National security and the processing of personal data

On 10 October 2018, ‘Convention 108’ of the Council of Europe regarding the ‘automatic processing of personal data’ (1985) was updated. Convention 108+ now explicitly incorporates the processing of personal data in a national securitycontext. The Netherlands signed Convention 108+ on 10 October 2018 and is now in the ratification process.

Surprisingly, Convention 108+ did not gain much attention yet. For the Netherlands, the treaty may bring changes to current legislation, because it provides more stringent regulations for the processing of data in a national security context and possibly provides for broader powers for oversight authorities.

Processing data in a national security context within the EU
Convention 108+ contains basic principles and provisions for processing personal data, as well as standards regarding oversight mechanisms and the international transfer of data. Many provisions are similar to the General Data Protection Regulation (GDPR).

However, the GDPR does not apply to national security and intelligence agencies. The European Union (EU) has no competence to regulate national security law for EU Member States. As a result, regulations for processing data in a national security context differ across the EU.

Convention 108+ may bring more harmonisation of the regulations for processing personal data and oversight mechanisms. The treaty enters into force on 11 October 2023 if there are 38 Parties to the Protocol amending Convention 108. So far, 36 States have signed the new Convention but only six have ratified.

Stricter regulations for processing data
Convention 108+ encompasses many basic principles of data processing, such as the principle of processing data (a) for specified and legitimate purposes; (b) adequate, relevant and not excessive in relation to the purposes for which they are stored; (c) accurate and, where necessary, kept up to date; and (d) no longer stored than necessary (see article 5 of Convention 108+). In addition, categories of sensitive data are identified (and updated in the new protocol) and data subjects gain certain rights (such as the right to be informed and the right to request rectification when informed).

In a national security context (similar to a law enforcement context) some principles do not apply or apply differently, such as the right to be informed of data processing and limitations to the notification principle. It is understandable, that some limitations to the notification principle apply. For instance, when so-called ‘targets’ (in a national security context) or ‘suspects’ (in a law enforcement context) are informed about the processing of their data, they know they are of interest to these national authorities and may then change their behaviour to continue their harmful activities without being detected.

The updated Convention 108+ strengthens the data processing regulations in a national security context. For example, the new Convention does not differentiate levels of protection afforded to a State’s own citizens or foreigners with regard to transborder flows of personal data (adjusted in article 14 of Convention 108+). Some States do apply this differentiation in their national security legislation. In addition, compared to Dutch legislation for national security and intelligence services, the Convention entails a broader definition of ‘sensitive data’, for which stricter regulations apply to process this type of data.

Oversight powers
Convention 108+ may bolster supervision of data processing activities in a national security context. Some oversight bodies for national security and intelligence agencies have access to data located at these agencies and some can even halt unlawful data processing activities. Convention 108+ demands that oversight bodies for data processing activities are independent (similar to the judiciary or a judicial body) and effective. Based on article 15 and 16 of the Convention, to be effective an oversight body must have the power to intervene, such as the possibility to halt data processing activities or even order that unlawfully processed data be deleted.

The new Convention allows for limitations to these far reaching powers in the field of national security and defense, provided that it is done ‘by law and only to the extent that it constitutes a necessary and proportionate measure in a democratic society to fulfill such an aim’. Granting oversight bodies such far reaching powers is a big step, because the fear of States may be that their security and intelligence services will no longer have pieces of information that may be relevant in the future to secure national security (for example to prevent a terrorist attack). However, from the perspective of protecting human rights, it can be argued that this step is part of the requirement of effective review and supervision of intelligence and security services, as interpreted in the jurisprudence of the European Court of Human Rights (ECHR) and pursued by the new Convention 108+.

Now what?
What does this mean for processing personal data for the purpose of national security? For the Netherlands, it means the provisions of Convention 108+ must be implemented in national law. This requires some changes, for example with regard to the aforementioned category of ‘sensitive data’. In addition, the Dutch oversight body for intelligence and security services does not have the binding power to intervene in unlawful data processing activities. The Dutch government must address this issue and decide which changes to law are desirable.

We welcome Convention 108+ because it brings more harmonisation to the regulations for processing data in a national security context and may strengthen oversight bodies for national security and intelligence agencies for States that ratify Convention 108+. It protects the individuals involved in the processing of personal data and provides more legal certainty with regard to the applicable rights and regulations. We look forward to contributing and monitoring the implementation of the treaty throughout the world.

Jan-Jaap Oerlemans & Mireille Hagens

This is cross post from the Montaigne Centre Blog.

Oversight of hacking power and take down order

Posted on 12/10/2017 op Oerlemansblog

The Computer Crime Act III is now under consideration for approval by the Dutch Senate. The act extends the criminalisation of certain behaviour, such as grooming of persons that appear to be 18 year old and younger, the unauthorised gathering of non-public data and offering that stolen data online. Perhaps more importantly, the Computer Crime Act III authorises Dutch law enforcement authorities, with permission from an investigative judge, to make content containing serious crimes inaccessible (such as child abuse materials or jihadist propaganda) and to access computers remotely for evidence gathering purposes (a so-called hacking power).

Hacking power

The proposed power to hack computers seeks to provide a solution to the increasing challenges of anonymity, encryption and cloud computing in cybercrime investigations. By using this special investigative power, law enforcement officials can access computers remotely and gather evidence at its source, thereby circumventing problems such as the encryption of data. The instrument can only be used under the most stringent conditions, such as a warrant from an investigative judge and a limitation to serious crimes.

After law enforcement officials gain remote access to a computer system, they can be authorised to observe the behaviour of a person by turning on a GPS signal, microphone or video camera. Law enforcement officials can also remotely copy relevant data for evidence purposes in a criminal investigation. A particularly far-reaching power is to make a computer or data inaccessible. This may result in disabling a botnet infrastructure or encrypting child abuse images remotely.

Take down order

The proposed take down order provides an instrument for law enforcement authorities to make web content inaccessible. If online service providers or individuals publishing criminal materials do not disable the content voluntarily, a takedown order can be issued. Fortunately, the use of the instrument is restricted to serious crimes and a warrant from a judge is required. However, the take down order can go as far as ordering a hosting provider to take down a particular website (when possible) and even compelling an internet access provider to disable content. This last application of a takedown order boils down to an internet filter. Does this leave us in a few year with a black list of websites that must be filtered by Dutch internet access providers?


In my article about the Computer Crime Act III (.pdf in Dutch), I discuss the changes the act will bring to the Dutch Penal Code and Code of Criminal Procedure. Although I do acknowledge the necessity of hacking as an investigative power to gather evidence in criminal investigations involving serious crimes, I worry about the proposed powers to make computers or data accessible.

The problem is that the cybercriminals behind this criminal behaviour often reside on foreign territory and hide behind anonymisation techniques. These cybercriminals will often not be tried in a Dutch court. I wonder how many times a botnet will be disrupted by taking it down, or websites will be shut down or even filtered, without a trial during which a judge can determine whether those acts by law enforcement officials were conducted lawfully.

Therefore, I argued (and with me some Members of Parliament, scholars and several civil rights organisations) that we need an independent supervisory authority. This authority, perhaps modelled on the UK Investigatory Powers Commissioner’s Office, should be issued with the task of overseeing the legitimacy of operations involving these far-reaching special investigative powers. It is not likely such an authority will be created as part of the Computer Crime Act III, but perhaps the new Dutch cabinet should consider legislation to create such an authority.

This is cross-post from LeidenLawBlog.