W7y8w3

changes that would limit the legitimate purposes ofsurveillance, it is likely that cases like Wróblewski’swill be repeated.ConclusionsTelecommunications data retention, by definition,constitutes a serious violation of the right to privacy.Mobile phones are a part of our everyday lifeand therefore our telecommunications data revealsa lot about our life: from professional to intimaterelationships to daily routines. With increasingamounts of data stored by private companies (notonly telecommunications or internet service providers,but also shops, banks, insurance companies,health services or energy providers), the issue oflegitimacy of data retention and access rules mustbe revisited. The trend towards retaining more dataand broadening the catalogue of purposes that justifyits further use should be reversed.Any surveillance mechanism that targets innocentcitizens and leads to the collection of data“just in case it may turn out to be useful” cannotbe reconciled with a presumption of innocence. Thisposition has been reinforced by the Court of Justiceof the European Union in its recent judgement thatdeclared the Data Retention Directive “invalid fromthe beginning” because of insufficient human rightssafeguards. 11 This judgement should be implementedin all European countries.Currently Polish law does not provide for anyindependent oversight over intelligence agencies.Only internal control mechanisms are in place,which cannot be treated as independent. As a resultthere is no way to verify whether Polish intelligenceagencies observe at least existing legal safeguards,other than through journalistic investigation orwhistleblowing. Wróblewski’s case shows beyonddoubt that strict control over intelligence agencies’powers to access citizens’ telecommunicationsdata is necessary. Such control mechanisms shouldcover not only the use of data retained for securitypurposes, but access to all types of data, the useof other surveillance technologies (SIGINT, CCTV,open source intelligence, predictive profiling, etc.)and international cooperation among intelligenceagencies.Institutional checks and balances with regardto surveillance carried out by the state cannot workwithout sufficient information. Therefore, the mainobstacle that we face in demanding more accountabilityfor illegitimate surveillance is secrecy and a11 The Court of Justice declares the Data Retention Directive to beinvalid. http://curia.europa.eu/jcms/upload/docs/application/pdf/2014-04/cp140054en.pdflack of transparency. Polish law does not providefor any reliable mechanism for verifying how manytimes and for what purposes public entities (lawenforcement or any of the nine intelligence agencies)asked for citizens’ personal data. This problemaffects all types of data and all types of requests,whether telecommunications, electronic services,banking, or social security data.Currently Polish public authorities are underno legal obligation to register their data requests,nor publish the number of requests or other details.Only telecommunications service providers are requiredto collect statistics showing how many timesthey were asked for their clients’ personal information.However, research conducted by PanoptykonFoundation in Poland showed that even data that iscollected by public authorities cannot be relied on. Asimple comparison of statistics published by the Officefor Electronic Communications (the supervisorybody for telecommunications service providers) anddata obtained directly from police and intelligenceagencies via freedom of information requests,shows that there is a significant discrepancy. Thelaw should provide for one methodology that wouldapply to collecting information about the scale andpurpose of requests for citizens’ data from varioussources.Action stepsGiven the above, the following steps should be takenin Poland to secure a human rights frameworkfor surveillance:• Thanks to Edward Snowden’s disclosures, Europeancitizens learned that there is a link betweenmandatory retention of telecommunicationsdata, introduced by the EU in 2006, and US programmesof mass surveillance. Measures whichhuman rights advocates across Europe havebeen fighting for the last seven years turned outto be part of something much bigger and muchmore disturbing. This common context of internationalmass-surveillance operations shouldbe further explored for advocacy purposes bycivil society on both sides of the Atlantic.• Following the recent ruling of the Court of Justiceof the EU, Poland and other Europeancountries should revise their laws that providefor telecommunications data retention withoutadequate safeguards. However, it will not bean automatic process resulting from the judgement.The judgement itself only affected theData Retention Directive – not respective nationallaws. It might be necessary for citizens andthe European Commission to take further legalaction. The possibility of bringing a complaint tothe European Commission on the grounds thatexisting national laws are in violation of the Europeanlaw is worth exploring.• The need for more transparency in the areawhere law enforcement and intelligence agencies“meet” private companies and demandcitizens’ data has become evident, not only withregard to telecommunications data, but evenmore so with regard to all types of data that arestored by internet service providers. One wayof pursuing this goal is by drafting so-calledtransparency reports – reports that show notonly the scale of surveillance but also exploreits purposes and human rights impact. Whilecompanies focus on numbers, civil society andresearchers should focus on problem analysis,asking pertinent questions on the basis ofavailable data. Panoptykon Foundation draftedsuch a transparency report for Poland in 2013. 12Other organisations could build further on thismethodology.12 Panptykon Foundation. (2013). Access of public authorities tothe data of Internet service users: Seven issues and severalhypotheses. Warsaw: Panoptykon Foundation. panoptykon.org/sites/panoptykon.org/files/transparency_report_pl.pdf200 / Global Information Society Watch poland / 201