constitutional instrument of European public order (ordre public)”,15 it has
accepted this treaty-like status of the Convention.16 It has also held that domestic
courts are not obliged, as far as the Convention is concerned, to apply the Convention
ex officio, i.e. when the applicant himself has not relied on the Convention in order to
substantiate its claims.17
Secondly, unlike the US courts, the Court is not a constitutional court empowered to
check on the ‘constitutionality’ or ‘human rights compatibility’ of new legislation.
The Court does not have the power to annul national measures, nor does it have the
capacity to consider that it can order a State to change its legislation.18 Also, individuals
are not permitted to complain against a law in abstracto simply because they feel that it
contravenes the Convention. In principle, an individual applicant must be able to show
that a law has been applied to his detriment. In Klass19 the Court lowered the strict
12 For a defence of the American approach: Joseph I. Rosenbaum, ‘Privacy on the Internet: Whose Information is it Anyway?’;
Jurimetrics, 1998, Vol. 38, 565-573.
13 On the Council: A. Tomkins, ‘Civil Liberties in the Council of Europe: A Critical Survey’ in: C. Gearty (ed.), European Civil
Liberties and the European Convention on Human Rights. A Comparative Study, The Hague, Martinus Nijhoff Publishers, 1997,
2-4
14 We rely on R.A. Lawson & H. Schermers, ‘A Bird’s-Eye View of the European ConventionFout! Bladwijzer niet
gedefinieerd.’ in R.A. Lawson & H. Schermers (eds.), Leading Cases of the European Court of Human Rights, Nijmegen, Ars
Aequi Libri; Second Edition, 1999, x-xii.
15 ECHR, Loizidou v. Turkey, judgment of 23 March 1995, § 75. See more in detail on this: R.A. Lawson & H. Schermers, l.c.,
xi. Note about our references to the judgments of the European Court of Human Rights: in a first reference to such a judgment
we will mention the name of the applicant and the respondent state, as well as the date of the judgment. With these data the
judgments can easily be found at: http://www.dhcour.coe.fr/eng/. After the first reference that we will only use the name of the
applicant (ex. Malone). For precise references and quotes we will refer to the relevant paragraphs of the judgments.
16 See for a discussion of dualist systems and the position of the Court: R.A. Lawson & H. Schermers, ‘Comment to ECHR,
Lawless v. Ireland, judgment of 1 July 1961’, in R.A. Lawson & H. Schermers (eds.), Leading Cases of the European Court of
Human Rights, Nijmegen, Ars Aequi Libri; Second Edition, 1999, 13-14.
17 ECHR, judgment of 15 November 1996, Ahmet Sadik, § 33.
18 However, Member States often amend their legislation in response to a judgment, if only to prevent identical violations in the
future. Similarly, national judiciaries are increasingly prepared to apply the Strasbourg case law (R.A. Lawson & H. Schermers, l.c.,
xi).
19 ECHR, Klass v. Germany, judgment of 6 September 1978, § 33.
PAUL DE HERT
72
victim requirement in the Convention allowing the applicant to pursue his complaint
concerning new German legislation containing wire-tapping powers and other powers
to put persons and communications under surveillance, but this important hurdle was
erected again in later cases without proper reasoning.20
Finally, the machinery of protection established by the Convention is subsidiary to the
national systems safeguarding human rights.21 Whereas the law of the European
Communities generally seeks to harmonize the legal practice in the Member States, the
European Convention on Human Rights only prescribes minimum standards.22 From
the 1970s onwards the Court has elaborated and refined a theory of the necessity of
leaving Member States a ‘margin of appreciation’ when applying the Convention,
judging that Member States and their competent national courts are in a better position
to judge the necessity of measures that infringe on Convention rights.23 The role of the
Court is (only) to supervise this process and to give the final ruling on whether national
measures are reconcilable with the Convention.24 Interesting for our topic is the relevant
nature of this European supervision. Different standards of scrutiny exist. In some cases
more freedom is left to the Member States, in others there is a stricter standard of
scrutiny. Several factors, identified by the Court in successive cases, account for these
differences.25 A bit contrary to the idea that all human rights are equally necessary, the
Court has identified factors such as the nature of the Convention right in issue, its
importance for the individual and the nature of the activities concerned.26 It has been
rightly observed that state activities such as the fight against serious forms of
criminality or terrorism, are usually not subjected to the most strict standards of
scrutiny.27 In this area states enjoy a margin of appreciation. It is for them to make the
20 See on the victim requirement and on the burden this imposes on the applicant to prove beyond doubt that a concrete violation
has occurred in his or her case P. De Hert & O. De Schutter, ‘Straatsburg, videosurveillance en het vorderingsrecht van
verenigingen’, Algemeen Juridisch Tijdschrift (A.J.T.), 1998, 504-511 (annotation of ECRM, Pierre Herbecq & Ligue des droits
de l’homme v. Belgium); I. Cameron, National Security And The European Convention On Human Rights, The
Hague/London/Boston, Kluwer Law International, 2000, (479p.), 97-101
21 See on the importance of value pluralism and the position of the ECHR: Y. Arai-Takahashi, The Margin of Appreciation
Doctrine and the Principle of Proportionality in the Jurisprudence of the ECHR, Antwerp, Intersentia, 2002, 300.
22 R.A. Lawson & H. Schermers, l.c., xi with ref. to ECHR, Richard Handyside v. United Kingdom, judgment of 7 December
1976, § 49 (the Convention leaves to each Contracting Party, in the first place, the task of securing the rights and liberties it
enshrines) and to ECHR, Vermeire v. Belgium, judgment of 29 November 1991, § 26 (States have a freedom of choice when deciding
on measures to comply with their obligations under the Convention).
23 See on this theory, its origins and the ‘better-position’ argument: J. Schokkenbroeck, ‘De margin of appreciation-doctrine in de
jurisprudentie van het Europese Hof’, in Veertig jaar EVRM, (NJCM-special 1990), 41-58; R. Macdonald, ‘The margin of
Appreciation’, in R. Macdonald, F. Matscher & H. Petzold (eds.), The European System for the Protection of Human Rights,
Dordrecht, Martinus Nijhoff Publishers, 1993, 83-124; J. Vande Lanotte & Y. Haeck e.a., Het Europees verdrag tot bescherming
van de rechten van de mens in hoofdlijnen, Antwerp, Maklu, 1997, Deel 1, 187-188; E. Kastanas, Unité et diversité: Notions
autonomes et marge d’appréciation des Etats dans la jurisprudence de la Cour européenne des droits de l’homme, Brussels,
Bruylant, 1996, 480p.
24 See e.g. ECHR, Brannigan & McBride v. the United Kingdom, judgment of 26 May 1993, § 43.
25 ‘The Court has pointed out in several judgments that the Contracting States enjoy a certain ‘margin of appreciation’ in
assessing whether and to what extent differences in otherwise similar situations justify a different treatment in law (…). The
scope of the margin of appreciation will vary according to the circumstances, the subject matter and its background; in this
respect, one of the relevant factors may be the existence or non-existence of common ground between the laws of the Contracting
States’; (ECHR, Rasmussen v. Denmark, judgment of 28 November 1984, §. 40).
26 See in more detail: J.G.C. Schokkenbroek, Toetsing aan de vrijheidsrechten van het Europees verdrag tot bescherming van de
rechten van de mens, Zwolle, W.E.J. Tjeenk Willink, 1996, (575p.), 206-208.
27 “When the level of crime is perceived to threaten the ordre public, there may be pressure to take repressive measures at the
expense of human rights. It appears from the case law that the Court is prepared to accept the legitimacy of the fight against crime
and terrorism as well as to acknowledge the need to take effective measures, but obviously that does not mean that the authorities
have carte blanche” (R.A. Lawson & H. Schermers, l.c., xxi-xxii with ref. to ECHR, Brogan and others v. the United Kingdom,
judgment of 29 November 1988, § 48; ECHR, Kostovski v. the Netherlands, judgment of 20 November 1989, § 44).
Balancing security and liberty within the European human rights framework. A critical reading of the
Court’s case law in the light of surveillance and criminal law enforcement strategies after 9/11
73
initial assessment as to whether a right balance is struck between the exercise by the
individual of the rights guaranteed to him under the Convention and the necessity to
protect the democratic society as a whole.
When considering these three basic features, one is inclined to wonder about the
enthusiasm for and the moral authority of the European Court. In the following
paragraphs we highlight some of the elements that have contributed to this success
story, immediately followed by a more critical assessment of the strength of the
European human rights framework.
The dynamic influence emanating from Article 8 of the Convention
Surveillance technologies in their contemporary sense (e.g. large scale applications of
biometrics) were non-existent when French and American revolutionary spirits drafted
the first Western constitutions at the end of the eighteenth century. These texts, and all
the other texts that were inspired by them, simply did not envisage these techniques.
Only rougher techniques such as torture were taken into consideration. Even in the
European Convention there is no human right dealing explicitly with modern
surveillance technology. There are however some human rights with a general scope
that might be relevant for the issue. Of importance in the debate concerning
contemporary strategies against terrorism is firstly Article 8 of the Convention stating
that: “(1.) Everyone has the right to respect for his private and family life, his home
and his correspondence. (2.) There shall be no interference by a public authority with
the exercise of this right except such as is in accordance with the law and is necessary
in a democratic society in the interests of national security, public safety or the
economic well-being of the country, for the prevention of disorder or crime, for the
protection of health or morals, or for the protection of the rights and freedoms of
others”.
The history of the case law with regard to Article 8 of the Convention is rich, complex
and full of unexpected new developments that have contributed to a solid framework
of privacy protection.28 The first and foremost harmonizing influence emanating from
Article 8 of the Convention is the requirement that any invasion of privacy for a
legitimate reason (for purposes of criminal investigation, usually the prevention of
crime) must have a basis in law, and that this law – be it case law or statute – must be
of a certain quality: foreseeable (sufficiently detailed) and accessible and providing
remedies for the citizen. While in continental “civil” legal systems and culture it is
regarded as self evident that interference with the individual citizen by the state
requires an explicit basis in law, common law systems take the opposite view:
everything is allowed unless forbidden. Therefore, the full implementation of the
Convention required of the United Kingdom a substantial cultural volte face,29 at least
as far as the rules governing police powers are concerned.30
28 See P. De Hert, Artikel 8 EVRM. De bescherming van privacy, gezin, woonst en communicatie, Gent, Mys en Breesch Uitgeverij,
1998, 367p.
29 The course of events from Malone to the Regulation of Investigatory Powers Act 2000 is a locus classicus. A violation was
found of Article 8 ECHR in a case concerning interception and metering of telecommunication, on the grounds that a legal basis
PAUL DE HERT
The legality principle, meaning that interferences by the executive with the rights and
freedoms of the individual should not be permitted unless there is a clear legal basis to
do so and that individuals should be able to predict with reasonable certainty when
and under what conditions such interferences may occur, is also expressly laid down
in Articles 2, 5, 6, 7 and in the second paragraphs of Articles 9 to 11.
Article 8 of the Convention has also benefited from a wild interpretative method used
by the Court. The result is commonly known as ‘the dynamic character of the
Strasbourg case law’. This ‘remarkable aspect’ of the European human rights
practice,31 is no less than a straightforward departure from the traditional international
public law principle of strict interpretation of treaties. On numerous occasions the
Court emphasized that the Convention is “a living instrument which should be
interpreted according to present-day conditions”.32 In a similar vein the Court has
repeatedly stressed that the Convention is intended to guarantee “not rights that are
theoretical or illusory but practical and effective”.33
This unconventional, but effective method of interpretation that opens the way for
expanding the protection offered by the Convention, is of course very promising when
considering new technological developments that challenge human rights in a way
that could not be foreseen when drafting the Convention. The telephone tapping case
law of the European Court is traditionally hailed as a powerful demonstration of the
strength of the Convention. Although the Convention does not speak to us about
modern means of communication, the Court has successively brought telephone
conversations (Klass),34 telephone numbers (Malone), voice recording (P.G. & J.H.)35
under the scope of Article 8. This “dynamic” interpretation of the Convention is
believed to bring e-mails under the scope in due time.36
These examples show the wide interpretation given to Article 8 of the Convention.37
