Nuestro Mundo no esta en Venta: State surveillance and data collection: basic principles

In theory – and, in particular, in liberal democratic political and legal theory – any measure through which the authorities are empowered to collect information on individuals must meet a number of basic principles.

First of all, those measures should be governed by the law – yet many surveillance or data collection measures are put in place despite being illegal. In the latter category are examples such as the mass surveillance of telecommunications traffic conducted by the UK’s signals intelligence agency, Government Communications Headquarters (GCHQ);¹ the creation of a file known as the ‘Gangs Matrix’ by the Metropolitan Police, found to be racist by a regulatory body;² the French police’s use of facial recognition software;³ or the Russian authorities’ use of facial recognition software to track down peaceful protesters.⁴

It is noteworthy that in each of these cases, new surveillance and data-gathering measures were introduced in secret. Meaningful, public, democratic debate about the measures; evaluations of how they operate, their effectiveness and whether they meet their objectives; and mechanisms of independent oversight and control (for example, authorisation by courts and review by supervisory bodies) may all help to avoid the introduction of invasive, abuse and illegal practices, and to ensure that surveillance powers are kept under control.

However, new surveillance or data collection measures should not be introduced simply because governments decide to do so. Within the type of human rights framework set out in international law, the authorities have to demonstrate that those measures are necessary – as, undoubtedly, some of them are. Few people would argue that it is illegitimate for there to be video surveillance installed around critical infrastructure such as power stations, for example.

In Europe, there is substantial jurisprudence on this question in both national courts, as well as supranational tribunals such as the Court of Justice of the European Union and the European Court of Human Rights. As explained by the European Data Protection Supervisor, the EU’s independent data protection authority:

“Necessity shall be justified on the basis of objective evidence and is the first step before assessing the proportionality of the limitation. Necessity is also fundamental when assessing the lawfulness of the processing of personal data. The processing operations, the categories of data processed and the duration the data are kept shall be necessary for the purpose of the processing.”⁵

Of course, governments frequently claim that a measure is necessary without providing any meaningful evidence that this is the case. Once again, it is vital that the public, experts, and civil society organisations are able to intervene in debates on these issues in order to demand genuine demonstrations of and evidence for the necessity of a particular measure.

If a measure can be classified as necessary, the authorities should also demonstrate that it is proportionate. Put another way, they must demonstrate that the limitations they wish to impose on any particular right are justified. To quote the European Data Protection Supervisor again:

“…proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right… Safeguards accompanying a measure can support the justification of a measure. A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.”⁶

This framework – of legality, necessity and proportionality – clearly has advantages over systems in which the authorities simply do as they wish, with no meaningful oversight, control or restrictions on their activities. However, it also has limits. For example, it makes it possible to argue that in a world where so much data is available, it is necessary and proportionate for authorities to have access to it for security purposes. This leaves little room for principled political or moral disagreements with surveillance and data collection measures.