Comments on the draft act strengthening judicial oversight of operational surveillance

Mirosław Wróblewski, President of the Personal Data Protection Office, submitted comments on the draft act amending certain laws to strengthen judicial oversight of operational surveillance. The draft act currently under consideration in the Sejm (Lower House of the Polish Parliament) does not provide for informing a person whose personal data was processed in secret as part of an operational surveillance operation of the fact of such surveillance after its completion, in a situation where the surveillance did not result in the collection of evidence confirming that the person committed a crime. The draft, on which the President of the Personal Data Protection Office has issued an opinion, does not ensure full compliance in this regard with the judgment of the European Court of Human Rights in the case of Pietrzak, Bychawska-Siniarska, and Others v. Poland.

The draft was not submitted to the supervisory authority for review during the government stage of the legislative process, contrary to the provisions of Article 5(3) of the Polish act on the Protection of personal data processed in connection with preventing and combating crime. The supervisory authority’s comments were forwarded to Dariusz Salamończyk, Deputy Head of the Sejm Chancellery.

The President of the Personal Data Protection Office supports all legislative initiatives aimed at strengthening oversight of the use of operational surveillance and enhancing the level of protection for the rights of individuals subject to such surveillance. In general, he agrees with the provisions set forth in the draft, though he considers them insufficient.

Key proposed changes

The draft under review introduces the following legal provisions, which fully deserve the supervisory authority’s support:

1.   the requirement for the court to provide a statement of reasons for its decision regarding: the authorisation of an operational surveillance measure, the refusal to authorise an operational surveillance measure, or the extension of an operational surveillance measure;

2.   the obligation to inform the court that issued the order authorising or extending the operational surveillance of the destruction of materials collected during the operational surveillance that are inadmissible in criminal proceedings, as well as materials that do not contain evidence sufficient to initiate criminal proceedings or evidence relevant to ongoing criminal proceedings;

3.   the obligation to inform the court that issued the order authorising or extending the operational surveillance of the results of the operational surveillance upon its completion, and, at the request of that court, also of the course of the operational surveillance while it is ongoing;

4.   the authority of the competent court to issue, at any time—subject to justification—an order to suspend the operational surveillance;

5.   the removal of the authority to conduct operational surveillance from the Internal Oversight Inspector, through whom the minister responsible for internal affairs exercises oversight over the Police, the Border Guard, the State Protection Service, and the State Fire Service.

Comments by the President of the Personal Data Protection Office

The proposed regulations described above are generally sound, but they do not fully address the issue of ensuring that operational surveillance provisions comply with constitutional standards regarding permissible interference with an individual’s right to privacy and right to the protection of personal data.

First, the draft does not include provisions regarding the notification of a person whose personal data was processed in secret as part of an operational investigation, regarding the fact of such an investigation after its conclusion, in a situation where the investigation did not result in the collection of evidence confirming that the person committed a crime. This issue was already highlighted in the Constitutional Tribunal’s judgment of July 30, 2014 (K 23/11), yet it remains unregulated by law.

Second, operational surveillance is the instrument that most intrudes on an individual’s privacy. Serious consideration must be given to whether the list of crimes provided for in the regulations—suspicion of which justifies applying to a court for an order authorising operational surveillance—is not too broad and does indeed cover only such serious crimes that the use of operational surveillance in their case does not violate the principle of proportionality under Article 31(3) of the Constitution of the Republic of Poland.

In his opinion, the President of the Personal Data Protection Office noted that Polish regulations concerning the operational control regime, the retention of telecommunications data and its use for the purposes of the security services, as well as covert surveillance conducted under the provisions of the Act on Counter-Terrorism Measures, were the subject of an assessment by the European Court of Human Rights in its judgment of May 28, 2024 in the case of Pietrzak, Bychawska-Siniarska, and Others v. Poland (applications nos. 72038/17 and 25237/18). The ECHR ruled in the aforementioned case that Poland had violated Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms—the right to respect for private and family life and correspondence—with regard to complaints concerning the regime of operational control, surveillance under the Act on Counter-Terrorism Measures, and the retention of communications data for potential use by competent national authorities or agencies.

The ECHR found that Polish law does not provide sufficient safeguards against excessive interference with individuals’ private lives and lacks guarantees regarding communications covered by attorney-client privilege. The absence of these safeguards was not sufficiently offset by a judicial review mechanism, which proved to be illusory. The ECHR also stated that the existing procedure for authorizing operational surveillance should be supplemented by other mechanisms for ex post procedural review.

The ECHR also noted that, under the current legal framework, there is no obligation to inform a person subject to an operational surveillance measure, even after a specified period has elapsed and provided that doing so would not jeopardize the purpose for which the measure was implemented. The ECHR further noted that Polish law did not provide for an effective remedy for persons who believed they had been subjected to covert surveillance.

Given the shortcomings identified in the opinion of the President of the Personal Data Protection Office, the draft, in its essential parts, does not ensure compliance with the judgment of the European Court of Human Rights in the case of Pietrzak, Bychawska-Siniarska, and Others v. Poland

DPNT.401.143.2026