On 11 January 2022, the European Court of Human Rights (ECHR) published its judgement regarding the case of Ekimdzhiev and Others v. Bulgaria (No. 70078/12). The proceedings were brought in relation to the legal conditions for wiretapping and surveillance in Bulgaria.
In its judgement ECHR held that Bulgarian legislation lackеd effective safeguards against arbitrariness and abuse of special means of surveillance (SMS) by the authorities, as well as when requesting traffic data from mobile operators.
Essentially, the judgment consists of two separate sections. They contain a thorough analysis of the possibilities for abuse by the authorities when using SMS and when requesting traffic data (i.e. data on incoming and outgoing telephone calls, short text messages, mobile internet sessions, location data, etc.) from mobile operators.
With respect to the use of SMS, the ECHR has found progress compared to its previous analysis made in 2007. However, it finds that the minimum safeguards against arbitrariness and abuse under Article 8 of the European Convention on Human Rights (the Convention) have not yet been achieved. A violation of the Convention has therefore been established since, according to the ECHR, the regulatory framework related to SMS does not meet the requirements necessary in a democratic society.
As regards the access to traffic data, the conclusion is similar – despite the positive progress following the legislative changes based on the CC decisions, the minimum safeguards against abuse have not yet been achieved. The following shortcomings have been identified:
In conclusion, the ECHR finds a lack of necessary safeguards in the event of arbitrariness on the part of the competent state authorities, and therefore a violation of Art. 8 of the Convention.
It is hardly the first time that Bulgarian citizens have been found to have no effective safeguards in case of wiretapping and surveillance. Fifteen years ago, it was an ECHR judgement which found that the Bulgarian Special Surveillance Means Act (SSMA) did not provide for sufficient safeguards against the risk of abuse when using SMS, neither did it provide effective remedies.
Regarding the use of traffic data, the Constitutional Court of Bulgaria (CC) has twice categorically ruled that the Electronic Communications Act (ECA) violates the fundamental rights and freedoms of citizens. In 2015, the Constitutional Court adopted a decision declaring as unconstitutional provisions in the ECA related to the obligation of mobile network operators to retain such data in order to make it available to the competent authorities upon request for certain legal purposes.
In 2020, the CC again ruled on amendments to the ECA that provided a possibility for public authorities in relation to the declared state of emergency. A possibility was introduced for the traffic data from mobile telephones of people placed under quarantine to be retained for a term of 6 months and for the Ministry of the Interior to be able to access such data during this period. Recognised experts in the field, including Prof. Dr. George Dimitrov from DPC, were invited by the CC to give their opinions while examining the case. The CC fully adopted the arguments presented by Prof. Dr. Dimitrov and his team, and declared as unconstitutional the said provisions in its decision of 17 November 2020.
Despite the numerous rulings and legislative developments over time, the ECHR’s latest judgement again clarifies that the state has not yet provided citizens with adequate safeguards.
The judgment reaffirms the need for adequate legislative changes regarding the use and control of SMS, as well as the access to traffic data affecting the secrecy of correspondence and citizens’ right to privacy.
