![Sample our Law journals, sign in here to start your FREE access for 14 days]({"type":"image" , "src" : "/sda/5942/TOC-Subject-Sample-2021-Law.jpg"})
ABSTRACT
Supporters of increased surveillance see tremendous potential in the ever increasing creation, collection, and retention of personal data. Most acknowledge that the massive collection of information also creates challenges where the collection outpaces the ability to meaningfully process the data. Increased processing power and more finely tuned algorithms are often portrayed as the solution to this haystack conundrum. While a human may struggle to find the needle in an overflowing haystack of disordered information, powerful computers can take a logical and structured approach that will make the haystack eminently more searchable. This article evaluates this premise from a human rights perspective and considers whether algorithmic surveillance systems can be designed to be compatible with the right to privacy. In addition to assessing the incongruity between traditional safeguards (such as foreseeability and accountability) with algorithmic surveillance, this article also confronts the problem of initial collection and addresses the contention that well-defined algorithmic search can effectively limit the intrusiveness of surveillance. Evolution in the case law of the European Court of Human Rights and the Court of Justice of the European Union will be factored into this analysis.
KEYWORDS:
Disclosure statement
No potential conflict of interest was reported by the author.
Notes
1 Roman Zakharov v Russia [2015] ECHR 1065; Szabó and Vissy v Hungary [2016] App 37138/14; Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others [2014] WLR (D) 164.
2 United States v Sokolow 490 US 1, 9 (1989) as discussed in Rich (Citation2015–Citation2016, 902–903).
3 United States v Sokolow 490 US 1, 9 (1989) as discussed in Rich (Citation2015–Citation2016, 902–903).
4 The author does not discount the targeted nature of some post hoc information requests that are common in many data retention regimes. Of course, such systems only consider the existence of individualised suspicion at the point of access and not at the point of collection and retention.
5 Article 8 of the Convention states:
1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.
6 Peck v The United Kingdom (2003) 36 EHRR 41, 57; Niemietz v Germany (1992) 16 EHRR 97, 29; Pretty v The United Kingdom [2002] ECHR 427, 61; PG and JH v The United Kingdom [2001] ECHR 550, 56.
7 Silver v The United Kingdom [1983] ECHR 5, 86; Malone v The United Kingdom [1984] ECHR 10, 67.
8 Silver v The United Kingdom [1983] ECHR 5, 87.
9 Silver v The United Kingdom [1983] ECHR 5, 88. See also, Klass v Germany (1979–1980) 2 EHRR 214, 55.
10 Weber and Saravia v Germany [2006] ECHR 1173, 93; Leander v Sweden (1987) 9 EHRR 433, 51.
11 Weber and Saravia v Germany [2006] ECHR 1173, 93; Malone v The United Kingdom [1984] ECHR 10, 67; Huvig v France (1990) 12 EHRR 528, 29; Rotaru v Romania [2000] ECHR 192, 55; Kopp v Switzerland (1998) 27 EHHR 93, 64, 72; Valenzuela Contreras v Spain (1999) 28 EHRR 483, 46.
12 Weber and Saravia v Germany [2006] ECHR 1173, 94–95.
13 Huvig v France (1990) 12 EHRR 528, 30.
14 Szabó and Vissy v Hungary [2016] App 37138/14, 56; Weber and Saravia v Germany [2006] ECHR 1173, 95; Valenzuela Contreras v Spain (1999) 28 EHRR 483, 46 Huvig v France (1990) 12 EHRR 528, 46.
15 Weber and Saravia v Germany [2006] ECHR 1173; Liberty v The United Kingdom [2008] ECHR 568, 65.
16 Weber and Saravia v Germany [2006] ECHR 1173; See also, Liberty v The United Kingdom [2008] ECHR 568, 65; Roman Zakharov v Russia [2015] ECHR 1065 and Szabó and Vissy v Hungary [2016] App 37138/14.
17 See, for example, Liberty v The United Kingdom [2008] ECHR 568, 63; Roman Zakharov v Russia [2015] ECHR 1065, 229; Szabó and Vissy v Hungary [2016] App 37138/14, 57.
18 Weber and Saravia v Germany [2006] ECHR 1173, 4.
19 Weber and Saravia v Germany [2006] ECHR 1173, 4.
20 Weber and Saravia v Germany [2006] ECHR 1173, 101.
21 Szabó and Vissy v Hungary [2016] App 37138/14, 56; Weber and Saravia, 95; Valenzuela Contreras v Spain (1999) 28 EHRR 483, 46; Huvig v France (1990) 12 EHRR 528, 46.
22 Weber and Saravia v Germany [2006] ECHR 1173, 97. While this could potentially be a very large category of people, it is important to note that at the relevant time, wireless communications constituted just 10% of all telecommunications. Weber and Saravia v Germany [2006] ECHR 1173, 110.
23 Weber and Saravia v Germany [2006] ECHR 1173, 97.
24 Weber and Saravia v Germany [2006] ECHR 1173, 32.
25 Weber and Saravia v Germany [2006] ECHR 1173, 32.
26 Liberty v The United Kingdom [2008] ECHR 568, 68–69. A focus on remediating safeguards appeared to gain support in the recent Opinion of AG Saugmandsgaard Øe in Joined Cases C-203/15 and C-698/15 Tele2 Sverige AB v Post- och telestyrelsen and Secretary of State for the Home Department v Tom Watson and Others Opinion of AG Saugmandsgaard Øe, 226, 259.
27 Many of the same issues arise when surveillance data are collected via CCTV and subsequently algorithmically processed as when communications data are subject to such algorithmic processing.
28 In his article, Michael Rich considers whether ‘Automated Suspicion Algorithms’ can meet the US constitutional law standards of probable cause and reasonable suspicion (2015–2016, 877); Brinegar v United States 338 US 16o, 175 (1949).
29 It has been established that from the Article 8 requirement that privacy intrusive measures be ‘in accordance with the law’ ‘stems the need for the law to be accessible to the person concerned, who must moreover be able to foresee its consequences for him’. Ekimdzhiev v Bulgaria [2007] ECHR 533, 71; Huvig v France (1990) 12 EHRR 528, 26; Kruslin v France (1990) 12 EHRR 547, 27; Malone v The United Kingdom [1984] ECHR 10. In addition to requiring that the law be accessible and foreseeable, the law must also be compatible with the rule of law generally. In the case of serious privacy interferences, such as telephone tapping, the ECtHR has stated the requirement that ‘minimum safeguards’ should be set out in statute in order to avoid abuses of power. Huvig v France (1990) 12 EHRR 528, 34; Kruslin v France (1990) 12 EHRR 547, 35; Valenzuela Contreras v Spain (1999) 28 EHRR 483, 46.
30 According to the ECtHR ‘“necessary” … implies the existence of a “pressing social need” for the interference in question and the interference must be proportionate to the legitimate aim pursued’. Dudgeon v The United Kingdom [1981] ECHR 5, 51; Silver v The United Kingdom [1983] ECHR 5, 97; Handyside v The United Kingdom [1976] ECHR 5, 48–49.
31 In the CJEU context, proportionality requires actions to be ‘appropriate for attaining the legitimate objectives pursued’ and not excessive to what is ‘appropriate and necessary in order to achieve those objectives’. Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others [2014] WLR (D) 164, 46.
32 There is support, however, for the argument that bulk interception can play a valuable, if not proportionate, role in the protection of national security (Anderson Citation2015, 130).
33 Roman Zakharov v Russia [2015] ECHR 1065, 232; Kennedy v The United Kingdom [2010] ECHR 682, 153; Malone v The United Kingdom [1984] ECHR 10; Leander v Sweden (1987) 9 EHRR 433, 60; Iordachi v Moldova [2009] ECHR 256, 53.
34 Klass v Germany (1979–1980) 2 EHRR 214, 50; Roman Zakharov v Russia [2015] ECHR 1065, 232; Weber and Saravia v Germany [2006] ECHR 1173, 106.
35 Roman Zakharov v Russia [2015] ECHR 1065, 233.
36 Citron has highlighted the challenges of algorithmic accountability with particular focus on the difficulty of applying a traditional ‘due process’ model to algorithmic decisions. Recognising these challenges, Citron endorses a new model of ‘technological due process’ which does not rely on traditional due process and proposes to require a battery of mechanisms ‘capable of enhancing the transparency, accountability, and accuracy of rules embedded in automated decision-making systems’.
37 Szabó and Vissy v Hungary [2016] App 37138/14, 86. See also, Roman Zakharov v Russia [2015] ECHR 1065, 300.
38 Roman Zakharov v Russia [2015] ECHR 1065, 234.
39 The ECtHR has interpreted ‘private life’ broadly, recognising the simple storing of data relating to the private life of an individual falls within the scope of Article 8. Lundvall v Sweden [1985] App 10473/83, 3; Leander v Sweden (1987) 9 EHRR 433, 48; Amann v Switzerland (2000) 30 EHRR 843, 65.
40 Telephone metering information was considered in Malone v UK and location data were considered in Uzun v Germany. Malone v The United Kingdom [1984] ECHR 10, 84; Uzun v Germany [2010] App 35623/05, 52. At the same time, it is important to note that in both cases the ECtHR did note that an interference with privacy – even if on the lower level of seriousness – had occurred. Due to the lack of accessible legislation governing the access to metering information, the UK was found in violation on this point.
41 As pointed out by AG Saugmandsgaard Øe, metadata can be used to ‘facilitate the almost instantaneous cataloguing of entire populations, something which the content of communications does not’. Joined Cases C-203/15 and C-698/15 Tele2 Sverige AB v Post- och telestyrelsen and Secretary of State for the Home Department v Tom Watson and Others Opinion of AG Saugmandsgaard Øe, 259.
42 Reference for a preliminary ruling from High Court of Ireland made on 11 June 2012. See Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources, Minister for Justice, Equality and Law Reform, The Commissioner of the Garda Síochána, Ireland and the Attorney [2012] O.J. C258/11; Request for a preliminary ruling from the Verfassungsgerichtshof (Austria) lodged on 19 December 2012 — Kärntner Landesregierung and Others [2013] O.J. C79/7.
43 Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the Retention of Data Generated or Processed in Connection with the Provision of Publicly Available Electronic Communications Services or of Public Communications Networks and Amending Directive 2002/58/EC [2006] O.J. L-105/54. The Directive frequently asserted that the ‘content’ of communications cannot be retained under the authority of the Directive. See art. 1(2), art. 5(2), and Recital 13 of the Directive.
44 Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others [2014] WLR (D) 164, 27. While the CJEU did find the retention of information under the Directive to constitute a ‘particularly serious interference’ with privacy and personal data rights, the CJEU also held that the Directive did not violate ‘the essence’ of those rights. The Court justified this distinction by recognising that the Directive did not permit the retention of content data and the Directive required respect for ‘certain principles of data protection’. Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others [2014] WLR (D) 164, 39–40.
45 Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others [2014] WLR (D) 164, 29–30, 57.
46 Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others [2014] WLR (D) 164, 29–30, 59.
47 Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others [2014] WLR (D) 164, 29–30, 49–50.
48 Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others [2014] WLR (D) 164, 29–30, 51–52.
49 Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others [2014] WLR (D) 164, 29–30, 54 citing, Liberty v The United Kingdom [2008] ECHR 568, 62–63; Rotaru v Romania [2000] ECHR 192, 57–59; and S and Marper v the United Kingdom [2008] ECHR 1581, 99. According to the Court, there is an increased requirement for safeguards where the retained data are subject to automatic processing and there is a significant risk of unlawful access. Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others [2014] WLR (D) 164, 29–30, 55.
50 Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others [2014] WLR (D) 164, 29–30, 59.
51 Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others [2014] WLR (D) 164, 29–30, 65.
52 Joined Cases C-203/15 and C-698/15 Tele2 Sverige AB v Post- och telestyrelsen and Secretary of State for the Home Department v Tom Watson and Others Opinion of AG Saugmandsgaard Øe, 192–195.
53 It should be noted that Advocate General Saugmandsgaard Øe recently stated that ‘it is not possible to interpret the provisions of the Charter differently depending on whether the regime under consideration was established at EU level or at national level’. Joined Cases C-203/15 and C-698/15 Tele2 Sverige AB v Post- och telestyrelsen and Secretary of State for the Home Department v Tom Watson and Others Opinion of AG Saugmandsgaard Øe, 191. Of course, if the UK continues on its current course to leave the EU, the importance of the Convention system will increase further (so long as the UK remains a Party to the ECHR).
54 Roman Zakharov v Russia [2015] ECHR 1065, 264; Klass v Germany (1979–1980) 2 EHRR 214, 51; Liberty v The United Kingdom [2008] ECHR 568, 64–65; Ekimdzhiev v Bulgaria [2007] ECHR 533, 80; and Kennedy v The United Kingdom [2010] ECHR 682, 160.
55 Roman Zakharov v Russia [2015] ECHR 1065, 260–264.
56 Szabó and Vissy v Hungary [2016] App 37138/14, 171. Roman Zakharov v Russia [2015] ECHR 1065, 259 and 261.
57 Szabó and Vissy v Hungary [2016] App 37138/14, 68.
58 Szabó and Vissy v Hungary [2016] App 37138/14, 68–70.
59 Szabó and Vissy v Hungary [2016] App 37138/14, 68–70.
60 Liberty v The United Kingdom [2008] ECHR 568, 63.
61 In fact, Wells decries the haystack analogy altogether (2016).
62 Joined Cases C-293/12 and C-594/12 Digital Rights Ireland and Seitlinger and Others [2014] WLR (D) 164, 49, 55; S and Marper v the United Kingdom [2008] ECHR 1581, 103; Szabó and Vissy v Hungary [2016] App 37138/14, 56; Weber and Saravia v Germany [2006] ECHR 1173, 68–70.
63 See also, the preamble to the ECHR, which states that ‘[f]undamental freedoms … are best maintained on the one hand by an effective political democracy and on the other by a common understanding and observance of the human rights upon which they depend’.