Published on 29 January 2024
THIRD SECTION
Application no. 37659/22
Athanasios KOUKAKIS
against Greece
lodged on 28 July 2022
communicated on 10 January 2024
SUBJECT MATTER OF THE CASE
The applicant is a financial journalist who has conducted journalistic research in the spheres of banking, business and politics. As he was suspecting that his phone conversations were intercepted by the National Information Service, he submitted on 12 August 2020 a complaint before the Hellenic Authority for Communication Security and Privacy (Αρχή Διασφάλισης του Απορρήτου των Επικοινωνιών, hereinafter “the Authority”) requesting to be informed on whether his phone communications, concerning two mobile numbers and a fixed line, were intercepted.
On 15 April 2022 an article was published in Reporters United alleging that on 1 June 2020 the National Information Service had requested a two‑month lift of confidentiality on the applicant’s mobile phone number and on 13 July 2020 a two-month extension of the measure, relying on reasons of national security. According to the article, on the very date of the submission of the applicant’s complaint, the National Information Service requested to end the measure. The lift, its extension and the end were ordered by a prosecutor seconded to the National Information Service
Article 5 § 9 of Law no. 2225/1994, as in force at that time, provided that after the end of the measure to lift confidentiality, the Authority could inform the persons concerned of the imposed measure provided that its purpose was not thus jeopardised. On 10 March 2021 the Authority asked the seconded prosecutor whether the legal requirements for informing the applicant of the measure have been fulfilled. On 31 March 2021 Article 5 § 9 of Law no. 2225/1994 was amended so that the Authority could inform the persons concerned only in case the measure had been imposed in the context of serious offences, excluding such possibility for measures imposed on national security grounds. This provision was applicable also to measures which had taken place before the publication of the amended provision (Law no. 4790/2021).
On 29 July 2021 the Authority replied to the applicant that there had been no breach of the relevant legislation.
On 28 March 2022 the applicant was informed, following an analysis conducted by the Citizen Lab of Munk School of Global Affairs and Public Policy at the University of Toronto, that his mobile phone had been infected from July to September 2021 by Predator spyware. On 6 April 2022 he submitted a new complaint before the Authority requesting a thorough investigation. The applicant further complained on 4 May 2022 before the National Transparency Authority and, again, on 13 May 2022 before the Authority for Communication Security and Privacy.
On 18 April 2022 the head prosecutor at the Athens Criminal Court of First Instance ordered a preliminary investigation. On 9 June 2022 the applicant lodged a criminal complaint as regards both the interception by the National Information Service and the unlawful installation of the spyware.
Relying on Article 8 the applicant complains that under domestic law it is impossible to be officially notified of the lift of confidentiality imposed for national security reasons which may have an indefinite duration; the manner of surveillance and the surveillance techniques used, the means of communication and categories of data which are concerned by the surveillance are not defined; it is also not clarified what can constitute reasons of national security and the categories of persons liable to be targeted, while there is also no competent authority and procedure provided for the use, storage and erasure of the collected data.
He further complained under Articles 8 and 13 of lack of an effective remedy and of having no right to be informed of the surveillance.
QUESTIONS TO THE PARTIES
1. Has there been a violation of Article 8 of the Convention?
In particular, was the interference with the applicant’s right to respect for his private life and correspondence, as regards the interception of communications and spyware, in accordance with the law? Was the domestic law accessible and foreseeable as required by Article 8 (see among other authorities, Roman Zakharov v. Russia [GC], no. 47143/06, §§ 228-30, ECHR 2015, Ekimdzhiev and Others v. Bulgaria, no. 70078/12, §§ 291-93, 11 January 2022, Kennedy v. the United Kingdom, no. 26839/05, §§ 151-52, 18 May 2010, and Weber and Saravia v. Germany, (dec.). no. 54934/00, §§ 93-95, 10 January 2000, with further references)? Did any such interference pursue a legitimate aim and was it necessary in a democratic society (see for instance Roman Zakharov, cited above, §§ 227, 232, and Kennedy, cited above, §§ 130, 153-54)?
The parties are requested to comment on whether the relevant legal provisions, as applied in practice, ensured compliance with the minimum safeguards flowing from the Court’s case-law (see, among others, Roman Zakharov, cited above, §§ 231-34, and Ekimdzhiev and Others, cited above, §§ 294-358) and address in particular, though not exclusively: the definition of national security; the categories of people subject to the measures; a limit on the duration of the measures including when imposed for reasons of national security; the authorisation and supervision procedure, the independence and effectiveness of the competent body when the surveillance is ordered and of the competent body when the surveillance is carried out; a post-surveillance notification; the definition of the categories of data (content data, metadata etc.), the means of communication which are concerned, the surveillance techniques which are used and the safeguards for the examination, use, storage, onward transmission, and destruction of the relevant data.
2. Did the applicant have at his disposal an effective domestic remedy with respect to the alleged breaches of his rights under Article 8 of the Convention detailed above, as required by Article 13 of the Convention (compare with Ekimdzhiev and Others, cited above, §§ 352-55)?