This report contains information on laws regulating the collection of intelligence in the European Union, United Kingdom, France, Netherlands, Portugal, Romania, and Sweden. The report details how EU Members States control activities of their intelligence agencies and what restrictions are imposed on information collection. All EU Member States follow EU legislation on personal data protection, which is a part of the common European Union responsibility.
An updated version of this report is available.
Electronic intelligence falls within the domain of the Member States of the European Union (EU), who have sole responsibility for safeguarding their internal security. Electronic surveillance conducted by national law enforcement authorities is inherently linked to the right to privacy and personal data protection. Such rights are enshrined in European Union treaties and secondary legislation as well as in Conventions adopted by the Council of Europe and in the International Covenant on Civil and Political Rights, which binds EU Members.
Foreign intelligence gathering in the United Kingdom is regulated by the Intelligence Services Act, the Human Rights Act, and the Regulation of Investigatory Powers Act. These Acts provide for a system of warrants to be obtained to conduct surveillance and intercept communications, provided the surveillance is necessary to complete the statutory functions of the relevant agency. Issuing warrants in the UK remains an executive, rather than judicial, act. UK intelligence agencies are subject to parliamentary oversight.
While a number of intelligence agencies operate in France, large-scale communications interception is carried out primarily by the Directorate General on Exterior Security under the Ministry of Defense, and the metadata collected is shared within the French intelligence network. All of the existing intelligence agencies were created by executive action and are regulated primarily by decrees, executive decisions, circulars, and instructions that are classified.
Foreign intelligence gathering in the Netherlands is regulated chiefly by the Intelligence and Security Services Act 2002. The Act governs both the General Intelligence and Security Service and the Military Intelligence and Security Service, and requires that these Services obtain ministerial permission to exercise most of their powers, such as the power to institute surveillance and wiretaps and use intelligence agents.
Constitutional principles guarantee the protection of personal data in Portugal, including its collection and use, as well as the privacy of a person’s home and communications. An information system composed of intelligence services and supervisory bodies is in charge of producing intelligence for the purpose of defending national interests. European Union Directives have been transposed into the country’s domestic legal system to regulate the protection of personal data, and privacy in the telecommunications and electronic communications sectors.
Intelligence gathering in Romania is divided among several government agencies as provided in national security legislation. Constitutional principles guarantee the protection of privacy and personal data. Surveillance and intelligence gathering is conducted in accordance with national criminal procedural legislation, and all agencies involved in intelligence collection are subject to the same procedures. Control over intelligence activities by government agencies is conducted by the Parliament and through the judicial review of warrants for data collection issued by the prosecutorial offices; the latter form of control, however, appears to be inefficient because of weakness in the judiciary.
Signal surveillance is regulated by Swedish law. Only the National Defense Radio Establishment may carry out surveillance and only on cross-border communication. Information may be requested by the government, the military, and the police. Sweden’s surveillance legislation has received widespread criticism, including from the European Parliament, on the grounds that it fails adequately to protect privacy and may violate the European Convention on Human Rights. Specific privacy protection regulations that pertain to surveillance information are in place.