Privacy, surveillance, and the proportionality principle: The need for a method of assessing privacy implications of technologies used for surveillance

Abstract

Developments in technology have created the possibility for law enforcement authorities to use for surveillance purposes devices that are in the hands or private premises of individuals (e.g. smart phones, GPS devices, smart meters, etc.). The extent to which these devices interfere with an individual's private sphere might differ. In the European Union, surveillance measures are considered lawful if they have been issued in conformity with the legal rules and the proportionality principle. Taking a fundamental rights approach, this paper focuses on the information needed for adopting proportionate decisions when authorizing the use for surveillance of devices that are not built for surveillance purposes. Since existing methods of privacy assessment of technologies do not offer the required information, this paper suggests the need for a new method of assessing privacy implications of technologies and devices which combines an assessment of privacy aspects with the different dimensions of surveillance.

Keywords:

• privacy
• surveillance
• proportionality
• law enforcement authorities
• European Union

Notes

1 On the basis of the case law from the European Court of Human Rights, any interference from the State with the rights of the individuals must not exceed the necessary minimum.

2 For earlier works on proportionality see Van Gerven (1999) and Tridimas (1999).

3 In Uzun (§68–69), for example, the European Court of Human Rights considered the use of a GPS device for location tracking in public areas as a less intrusive measure than interception of personal communications.

4 For this study, surveillance with technology not originally built for the purpose of surveillance is understood to be devices that are introduced in the markets for the performance of other activities but that have a potential to be used for surveillance. Some examples of these devices would be: mobile phones, computers, smart electricity meters, GPS devices, etc. These devices offer possibilities for direct surveillance, for gathering personal information, location data, behaviour patternss, etc.

5 According to Taylor (2011) the proportionality principle plays a role in establishing a balance between the nature and the extent of the interference and the reasons for interfering.

6 The proportionality principle is central in the Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, Official Journal L 350, 30/12/2008, see for example Article 3.

7 The proportionality principle is central in the Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, Official Journal L 350, 30/12/2008, see for example Article 3.

8 See Opinion of AG Maduro in Case 524/06 Heinz Huber v. Bundesrepublik Deutschland, para. 16.

9 ‘Collateral intrusion' is defined in the UK in a guiding document to the application of RIPA as interference with the privacy of persons, other than the subject of the surveillance.

10 See for example the newest developments on wireless brain–computer interfaces in Borton (2013).

11 The lack of a common framework does not mean however that sector specific laws dealing with privacy and surveillance have not been adopted. See, for example, the Schengen agreements, creation of Europol and Eurojust, etc.

12 These authors present a detailed analyses of the implementation of Article 20 of the Data Protection Directive.

13 See the proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Brussels, 25.1.2012, COM(2012) 11 final, 2012/0011 (COD) – art. 33, rec. 74.

14 Proposal for a Directive of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the movement of such data, Brussels, 25.1.2012, COM(2012) 10 final, 2012/0010 (COD).

15 See Article 20 of the Data Protection Directive.

16 Please note that, in April 2013, the Article 29 Working Party released an opinion that was very critical and did not approve a PIA framework proposed for smart electricity meters.

17 See: ‘A Report on the Surveillance Society for the information Commissioner’, prepared by the Surveillance Studies Network in September 2006.

18 See comment by the authors themselves in Footnote 4 of Wright and Raab (2012).