Operational Activities and the Right to Privacy

Abstract

The confidentiality of the services and the lack of external control may lead to excessive autonomy or subjectification of the very purpose of operational activity and failure to exercise due restraint in encroaching on civil rights and liberties. Sometimes, such a situation may result from excessive ideological or political considerations in the operations of the executive authorities. In other words, the secrecy of operational control may lead to abuse. An additional aspect is the development of electronic communication facilities and the related cybercrime. The development of cyberspace requires control activities to be undertaken also in this area. The experience of modern democratic states indicates that the executive power responsible for public security and order, including its subordinate entities conducting operational and reconnaissance activities, has at its disposal resources which, in the name of defending public order, may lead to the destruction of democratic institutions and reduction of civil rights, including privacy rights.

The confidentiality of the services and the lack of external control may lead to excessive autonomy or subjectification of the very purpose of operational activity and failure to exercise due restraint in encroaching on civil rights and freedoms. Sometimes, such a situation may result from excessive ideological or political considerations in the operations of the executive authorities. In other words, the secrecy of operational control may lead to abuse. An additional aspect is the development of electronic communication facilities and the related cybercrime. The development of cyberspace requires control activities to be undertaken also in this area. Public security, considered as a fundamental in principle justifying the limitation of civil rights by the legislator, requires respecting the proportionality of acceptable encroachment in the name of safeguarding the safety and smooth functioning of the control system, while maintaining this proportionality in practice. Otherwise, the safety protection measures in the form of legally acceptable operational activities might in themselves present a risk to rights and liberties. Such will be the situation if, first, the introduced limitations prove arbitrary and disproportionate to the potential threats and, second, if they are removed (legally or effectively) from the control of democratic institutions. The conflict over the limits on applying operational and technical activities is familiar in any democratic country respecting the rule of law or, in practice, in international bodies in which, under Article 8 of the Convention on the Protection of Human Rights and Fundamental Freedoms,¹ universal standards have been developed. These standards are to benefit the assessment of proportions between public authorities’ interference and individual rights in this domain. The experience of modern democratic countries shows that executive authorities responsible for public order and safety, including their subsidiary bodies responsible for operational and exploratory activities, deploy measures whose utilisation—in the name of public safety protection—can lead to the deterioration of democratic institutions and a reduction in civil liberties, including the right to privacy.

The Polish Constitutional Tribunal, in its judgment of 19 February 2002,² expressed its opinion on the nature of the right to privacy. The Tribunal claimed that a vital component of the right to privacy is the so-called informational autonomy of the individual, which implies the autonomous right to disclose one’s personal information, as well as the right to exercising control over such information which is held by other entities. The right to privacy is guaranteed by Article 47 of the Constitution of the Republic of Poland and the informational autonomy of the individual is guaranteed primarily by Article 51. Under Article 51(1), no one may be compelled, except when based on an Act, to disclose information concerning himself or herself. Article 51(4) of the Constitution of the Republic of Poland establishes that everyone is entitled to have such information which is incorrect, incomplete, and collected in a way which is contrary to the law, to be corrected or removed. Furthermore, it is required for the principles and procedures of collecting and accessing information to be specified by an Act (Article 51(4) of the Constitution of the Republic of Poland). In the Court’s view, lege non distinguente, this last provision shall also be applied to the collecting and sharing of information by private entities. This line was also followed by P. Winczorek, “The right to privacy declared in the provision is protected, not only in relations between individuals and the public authorities, but also with other individuals and public and private institutions (vertical and horizontal application of law)”.³

However, in view of the growing number of terrorist attacks, particularly with the use of new technologies, the boundaries of interference with the right of privacy are greatly widening. In the Court’s view, as expressed in the judgment of the European Court of Human Rights of 12 January 2016, No. 37138/14 (The right to privacy, home, and correspondence), exercising covert control by bodies with executive power is a natural consequence of the forms terrorism takes. The government’s use of the latest technologies with the purpose of staying ahead of such attacks, including the mass monitoring of communications which could contain clues concerning pending incidents, might constitute the only reasonable solution. The techniques used in such monitoring operations have seen significant progress in recent years. These techniques have reached a degree of sophistication hardly imaginable to the average citizen, especially taking into consideration the technological facilitation and prevalence of automated and system-based data collection. Due to this progress, the Court had to examine the question of whether the development of control methods resulting in the immensity of collected data is paralleled by a simultaneous development in the legal provisions protecting the observance of citizens’ rights as envisaged in the Convention. These data often contain further information on the conditions in which essential components intercepted by public authorities have emerged, involving components such as the time and place, as well as the equipment used to produce computer files, digital photographs, electronic and text messages, and the like. Indeed, the aim of the government’s efforts, whose target is to limit terrorism and thereby to restore citizens’ confidence in the government’s ability to maintain public safety, would be undermined if a terrorist threat was paradoxically replaced by a visible threat triggered by the unhindered authority of executive power to intervene in the sphere of the private lives of citizens using uncontrollable, and at the same time far-reaching, control techniques and prerogatives. Potential interference with electronic correspondence, including mobile phone and Internet services, as well as covert mass control, attract the Convention-based protection of private life to an even larger extent. Such interference might be justified only under Article 8(2) of the Convention, if it is in accordance with the law, pursues one or more legally justified goals as indicated in Article 8(2), and is crucial in a democratic society to achieve any of these goals. The provision, as it allows an exception to the right provided by the Convention, must be interpreted narrowly. Powers to covertly control citizens, which are a feature of a Police State, are tolerated exclusively under the Convention only to the extent that they are strictly necessary for the protection of democratic institutions. The Court has concluded that the aim of the said interference is the protection of public safety, and/or the safeguarding of order and crime prevention, in line with Article 8(2) of the Convention.

In accordance with the view of the European Court of Human Rights regarding the privacy of the individual protected under Article 8 of the Convention, it is potentially permissible for the authority (legislative, executive, judicial) to interfere in this privacy as long as it meets certain criteria. Any such encroachment must, nonetheless, pass the three-tier evaluation test. This means that it is not permissible to implement restrictions (on privacy) with legal provisions of ranks other than an Act.⁴

In the cases against France (cases Kruslin v France, 11801/85 and Huvig v France, 11105/84 of 24 April 1990), it was pointed out that the Convention required from the national legislature that an applicable act define the category of persons for which such operational control could be used on the basis of a court order; the type of crime such an order could be issued against; the maximum control period; the reporting procedure concerning the content of recorded conversations (the case was about telephone tapping); measures providing the transfer of intact recordings and enabling their full control by the judge and the defence; and defining the cases in which the recordings may or must be destroyed, especially when the investigation was discontinued or the convicted person was acquitted by the judge. French legislation was declared as not meeting the criteria, similarly to the national legislation in the case of Malone v the United Kingdom (8691/79) in the judgment of 2 August 1984 (the cases concerned the collection of information and telephone tapping). It was recognised that the local acts were too vague and non-specific, which led to a situation in which, although the activities were statutory, they were also not in line with the Convention. It is not sufficient to refer to the factor of purposefulness. It appears vital to prove the necessity, strictly, of the specific (concerning the range and manner) limitation established by an ordinary Act. Therefore, collecting information in the course of operational control must be dealt with in legislation and, additionally, in the Police practice, as a subsidiary procedure in the intervention aim (as a safeguard to the public interest), mentioned in Article 8 of the Convention, including national security, public safety, the economic welfare of the country, crime prevention and the protection of order; the safeguarding of health and morality; and the freedom of other individuals. A similar provision was introduced into the Constitution of the Republic of Poland. Article 31(3) of the Constitution specifies that the restrictions on the exercise of fundamental constitutional freedoms and rights may be imposed only by law, and only when necessary in a democratic state for the protection of its security or public order, or for the protection of the natural environment, health, or public morals, or the freedom or rights of other persons. These limitations, however, cannot violate the essence of freedoms and rights.

In each case, it is necessary to demonstrate a plausible need for taking such limitation measures, and solely in the name of protecting the very rules of democratic order. A situation in which, by “incidentally” collecting operationally useful data, operational control gathers private data, which go beyond the aim of the control, means that the authority is operating beyond the scope of permissible intervention in the private domain.

The European Court of Human Rights has acknowledged, however, that the covert control of individuals is “necessary in today’s reality in a democratic society for national security and in order to safeguard order and prevent crime”, whereby it recognised that the fact of “the failure to inform about observation” does not violate the Convention (see the reasoning of the judgment of 6 September 1978 in the case of Klass and others v Germany (5029/71)), as well as D. Gajdus, B. Gronowska, Stosowanie podsłuchu telefonicznego w ocenie Europejskiej Komisji i Europejskiego Trybunału Praw Człowieka (Refleksje na tle rozwiązań polskich), “Palestra” No. 11/1994, pp. 115 and 116). Although the judgment in the case of Klass and others v Germany was in favour of the German legislature, the law was amended after the judgment had been passed in Strasbourg. As a result of the amendment, there was an increase in the protection standards by imposing an obligation to inform ex-post the person against whom such operational activities were being conducted, under Article G-10, that such a control was being carried out against him or her (Article 5(5)).⁵

In its judgment of 4 May 2000 (Rotaru v Romania, 28341/95) the European Court of Human Rights established that systems of covert invigilation must contain legislative (procedural) guarantees applicable to the control of actions by the appropriate departments. According to that Court, the investigative procedures must correspond to the values of a democratic society as closely as possible, and must in particular correspond to the rule of law. According to the ruling, the interference of an executive authority with the rights of individuals should be subject to effective control. The control should be carried out by external bodies in respect of the appropriate authorities carrying out operational actions. It is highly desirable that—in normal circumstances—it be done by judicial bodies. A judicial review guarantees independence, impartiality, and the application of the correct procedures. The Court considers that non-judicial control, exercised by other external bodies against the controlled person, with a properly representative composition, does not prejudice the standards of the Convention. An alternative to subjecting operational and exploratory activities to judicial control might be subjecting activities to the control of a special body whose location and composition ensure independence from the executive authority. Only then will the objectivity of the results of the control be guaranteed. It should be noted that, in the justification of the judgment by the European Court of Human Rights in the aforementioned case of Klass and others v Germany, it was deemed appropriate to exclude judicial control in cases in which telephone tapping was used. The ruling was delivered against a different regulation in which the function of control over tapping was entrusted to an official “with qualifications for a judicial office” with the concurrent guarantee of stable parliamentary control, exercised by a three-member commission, as well as a five-member Board of the Union Parliament. In the judgment of 27 April 2004, in the case of Doerga v the Netherlands (50210/99), the European Court of Human Rights stressed that any intervention in subjective rights guaranteed by the Convention must be in accordance with the rule of law. This, in turn, requires the foremost compliance of operational activity with the requirements of the national law. According to the Court’s case law, intervention in private life and correspondence include not only the individual means of covert control aimed at particular entities but also the strategic monitoring of connections and obtaining the personal data of communicating entities. The question was considered in the case of Weber and Saravia v Germany, in which German provisions regulating the strategic monitoring of telecommunication connections, whose aim was to record the telephone conversations of an unspecified number of callers, and then identify, using key-word information included in the conversations, which could potentially identify the offenders or their criminal plans, were challenged (the case of Weber and Saravia, Application No. 54934/00). Collecting and storing data connected with an entity by the state services, irrespective of the means by which they were collected (the citied case of Rotaru v Romania, Application No. 28341/95), also constitute an encroachment into the private sphere of an entity. In order to assume that there was an intervention in the law guaranteed by Article 8 of the Convention, it is enough to determine whether there was a collection of data on entities, regardless of how it would be used in the future. Nevertheless, the possibility of covertly obtaining information about persons by public authorities was not ruled out. The Court pointed to their indispensability as a tool enabling effective security guarantees, as well as the protection of a democratic state’s institutions against sophisticated forms of threats, notably espionage and terrorism.

The standards of collecting and processing data by competent authorities are defined by judgments in the cases of Zakharov v Russia, Application No. 47413/06, and Szabó and Vissy v Hungary, Application No. 37138/14. The applicant, Roman Zakharov, used the services of several mobile network operators, and on 23 December 2003 filed a lawsuit against three phone operators, claiming that they had committed an infringement of his rights to the privacy of telephone communication. He further claimed that, according to Regulation No. 70 of the Ministry of Communication, the mobile network operators had installed a device which enabled the Federal Security Service to intercept phone calls without the prior authorisation of a judicial authority. Regulation No. 70, which has never been published, excessively limited his right to privacy. Roman Zakharov requested the Court to issue a warrant under Regulation No. 70, ordering the installed device to be removed, and to make telephone communication available only to authorised persons. The provisions of Russian law regulating the interception of communication transmission do not take into consideration any adequate and effective guarantees against the risk of such malpractice, which is integral to every system of invigilation, and which is particularly high in a system in which secret services and the Police have direct access, via technical means, to all telephone communication. In particular, the circumstances in which public authorities are authorised to use secret surveillance measures are not expressed in sufficiently precise terms. The provisions regulating the discontinuation of using secret surveillance measures do not provide sufficient safeguards against arbitrary interferences. National laws allow the automatic interception of suspect data; in addition, it is not clearly specified in which cases the intercepted material should be stored or destroyed at the end of the test.

The procedures for authorisation cannot guarantee that secret surveillance measures will be used only in situations in which they are “necessary in a democratic society”. Nowadays, control over intercepted communication does not fulfil the requirements of independence, nor that which pertains to the entrusted authority and power which would be sufficient for effective and constant control. The effectiveness of appeal mechanisms is weakened because the person whose communication is being intercepted is not informed of the fact, and, furthermore, because of the lack of effective access to the documentation pertaining to the interception. Providing executive authorities with unlimited decision-making powers in the matters of national security would be contrary to the rule of law. The law must mark with sufficient clarity the limits of every decision-making freedom conferred on any competent authority, as well as the means by which it is exercised, keeping in mind the legal aim of the measures, so as to provide the entities with adequate protection against arbitrary interference. What is required is prior judicial authorisation, providing an essential safeguard against arbitrariness.

Similarly, the European Court of Human Rights concluded that the Hungarian Act on the Police infringed the right to privacy. Following the amendments introduced in 2011, the Act now enables special anti-terrorist units to carry out covert house searches, to tap phones, to open packages and letters, and to perform the uncontrolled viewing and recording of electronic mail. The Court consistently holds that the rules on the special powers of the secret services should provide for strong control of their actions, and for informing citizens of the fact that they are under surveillance. In the case of Szabo and Vissy v Hungary, the Court ruled that the contested regulations could apply to any person staying on the territory of the country and to any property located there, and people have no way of verifying whether they are being surveilled or not. The introduction of special powers for the services to fight terrorism is, according to the Court, justified; however, Hungary should, at the same time, guarantee sufficient protection of its citizens’ rights. The legal provisions should indicate that tapping and intercepting communication is allowed only in the case of persons for whom there is a reason to suppose that they are participating in terrorist activities. The undertaken measures should be subject to external, preferably judicial, control, also that conducted ex-post. The Court has also been critical towards the fact that the Hungarian regulations do not take into consideration the deletion of stored personal data which have proven useless, or any clear indication of whether it is possible to extend several times the use of privacy-infringing control measures. This should be achieved by external control, and by providing the people with an effective tool enabling them to assert their rights. The first step, though insufficient, is stating whether a person is being subjected to a special inspection.

It should be stressed that nations are equipped with what has been referred by the Court as the margin of appreciation; in other words, a degree of freedom to balance the rights of individuals against national security (vide 5 Leander v Sweden, 9248/81, § 59, 26 March 1987). As early as in the 1970’s, the Court observed that legislation allowing the covert monitoring of the mail and telecommunication in a democratic country was necessary in exceptional circumstances, in the interests of national security, and/or in order to prevent hostile actions or crime. More recently, the Court has found that the invigilation of terrorist suspects using GPS does not infringe their right to privacy as guaranteed by Article 8 of the Convention (Lass and others v Germany, 5029/71, 6 September 1978, Series A, No. 28, § 48, as well as Uzun v Germany, 35623/05, § 80, the European Court of Human Rights, 2010 (fragments)). The Court ruled that sufficient safeguards had been used in providing protection against the arbitrary use of such methods. On the other hand, the powers conferred on the Police by special anti-terrorist legislation, to detain and search any person on no sufficiently defined basis for suspicion of violation, are deemed as infringing the applicant’s rights to the respect of his or her private life.⁶

So far, there has been no single Act in Poland which would thoroughly regulate the question of the detection, prevention, and elimination of terrorist threats, or the issue of removing the effects of such attacks. Basic regulations to this effect have been included in the following Acts:

• (1) The Act of 6 June 1997—Penal Code, which, inter alia, contains a definition of a terrorist crime (Article 115 § 20), and penalises the founding and leadership of, and involvement in, an organised group or association whose aim is to commit a terrorist crime (Article 258 § 2 and 4), the financing of a terrorist crime (Article 165a), as well as distributing or publicly presenting content which can facilitate the perpetration of a terrorist crime (Article 255a);

• (2) The Act of 26 April 2007 on Crisis Management, which determines the authorities responsible for cases of crisis management, as well as their tasks, and the principles of action in the field, as well as defines, inter alia, the concept of a terrorist incident;

• (3) The Act of 1 March 2018 on Preventing Money Laundering and the Financing of Terrorism,⁷ which determines the principles and manner of preventing the financing of terrorism.

The basic aim of the new regulations is to raise the effectiveness of the Polish anti-terrorist system, thus increasing the safety of all Polish citizens through facilitating effective actions in cases of suspected terrorist crimes, including setting up preliminary procedures. The issue of responding to terrorist threats has also been recognised in regulations concerning emergencies. In addition, the issues related to the tasks and authorisations of services and institutions with regard to terrorist threats are contained in competence acts regulating their action (e.g. the Act of 6 April 1990 on the Police, the Act of 12 October 1990 on Border Guards,⁸ and the Act of 24 May 2002 on the Internal Security Agency and on the Intelligence Service⁹), as well as other legal acts covering selected aspects pertaining to a particular type of threat (such as the Act of 4 September 2008 on the Protection of Maritime Traffic and Sea Ports, and the Act of 12 October 1990 on the Protection of the State Border). In order to strengthen the state’s preparations to the emergency of terrorist threats, it is crucial to integrate activities implemented by particular members of the multi-party anti-terrorist system in Poland. Of key importance in the effective functioning of an anti-terrorist system in Poland is providing the optimal coordination of actions and mechanisms of cooperation on the strategic, operational, and tactical levels. For this purpose, the Act of 10 June 2016 on Anti-Terrorism was adopted. According to the definition contained in this Act, these are activities of public administration authorities whose aim is to prevent terrorist actions, to prepare for taking control of them through planned actions, to react in the event of such actions, and to remove their effects, including by restoring the resources targeted at reacting to them (Article 2(1)). Article 25 of the Act provides for a special mode of preliminary proceedings in case there is a suspicion of an attempt at committing a crime or making preparations for a terrorist crime, with the aim of detecting or detaining, or compulsory appearance of, any person suspected, and also in order to find items which could constitute evidence in the case, or which could be confiscated in the criminal proceedings. This mode refers, inter alia, to the possibility that the prosecutor issues a provision to search any premises identified in the provision, or to detain a suspect, should there be justified reasons to assume that the suspect or the listed items might be present in the area. In order to find objects which can be considered evidence in a case, or be subject to seizure in criminal proceedings, the Article also provides for the possibility to search persons present on the premises, their clothing and objects they have on them. The above-mentioned actions may be carried out at any time of day or night.

The European Court of Human Rights, in its judgment on Sher and others v the United Kingdom (No. 5201/11), ruled that, in the case of proceedings relating to terrorist crimes, there is justification for allowing such a search or detention to be performed based on conditions considered more broadly than in other cases. In particular, as pointed out by the Court, there is no violation of the European Convention of Human Rights and Fundamental Freedoms if the search is performed on the conditions indicated above, and in a situation in which there is a right of appeal against the above-mentioned activities. Under Article 23 of the Act on Anti-Terrorist Activities, and amendments to other Acts, with regard to the scope not regulated herein, Article 236 of the Act of 6 June 1997 of the Code of Criminal Proceedings¹⁰ shall apply, in accordance with which any persons whose rights have been violated are entitled to lodge a complaint. Furthermore, it has been pointed out in Article 26 of the Anti-Terrorist Act, relating to the situation in which there is a suspicion of committing a terrorist crime, that if it is in the best interests of preparatory proceedings, an order for the bringing of charges may be drawn up on the basis of information obtained as a result of operational and exploratory activities, including the activities referred to in Article 9 of the Act, i.e. laid down by the Head of the Internal Security Agency against a non-citizen of Poland, in whose case there exists a justified suspicion of terrorist activities, for a period not exceeding 3 months, and covert operational and exploratory activities. In order to detect, prevent or fight crime, the Head of the Internal Security Agency may order against a non-Polish citizen in whose case there exists a justified suspicion of terrorist activities, for a period not exceeding 3 months, covert activities including:

• (1) obtaining and recording the content of conversations using technical means, including telecommunication networks

• (2) obtaining and recording the images and sounds of persons from rooms, public transport, or places other than public places

• (3) obtaining and recording correspondence content, including correspondence via means of electronic communication

• (4) obtaining and recording data recorded on digital-data media, communications terminal equipment, information, and information and communication systems

• (5) obtaining access to and control of the content of consignments.

Moreover, in this case, the Court, at the request of the Prosecutor, may order a provisional detention for a period not exceeding 14 days. An autonomous indication for the implementation of a provisional detention is the likelihood of committing, or preparations to commit, a terrorist crime. Under Article 6 of the Act, the Head of the Internal Security Agency, complying with the requirements concerning classified-information protection, keeps an updated list containing information on persons undertaking activities intended for the purpose of terrorist organisations or organisations connected with terrorist activities, or members of such organisations; wanted persons conducting terrorist activities or persons suspected of committing terrorist crimes, against whom in Poland there is an order of arrest or search, or against whom there is an arrest warrant, as well as those wanted on the basis of a European arrest warrant; persons against whom there is a justified suspicion that they might carry out actions whose aim is to commit a terrorist crime, including persons posing a threat to the safety of Polish civil aviation; or persons taking part in terrorist training, or travelling with the aim of committing a terrorist crime. Additionally, under Article 10 of the Act, within the framework of the entitlement to collect palmprint image data, to copy facial images, and to collect DNA material, the officers of the Internal Security Agency, the Police and the Border Guard are entitled to collect palmprint images, to capture facial images and to collect biological material in a non-intrusive way in order to determine the DNA profile of a non-Polish citizen, in cases where: (1) there is a justified doubt concerning the person’s identity, or (2) there is a justified suspicion that the person has illegally crossed the border of Poland, or doubt about the declared purpose of that person’s stay on Polish territory, or (3) there is a suspicion concerning the intention of that person’s unlawful presence on Polish territory, or (4) there is a justified suspicion that the person might be in some way involved in terrorist activity, or (5) the person might have taken part in terrorist training. Under Article 26 of the Anti-Terrorist Act, should there arise a suspicion of a terrorist crime, for the sake of preparatory proceedings, the decision to present charges may be drawn up on the basis of information obtained in the course of operational and exploratory activities. It is worth adding that, in accordance with Article 60 of the Act which establishes a registration obligation in the case of pre-paid services, the subscribers to pre-paid services who signed a contract prior to the date of the entry of the regulation into force, have been duly summoned to supply the pre-paid services provider with the data specified in the Act of 16 July 2004—Telecommunications Law (Article 60b—the obligation to supply personal data by the subscriber). In accordance with the Act, subscribers (excluding those who use publicly available phone services provided using public phones, or by dialling the network access number to the service provider’s network, or pre-paid services subscribers whose aim is to broadcast or distribute TV programmes through ground, cable or satellite), should supply the provider with the following data:

• (1) for subscribers who are natural persons:

  • (a) name and surname

  • (b) personal identification number (PESEL), if assigned, the series and number of a document confirming the person’s identity, and, in the case of a foreigner not being a citizen of a Member State or the Swiss Confederation—the passport number or residence permit;

• (2) for subscribers who are not natural persons:

  • (a) name

  • (b) the business registry number (REGON) or the tax identification number (NIP), or the National Court Register (KRS) number, or the Business Register Number, or a number affixed in any other register.

The service provider begins to provide telecommunication services:

• (1) not earlier than the conformity of the data provided by the subscriber is confirmed against the data included in the document stating the subscriber’s identity as a natural person, included in a specific register, or after the subscriber provides his or her personal data, and these are confirmed electronically using electronic identification means serving to authenticate, in the IT system of the national bank, the data verified using a qualified certificate of an electronic signature, or electronic identification means serving authentication purposes in the IT system of the telecommunication service provider, if the subscriber’s personal data have already been verified in connection with a different contract, and electronic identification means serving authentication purposes in the IT system which meets the requirements specified in the regulations issued on the basis of Article 20a(3) of the Act of 17 February 2005 on the Computerisation of the Operations of Entities Performing Public Tasks.

Confirmation may also be made by the service provider through a third party operating on behalf of that service provider. A pre-paid service provider of a public telecommunication network shall immediately cease to provide such services to subscribers who fail to deliver such data, or whose data have not been confirmed. Similar solutions regarding interference in the right to privacy have been introduced in Article 180a of the Telecommunications Law, which regulates the issue of data retention. Both the public telecommunication network operator and the publicly available telecommunications service provider are obliged, at their own cost, to:

retain and store data relating to the network termination point, telecommunications terminal equipment, the end user: initiating the connection, and to whom the connection is addressed; as well as determining:

• (a) the date and time of the connection, and its duration

• (b) the type of the connection

• (c) the location of the telecommunications terminal equipment generated in the telecommunications network, or processed by them within the Polish territory, for the period of 12 months counting from the day of the connection or the failed connection, and to destroy the data after the end of this period, with the exception of information which has been saved in accordance with separate provisions, and to share data concerning the entity initiating the connection, as well as the one to whom the connection is addressed with the competent authorities, the Court, and the Prosecutor, on the terms and conditions, and in the mode, as specified in separate provisions. These authorities include the Police. Under Article 20c of the Act on the Police [Obtaining and processing telecommunication, postal and Internet data], in order to detect or prevent crime, including fiscal crimes, or in order to save human life or health, or to support search-and-rescue actions, the Police may obtain data which do not constitute a telecommunications transmission, a transported postal item, or an electronic service (“telecommunications, postal or Internet data”), and may process the same without the persons concerned being informed and/or having given their consent to it.

The Chief Police Commander, the Head of the Central Bureau of Investigation, the Head of the Police Internal Affairs Office, and the Regional Police Commander maintain registers of telecommunications, postal or Internet data requests. These requests contain information identifying the Police unit and the Police officer obtaining such data, their type, the purpose for which they are being obtained, and the time at which they are being obtained. These registers are electronic, without prejudice to the rules of protecting classified information. The data are also collected from, and shared with, law-enforcement authorities of the European Union, and other countries, European Union agencies engaged in crime prevention and combat, and the International Crime Police Organisation—Interpol, on their due request, if this is aimed at detecting crime and prosecuting perpetrators, protecting human lives and health, or searching for missing persons. Under Article 20a, control over telecommunication, postal or Internet data collection by the Police is exercised by the Regional Court appropriate for the Police unit to which the data are made available. The Police authority, with the provision on the protection of classified information, submits to the Regional Court, on a half-yearly basis, a report covering

• (1) the number of cases in which telecommunications, postal or Internet data were obtained in a given reporting period, as well as the type of requested data;

• (2) the legal classification of the actions with regard to which there were requests for obtaining telecommunications, postal or Internet data, or information concerning such acquisition of data in order to save human life or health, or in order to support search and rescue operations.

As part of the control, the Regional Court might need to view the materials which justify sharing such telecommunications, postal or Internet data with the Police. The Regional Court then informs the Police authorities of the outcome of the control within 30 days of its completion. As a consequence, the ex-post system of operational and exploratory control allows the establishing of whether such an intervention in private life was purposeful, proportionate, and necessary.

Social changes which are the result of civilisational developments stimulate the democratic processes and constitute a space in which various business, economic, organisational, and socially desirable aims can be achieved, but they also tend to be the reason for regressive actions. This applies to virtually every sphere of human activity, and it applies to human rights and basic freedoms in particular. The risk of such dangers for an individual grows in proportion to the process of weakening the country as a structure and an institution. As a consequence, an individual citizen loses his or her sense of security. This feeling is related to the new situations in which an individual, a citizen, exists. Globalisation, the crisis of the institution of the state as a regulator, doubts connected with the territory, information exchange, the intermingling of cultures, the identity crisis, the world economic crisis, and terrorism with its new sources, all create a new space in which rights and basic freedoms require special public attention, and the redefinition of aims for choosing the proper protection measures. An additional aspect of these changes is the question of safeguarding public safety which, also for the above-mentioned reasons, requires redefinition. The protection of public safety is one of the most crucial aims of the state’s actions and, consequently, those of public authorities and the entire public administration. Thus, it is worth stressing that public security is composed of various elements, such as personal and individual safety.

While wielding its attributes of power, the state uses various legal instruments and institutions whose aim is to protect the public interest, morals, and national security. A situation in which the state is weakened, like no other, poses a direct risk to public security and, as a consequence, to individual safety. For this reason, it has become vital to determine the status of the individual against the state, within the framework of public authority directed at the protection of the individual by ensuring public safety. Undoubtedly, operational and exploratory control is such a measure. If one analyses the status of such a control guarantee, it becomes vital to supplement its scope with an assessment of the citizens’ responsibilities and limitations connected with public safety, including such spheres of individual functioning as are related to a citizen’s privacy and identity—though always in accordance with the principle of Christian Wolff, the continuator of Pufendorf’s thinking that homo persona moralis est quaternus spectatur tanquam subiectum certarum obligationum atque iurium certarum.¹¹