Venice Commission - Report on a rule of law and human rights compliant regulation of spyware

www.venice.coe.int

Disclaimer: this information was gathered by the Secretariat of the Venice Commission on the basis of contributions by the members of the Venice Commission, and complemented with information available from various open sources (academic articles, legal blogs, official information web-sites etc.).

Every effort was made to provide accurate and up-to-date information. For further details please visit our site : https://www.venice.coe.int/


  Slovakia

1. Does your legal framework allow for the use of spyware as a tool of targeted surveillance either in criminal or intelligence investigations or is there an explicit prohibition on the use of spyware? If so, how does your domestic legal framework define spyware?

There is no legal definition of spyware and no explicit prohibition on its use. The Slovak legislation uses a general term “information-technical devices”, which includes the classic surveillance methods and could also be understood to include spyware. See the answer to Q2 for more details.

2. Are there specific rules (covering notably the scope ratione materiae, temporis and personae) in place or do the general rules on targeted surveillance (interception of communications) apply (could you please provide us with such specific or general rules)?

There are no specific rules regarding spyware and, indeed, the general rules on targeted surveillance apply. These are contained in two principal pieces of legislation, namely the 2003 Protection Against Interception Act (“PAIA”, annexed in its entirety in English, with only final and transitory provisions left out) and the 2005 Criminal Procedure Code (“CPC”, relevant provisions annexed). Several other laws refer to the PAIA; those provisions are also annexed.
The PAIA defines “information-technical devices” in Section 2 par. 1 as “electro-technical, radio-technical, photo-technical, optical, mechanical, chemical and other devices” used secretly for purposes therein defined. These include the tracing, opening, examination and evaluation of mail and other transported items, obtaining the contents of messages transmitted over electronic communications networks, including the interception of telephone communications, and making visual, audio, audio-visual or other recordings. The definition contained in Section 10 par. 20 CPC is almost identical.
Several authorities may use those surveillance tools under the PAIA, but the information gathering is carried out either by the Police Corps or by the Slovak Information Service.
Surveillance tools and any data gathered in this way may only be used for the time and to the extent strictly “necessary in a democratic society” for legitimate aims defined by the law and only if it is proven that meeting those aims would be ineffective or severely hindered by other means. The legitimate aims include the protection of the constitutional system, internal order and foreign policy interests of the State, security and defence of the State, the obtaining of information from foreign sources, the prevention and investigation criminal activities, and the “protection of the rights and freedoms of others” (Section 3 PAIA).
Target surveillance must always be authorised by the competent court (see Q5 for details). In urgent matters, however, the Police Corps may carry out surveillance even without a court warrant but must inform the competent judge of the surveillance within one hour and file a written, substantiated application within six hours from the start of the surveillance. If the court does not approve the surveillance within 12 hours, all surveillance must be terminated and any data and recording obtained destroyed and the court informed of the destruction (Section 5 PAIA).
Any recording and data obtained through illegal surveillance must be destroyed before a judge within 24 hours and may not be used as evidence in court proceedings. The results of surveillance that has not produced any information useful for meeting one of the legitimate aims listed above must also be immediately destroyed. (Section 7 PAIA).
The regulation contained in Sections 114 and 115 CPC is in many ways analogous. First, the CPC limits the use of surveillance measures to certain categories of crimes only.
Audio and video recordings may only be used when investigating intentional crimes punishable by a maximum prison term of more than three years, corruption, and intentional crimes that must be prosecuted under an international treaty. If the respective device is to be installed in a household, the list of crimes is even more limited and consists of felonies, corruption, abuse of authority of a public official, money laundering, and intentional crimes that must be prosecuted under an international treaty.
Interception and recording of telecommunications and of “data transferred in real time via a computer system” is only allowed when investigating felonies, corruption, extremism crimes, abuse of authority of a public official, money laundering, and intentional crimes that must be prosecuted under an international treaty, and only if other measures prove to be insufficient.

3. What kind of data, if any, could be collected with spyware?

The law does not regulate this issue. Section 2 par. 1 PAIA merely stipulates that “information-technical devices” shall be used for “obtaining the contents of messages transmitted over electronic communications networks, including the interception of telephone communications” and “making visual, audio, audio-visual or other recordings”.

4. Has there been any official evaluation of the need for, or added value of, spyware?

We are unaware of any official evaluation of the need for spyware.

5.Who authorises/approves measures of targeted surveillance in criminal and intelligence investigations (judiciary, executive, expert bodies, security services)?

Targeted surveillance must always be authorised by the competent court. Under Section 4a PAIA, the jurisdiction lies with the regional court in whose district the requesting state authority is located. The only exception concerns crimes within the competence of the Specialised Criminal Court.
Surveillance measures may only be used with the prior written consent of the lawful judge and the consent may only be granted for six months. The consent may be extended upon a new application, but each time only for another six months. There is no remedy against the court’s decision either granting or dismissing the application. The application must contain the reasons for the use of surveillance measures and especially must justify the ineffectiveness of other measures in attaining the legitimate aim (Section 4 PAIA).
Both the judge and the applicant authority must continuously examine the persistence of the reasons for the surveillance and if the reasons no longer apply, the surveillance must be immediately terminated (Section 4 par. 6 and Section 6 par. 1 PAIA).
The surveillance under the CPC may only be authorised by a judge. In urgent matter, a prosecutor may do so but a judge but confirm their decision within 24 hours. The court warrant authorising surveillance must be substantiated and may only be issued for six months, with the possibility of repeated prolongation for a maximum of two months in each instance. The court and the police unit carrying out the surveillance must continuously verify whetherthe reasons for surveillance persist and if they no longer apply, the surveillance must be terminated immediately.
If no relevant information has been uncovered, any recordings or their copies must be destroyed.

6. What are the national oversight mechanisms in place in your country for the activities of the security services (are they judicial, parliamentary, executive, or expert)? Do these bodies have (binding) remedial powers?

The National Council of the Slovak Republic (the parliament) exercises oversight, mainly via its special commission for the monitoring of the use of information-technical devices (Sections 8a and 9 PAIA).
The Commission has eight members, of whom one is its president, who must belong to the opposition.
The parliament selects six members from among the members of each of the three parliamentary committees involved: two members from the Special Monitoring Committee of the National Council of the Slovak Republic for the monitoring of the activities of the Slovak Information Service, two members from the Special Monitoring Committee of the National Council of the Slovak Republic for the monitoring of the activities of the Military Intelligence, and two members from the Committee of the National Council of the Slovak Republic for Defence and Security. Three members must be selected from among the majority’s deputies and three members from among the opposition deputies. The remaining two members may be non-parliamentarian citizens with relevant work experience defined in Section 8a PAIA and the highest level of security clearance. They are selected by the parliament upon proposal by the chairperson of the Defence and Security Committee.
The Commission must carry out inspection at least on an annual basis, but may do so at any time of its own motion and upon complaint by anyone who claims they have been subjected to unlawful surveillance.
The Commission’s powers are mostly of monitoring nature. Its members have the right to enter premises, access registers and obtain information, even if classified, from the relevant state authorities. The protocols of inspections carried out are then submitted to the relevant parliamentary committees.
Should the respective parliamentary committees suspect that surveillance has been carried out in violation of the law, they must inform the Speaker of Parliament, who then informs the Prosecutor General.
The parliament must discuss in plenary twice a year the reports of the committees on the state of use of surveillance measures. The reports submitted to the plenary must include any detected case of illegal use of surveillance methods. The reports must not reveal the identity of the persons under surveillance or otherwise violate their right to privacy.
It must be admitted that even though Section 8a PAIA regulating the Commission was introduced by a 2015 amendment, the Commission has still not been established in practice, mostly due to political disagreements.

7. Does a post-surveillance notification mechanism exist? Are there any other remedies available for individual targeted by measures of targeted surveillance?

Sections 114 and 115 CPC stipulate that if the surveillance has not helped uncover any relevant information, any recordings or their copies must be immediately destroyed. A protocol on the destruction is to be included in the case file. The persons concerned who do not have access to the file must be, within three years from the final decision in the criminal case, notified that they had been subjected to surveillance and that any recordings have been destroyed. They must be informed of the possibility to file with the Supreme Court a motion for review of the court warrant authorising the surveillance.
The notification duty does not apply in proceedings on particularly serious felonies or felonies committed by an organised group, criminal group or terrorist group, or where several persons participated in the commission of the criminal offence and, in relation to at least one of them, the criminal prosecution has not been concluded, or if the provision of such information could obstruct the purpose of the criminal proceedings.
However, no post-surveillance notification duty exists under the PAIA, which has been repeatedly criticised in the literature.
The affected persons may also file a constitutional complaint under Art. 127 of the Constitution. The constitutional complaint mechanism has recently proven essential in filling in a lacuna in the PAIA consisting in the fact that the regional courts exercising judicial review under PAIA have no power to specifically order the destruction of recordings obtained through illegal surveillance. This legislative omission was criticised by the European Court of Human Rights in its 2021 judgment in Zoltán Varga v. Slovakia (58361/12 et al.). In the recent 15 May 2024 judgment (III. ÚS 97/2012), the Constitutional Court specifically ordered – in this case – the Slovak Information Service to destroy any still existing recordings and other documents obtained through the illegal surveillance carried out in that case and to inform the complainant of their destruction.