CS406: Information Security

In this section we will discuss one of the most crucial legal rights of this book. The right to privacy that is articulated in art. 8 ECHR is not only relevant for bodily integrity, decisional privacy, and the other aspects of privacy, but also directly affects issues of cybercrime and copyright. This is due to the fact that cybercrimes may violate privacy (hacking, data breaches), or that copyright holders may violate privacy when disseminating their works (photographs, texts) but also because the investigative measures that aim to detect cybercrime and violations of copyright often infringe upon the right to privacy as protected in art. 8.

Here, we develop a first analysis of the legal conditions it stipulates, how they are explained by the ECtHR and the legal effects it generates.

Art. 8 consists of 2 paragraphs. The first paragraph concerns the question of whether privacy is infringed, the second paragraph clarifies under what conditions an infringement is justified.

The legal effect generated by this paragraph is "an infringement of privacy", and this infringement depends on the following alternative legal conditions:

1. Private life is not respected
2. Family life is not respected
3. The protection of one’s home is not respected
4. The confidentiality of one’s correspondence is not respected

The ECtHR takes the view that these concepts require a broad rather than a narrow interpretation, bringing a wide variety of situations, events, relationships and contexts under the protection of art. 8.

Private life can be at stake in the context of work, meaning that a search of an office space may be an infringement of privacy. Family life is at stake when a state prohibits members of a family to live together, for instance in the case a refusal to provide a residence permit for a partner from another state, or of a parent wishing to further develop a relationship with their child despite not being married to the other parent. Protection of the home may become relevant when a person has taken residence in a house they neither own nor rent, meaning that the need to respect one’s home is not dependent upon ownership or contract. The confidentiality of communication has been interpreted to include letters, telephone and more recently all types of internet-enabled communication that is not public. Privacy, as protected by art. 8, clearly concerns physical, spatial, contextual, decisional, communicative and informational privacy, and though art. 8 addresses the contracting states, its indirect horizontal effect has been recognised by the ECtHR, requiring states to ensure proper protection against violations by others than the state. Note that the individual complaint right of the ECHR can only be invoked against a state, not against a company. To invoke direct horizontal effect, a person needs to sue the tortfeasor in a national court.

Once the legal effect of an infringement has been established by the ECtHR, it will investigate whether the state has a valid justification.

The legal effect of a valid justification is that, despite the infringement, art. 8 is not violated. This effect depends on the following cumulative legal conditions:

1. The infringement has one of more of the following legitimate aims: national security, public safety or the economic well being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others;
2. The infringement is in accordance with the law
3. The infringement is necessary in a democratic society.

The second paragraph of art. 8 requires a triple test, meaning that all three legal conditions must be met. These conditions can be formulated as follows, taking into account relevant case law. Any infringing measures taken by the state must:

1. have a legitimate aim
2. have a basis in law and
3. be proportional in relation to the aim served.

The articulation of legitimate aims in art. 8.2 is rather inclusive, which means that the ECtHR seldom finds reason to endorse the claim that the state lacked a legitimate aim.

Many of the cases where ECtHR (the Court) finds that art. 8 has been violated concern the condition that the infringement must be "in accordance with the law". This basically refers to the legality principle of constitutional law (3.3). The Court has - over the course of the years - developed 3 criteria to decide whether an infringement has a proper basis in law. The legal competence to take infringing measures must:

1. be accessible, knowable for citizens to whom it will apply
2. the infringements must be foreseeable, which means sufficiently specified
3. the quality of the law must include sufficient safeguards that limit the exercise of the competence in time and space, specifying the extent to which privacy may be infringed, and notably requiring independent oversight (e.g. warrants) in the case of more serious infringements

Note that the Court will not merely check legislative or regulatory provisions, but test practical arrangements and actual safeguards to establish whether the infringing measures were taken "in accordance with the law". Throughout its case law, the ECtHR demands that the rights attributed in the ECHR are both "practical and effective", stating that:

If privacy is infringed with a legitimate aim, based on a legal competence that is accessible, foreseeable, while having sufficient safeguards, the final test is a proportionality test. This entails that the ECtHR investigates whether the measure was necessary in a democratic society, which requires - according to the Court - a pressing social need to resort to such measures. Under this criterion the Court will examine the gravity, invasiveness and seriousness of the infringement in relation to the importance and seriousness of the aim served. This criterion basically requires that the measures taken can reasonably be expected to be effective, because a measure that is not effective cannot be necessary. The proportionality test includes a subsidiarity test; if another measure which is less infringing is feasible or sufficiently effective, the measure is not proportional.