MINISTERS’ DEPUTIES

Notes on the Agenda

CM/Notes/1514/H46-32

5 December 2024

1514th meeting, 3-5 December 2024 (DH) Human rights   H46-32 Bucur and Toma v. Romania (Application No. 40238/02) Supervision of the execution of the European Court’s judgments Reference documents DH-DD(2024)974, H/Exec(2024)16, CM/Del/Dec(2024)1507/H46-24

 

Application	Case	Judgment of	Final on	Indicator for the classification
40238/02	BUCUR AND TOMA	08/01/2013	08/04/2013	Complex problem

Case description

This case concerns the disclosure by the first applicant, a military officer in the Romanian Intelligence Service, of information on wide-scale illegal telephone tapping on the part of the intelligence service and of the content of some of the communications thus intercepted, including telephone conversations recorded at the home of the other two applicants. These disclosures during a press conference in 1996 resulted in the first applicant’s conviction, in last instance by the Supreme Court of Justice in May 2002, to a suspended prison term.

The European Court found violations of Articles 8 and 13 because of the lack of safeguards in the legislation on secret surveillance measures based on national security considerations, in particular as regards the collecting and storing of personal data by the Romanian Intelligence Service, and the absence of domestic remedies allowing challenges to the retention of such data by the same. It also found violations of Articles 6 and 10 in relation to the criminal trial and conviction of the first applicant and a failure to comply with Article 38 due to the authorities’ refusal to provide the Court with the full criminal investigation file, without a satisfactory explanation.

Status of execution

The remaining questions under the Committee of Ministers’ supervision concern the general measures necessary to guarantee non-repetition of the violations of Article 8 and 13.^[1]

1) Previous examinations by the Committee of Ministers 

The Execution Department’s analysis prepared for the examination of the case in September 2023[2] showed that the relevant legislative framework still failed to provide the minimum safeguards that should be set out in law to avoid abuses of power. Indeed, it did not (i) define the categories of persons who may be subject to targeted secret surveillance measures based on national security considerations;

(ii) ensure that personal data collected through such surveillance is stored only if and as long as necessary, in a democratic society, to achieve the legitimate aim pursued and destroyed if this is not or no longer the case; (iii) introduce independent and effective supervision of the implementation of such measures; and (iv) provide for effective remedies to individuals who consider themselves wronged by the same (see H/Exec(2023)9).

The Department also outlined concerns in relation to amendments to the Code of Criminal Procedure enacted by Parliament in July 2023[3] to reactivate the possibility to use material obtained through secret surveillance measures, based on national security considerations, as evidence in criminal proceedings (this possibility had been excluded under a 2020 ruling of the Constitutional Court, which had found it unattended by the required safeguards).^[4] While these amendments introduced an ex post facto judicial review of the legality of such measures in criminal proceedings,[5] they did not rectify the deficiencies in the national security legislation related to the categories of persons concerned, the retention periods for the intercepted data, the circumstances and the conditions for destroying it and the procedure to be followed (for details, see H/Exec(2023)9, Section VII).

Against this background, the Committee urged the authorities to submit information on the concrete steps taken to implement the required safeguards no later than 15 December 2023 and instructed the Secretariat, in the absence of information attesting tangible progress, to prepare a draft interim resolution for consideration at the relevant meeting (CM/Del/Dec(2023)1475/H46-27).

On 28 August 2024, the authorities provided information on a legislative proposal initiated by members of Parliament on 27 May 2024, aimed at reinforcing the safeguards surrounding the collection and retention of data within the framework of activities related to national security (DH-DD(2024)974).[6]

Given the late submission of this information for the last examination of this case, in September 2024 (1507^th meeting (DH)), it was not possible to assess it then. The Committee therefore decided to resume consideration of this case at the present meeting, in the light of a detailed analysis of the information on the draft legislation to be prepared by the Secretariat.

The Committee also invited the authorities to keep it informed of the progress in the legislative process and of any other development and strongly encouraged them to make full use of the expertise available from the Council of Europe and to co-operate closely with the Secretariat in this process, including in order to identify good practices developed and implemented by other member States to ensure Convention-compliant secret surveillance systems, notably as regards review arrangements.

2) Draft legislative amendments to the national security legislation

In their August 2024 submission, the authorities presented the detailed provisions of the draft legislation amending Law No. 51/1991 on national security (the “National Security Act”) in order to implement European data protection rules[7] and case-law and to execute the Court’s relevant judgments,[8] by securing the individual right to privacy in the course of secret surveillance and intelligence-gathering operations.

The proposed amendments introduce additional safeguards in relation to the collection and storage of personal data in the context of secret surveillance based on national security considerations. They impose specific obligations on State authorities responsible for national security, including the Romanian Intelligence Service, namely (a) to process personal data fairly and lawfully; (b) to collect such data only for national security purposes; (c) to preserve the integrity, confidentiality and accuracy of the data they hold; (d) to verify in their own filing systems at certain intervals, but no later than five years after storage, whether that data should be retained, rectified, erased or destroyed;

(e) to ensure that the transmission, communication or transfer of personal data is permitted only for the purposes referred to in the law or for the performance of a lawful task of a law enforcement authority or body or other public authorities, provided that the data are processed in connection with that purpose and for no longer than is necessary; and (f) to erase or destroy the data, regardless of the form of storage, when they establish that the data are not linked to “vulnerabilities, risks or threats to Romania’s national security”.

In addition, the legislative proposal establishes new legal remedies for breaches of the above legal obligations, while maintaining parliamentary oversight in respect of the activity of the Romanian Intelligence Service. Thus, a two-stage procedure is set up, first before the joint standing committee of the two Houses of Parliament exercising the supervision of that activity (the “joint parliamentary committee”) and then before a court of law. Based on the draft provisions, any person who, in relation to a specific situation, considers that his or her rights or legitimate interests have been breached may lodge a written and reasoned complaint with the joint parliamentary committee, which will request the point of view of the intelligence service, to be provided within 30 days from the date of receipt of the request. The answer shall not contain data and information relating to operations or operational activities in progress or to be carried out, to sources of information or to specific methods and means, as well as to information that could lead to the real capacity of operative staff being revealed. If the joint parliamentary committee rules the complaint well-founded, it shall forward that complaint to the competent bodies. If not, it shall reject the complaint within 15 days from the date of receipt of the answer of the intelligence service in a report and shall inform the person who lodged that complaint that his or her right or legitimate interest has not been affected. If the person concerned is not satisfied with the decision of the joint parliamentary committee, he or she may ask for judicial review in accordance with the administrative litigation procedure (for full details, see H/Exec(2024)16).

The government also indicated that on 27 June 2024, the Supreme Defence Council endorsed the legislative proposal, underlining the importance of harmonising the domestic legal framework for the protection of personal data with the requirements of the European Court’s case-law and the recommendations of the Committee of Ministers, while also offering suggestions for improving the clarity of the proposal’s text.

In their submission, the authorities further specified that the legislative proposal put forward by MPs and adopted by the Chamber of Deputies in November 2020,[9] which sought to reactivate the possibility to use material obtained through such surveillance as evidence in criminal proceedings, is still pending for adoption by the Senate (for details, see DH-DD(2024)974).[10]

Analysis of the Secretariat

The detailed analysis of the legislative proposal of 27 May 2024 is set out in document H/Exec(2024)16. The main conclusions of this analysis are presented below.

As already noted by the Committee of Ministers, it is positive that a draft legislation was submitted to the Romanian Parliament in order to adopt the necessary measures to bring the national security legislation on collection and retention of personal data in line with the relevant Convention requirements.

It is likewise positive that, through the legislative amendments proposed, the authorities envisage to embed in the domestic legal framework data protection principles such as lawfulness, fairness, purpose limitation, accuracy, storage limitation and data minimisation, which correspond to minimum safeguards under the Convention and the Court’s relevant case-law, and to establish an ex post facto judicial review of secret surveillance by the Romanian Intelligence Service. These developments can be noted with interest and confirm that an interim resolution is not necessary.

At the same time, the analysis of the draft legislation has revealed areas of concern and uncertainty in relation to (1) the categories of persons who may be subject to secret surveillance measures based on national security considerations; (2) the duration of the storage of such data and the circumstances in which they can be erased or destroyed and the procedure to be followed, including when the data are intended for use as evidence in criminal proceedings; (3) the existence of independent and effective supervision of the implementation of secret surveillance measures, including while in force;

and (4) the legal remedies available in practice for those who consider themselves affected by secret surveillance and the effectiveness of the ex post facto judicial review of those measures, in particular the competent court’s power to order the destruction of surveillance material (see H/Exec(2024)16).

In the light of the foregoing, the Committee might wish to call on the authorities to take all necessary steps to ensure that the measures adopted in the framework of the ongoing reform efforts will lead to a domestic legislation on secret surveillance for national security purposes that fully and effectively complies with the requirements of Articles 8 and 13 resulting from the Court’s relevant case-law and invite them to provide clarifications on the outstanding issues identified in document H/Exec(2024)16.

The Committee could moreover strongly encourage again the authorities to make full use of the expertise available through the Council of Europe and request the opinion of the Venice Commission on the draft legislation currently under examination by Parliament and any subsequent amendments thereto. The authorities could be also encouraged to co-operate closely with the Secretariat in the ongoing legislative process, including in order to identify good practices developed and implemented by other member States to ensure Convention-compliant secret surveillance systems, notably as regards oversight and review arrangements.

Finally, the authorities could be invited to submit updated information on the progress of this process and on any other development by 30 June 2025 and to keep the Committee regularly informed afterwards. In the light of the information received, the Committee could resume consideration of this case at one of its Human Rights meetings in 2026.

Financing assured: YES