The document discusses the procedural powers granted to states under the Cybercrime Convention from a human rights perspective. It notes that the convention's procedural powers restrict fundamental rights, but are subject to conditions and safeguards. Specifically, it outlines requirements from the European Convention on Human Rights that any restriction must be prescribed by law, pursue a legitimate aim, and be necessary in a democratic society. It also discusses safeguards like limiting the duration and scope of surveillance, independent authorization, and oversight to prevent arbitrary application and protect human rights in the use of investigative powers against cybercrime.

1. PROCEDURAL POWERS UNDER THE
CYBERCRIME CONVENTION FROM
THE (EUROPEAN) HUMAN RIGHTS
PERSPECTIVE
Marko Jurić
University of Zagreb
marko.juric@pravo.hr

2. Convention on Cybercrime
Budapest, 2001
Signed by Moldova in 2001, entered into force
in 2009

3. Scope of Cybercrime Convention
Substantive criminal law (criminal offences
to be established under domestic law)
Procedural law (six procedural powers to
be established under domestic law)
Rules on international co-operation

4. Convention on Cybercrime: Section 2
Art. 16: Expedited
preservation of
stored computer
data
Art. 17: Expedited
preservation and
partial disclosure
of traffic data
Art. 18:
Production order
Art. 19: Search
and seizure of
stored computer
data
Art. 20: Real-time
collection of traffic
data
Art. 21:
Interception of
content data
PROCEDURAL POWERS NECESSARY TO
DETECT, INVESTIGATE AND PROSECUTE
CYBERCRIME
Art. 15:
Conditions
and
safeguards
NECESSARY TO
SAFEGUARD HUMAN
RIGHTS & FREEDOMS

5. Procedural powers restrict fundamental
human rights and freedoms
1. Right to respect for private and family life, home and
correspondence [ECHR Article 8]
2. Right to freedom of expression [ECHR Article 10]
3. Right to freedom of assembly / association [ECHR Article 11]
4. ...

6. Procedural powers defined in Section 2 of the
CC are subject to conditions and safeguards
A. Relevant international human rights treaties, Art. 15(1)
B. Conditions and safeguards specified in the Cybercrime
Convention, Art. 15(2)

7. International human rights treaties
■ International law
– European Convention on Human Rights (ECHR)
– International Covenant on Civil and Political Rights
(ICCPR)
■ European Union law
– Charter of Fundamental Rights of the EU

8. Requirements under the ECHR and ICCPR
Restriction is prescribed by law (in
accordance with the rule of law)
Restriction pursues legitimate aim
Restriction is necessary in a democratic
society

9. Restriction pursues legitimate aim(s)
Prevention of crime
Protection of national security / public
safety
Protection of economic well-being of the
country

10. Restriction must be prescribed by law
There is a legal basis for a restriction in national law
National legal rules are accessible
National legal rules are precise and foreseeable
There are adequate safeguards against arbitrary
application of national law

11. Restriction must be necessary in a democratic
society
There is a pressing social
need for a restriction
Restriction is proportionate
to the aims pursued

12. Requirements under the Cybercrime
Convention, Art. 15(2)
(1) application of the principle of proportionality
(2) judicial or other independent supervision
(3) grounds justifying application
(4) limitation of the scope and the duration of such power or
procedure

13. Surveillance of communications –
ECtHR’s case-law
1. Klass and others v Germany
2. Weber and Saravia v Germany
3. Liberty and others v UK
4. Association for European Integration and Human Rights and Ekimdzhiev v
Bulgaria
5. Iordachi and Others v Moldova
6. Kennedy v UK
7. Zakharov v Russia
8. ...

14. Minimum safeguards according to the
ECtHR
■ nature of offences which may give rise to surveillacne
■ definition of the categories of people liable to have their communication
intercepted
■ limit on the duration of surveillance
■ procedure to be followed for examining, using and storing the data obtained
■ precautions to be taken when communicating the data to other parties
■ circumstances in which recordings may or must be erased or destroyed

15. Offences which may give rise to
interception order
Cybercrime convention: interception is applicable „in relation to a
range of serious offences to be determined by domestic law”
National law: measure to be used in relation to serious, very
serious or exceptionally serious offences, as defined in Criminal
Code
ECtHR: “more than one half of the offences provided for in the
Criminal Code fall within [these categories]”

16. Persons who are liable to have their
communications intercepted
National law: suspect, defendant or other
person involved in a criminal offence
ECtHR: “who exactly falls within the category
of “other person involved in a criminal
offence”?

17. Persons who are liable to have their
communications intercepted
National law: suspect, defendant or person „who
may have information about an offence, or other
information relevant to the case”
ECtHR: there are no clarifications in national
legislation or case-law as to how these terms are
to be applied in practice

18. Duration of a measure
Not necessary to provide strict statutory limitation of overall
duration of a measure
But, national legislation should prescribe:
- initial duration of a measure
- conditions under which an order can be renewed
- Obligation to discontinue measure when it is no longer
necessary

19. Obligation to destroy data
- in a reasonable time after the investigation, if person concerned was not charged
- if person was charged, state has wider margin of appreciation
- but, data which are not relevant for the purpose for which they have been
collected should be deleted immediately

20. Authorisation of a measure
■ Competent authority
– Court
– non-judicial authority, if it is sufficiently independent
■ Scope of review
– Verify the existence of factual basis necessary to authorize the measure
– Verify that necessity / proportionality requirement is satisfied
■ Content of the authorisation order must identify
– Specific person, or
– Single set of premises

21. Direct access to communications
System which enables authorities to intercept
communications directly... without requiring them to show
an interception authorization to service provider, or anyone
else, is particularly prone to abuse...

22. Supervision
1. Supervisory body must be independent of authorities carrying out the measure
2. Must have sufficient powers and competences to exercise effective and
continuous control

23. Thank you!
marko.juric@pravo.hr