I. Introduction

The digitalisation of every aspect of our lives is a driving force for change in contemporary society, impacting all areas. This article examines the extent to which digitalisation is being properly “steered” by our legal systems. This is done from the perspective of procedural safeguards in criminal proceedings, which must revolve around human dignity and the protection of fundamental rights. The issue is becoming increasingly relevant – and urgent – in light of the populist and autocratic tendencies in many legal orders previously considered to be firmly committed to the principles of the rule of law.

The following sections will analyse some of the problems and tensions that contemporary criminal proceedings face in the digital era. This analysis will help us rethink the future of criminal procedure in a “digitalised” world and explore how we can continue to safeguard individuals against the State’s increasingly all-embracing power. I will not address the – albeit highly relevant – topics of the use of technology in general and the rules on electronic evidence or videoconferencing. The aim of this article is rather to draw attention to the ways in which information and communication technologies – particularly the State’s capacity for mass surveillance, which is set in motion long before criminal proceedings formally commence – are already transforming the structure and functions of criminal proceedings.¹

Two factors require us to reconsider the safeguards of the criminal justice system. The first factor concerns “persons of interest” who are subject to certain surveillance measures that may affect their right to privacy and their right to data protection. As they are not suspects in a criminal investigation and no criminal proceedings have been formally initiated, however, the corresponding safeguards do not apply. Still, it is evident that their situation is not comparable to that of an ordinary citizen who is outside the attention of security systems. Finding the appropriate balance between protecting individuals from the State and allowing the identification of risks that may significantly impact their liberty and privacy is difficult.² In parallel, data acquired through surveillance measures may be used in the criminal proceedings to trigger suspicion and investigative measures or even as evidence.

The second factor is the enormous expansion of surveillance possibilities through digital technologies and sophisticated software using artificial intelligence and, in the near future, quantum computing. These developments are changing the scope of preventive and predictive surveillance, as the information gathering of the “pre-digital age” – through informants, police surveillance, or the interception of communications by intelligence services – becomes less relevant.³

In this context, the role of large tech companies cannot be overlooked — not only because of their capacity to interfere with our right to privacy, but also because, they are becoming necessary “partners” of law enforcement authorities in criminal investigations through their management of our data.⁴

Without aspiring to find answers to all emerging questions of this digital revolution, in the following sections, I will highlight the need to redefine procedural safeguards in a digitalised context, namely where the fields of prevention and prosecution have become increasingly blurred. As it stands, AI tools are enabling the processing of vast amounts of data, which could affect both the initiation and the outcome of a criminal proceeding. To set the scene, I will first outline the current approaches of the European Court of Human Rights (ECtHR) and the Court of Justice of the EU (CJEU) regarding mass surveillance and access to bulk data without prior suspicion of an individual (Section II). Second, I will identify the main challenges for the criminal proceedings in the digital environment(Section III). Finally, I will draw conclusions for the future of procedural safeguards in the European Union (Section IV).

II. Intelligence, Prevention, and the Bulk Interception of Communications — From Big Brother Watch to EncroChat

The scenario described in the introduction raises several questions concerning the definition of suspects’ rights in national codes of criminal procedure, also considering that only a minimum level of harmonisation at the EU level has been achieved through the procedural rights directives. Should we consider defining and regulating rights of individuals who are classified as persons of interest or “pre-suspects”? Do the safeguards provided by the data protection and data retention rules adequately protect citizens’ rights? Should a new level of safeguards be introduced for these individuals to ensure that data collected for security purposes is not used for criminal prosecution? Should additional safeguards beyond those foreseen in criminal proceedings be required for the processing of data obtained through bulk surveillance?

The case law of the ECtHR (1. below) provides some guidance to these questions, even though the ECtHR has generally left the neuralgic issue of the admissibility of evidence in cases of procedural rights violations up to the national laws. The CJEU has also established some building blocks (2. below) and, in contrast to the ECtHR, even introduced some relevant criteria on the admissibility of digital evidence.

1. The case law of the ECtHR

The ECtHR established in numerous judgments the minimum standards of rights that must be guaranteed to individuals in the context of the protection of national security. Since Klass and Others v. Germany,⁵ the ECtHR’s approach has focused on the safeguards that must accompany methods of secret surveillance (covert surveillance), as well as how each of those investigative activities is recorded. The requirements relating to the interception of communications involving mass surveillance were defined in Szabó and Vissy v. Hungary,⁶ Weber and Saravia v. Germany,⁷ and Zakharov v. Russia,⁸ but the Court has rarely assessed whether a situation affects national security. It has, however, stated that the protection of national security must always be weighed against the seriousness of the intrusion into the individual right to respect for private life.

a) The Big Brother Watch case

The opportunity to analyse mass surveillance measures and the right to privacy was given in the 10 Human Rights Organizations v. United Kingdom case,⁹ better known as the Big Brother Watch case. The applicants specifically argued that Art. 8 of the UK Regulation of Investigatory Powers Act (RIPA) 2000, which allowed the surveillance of bulk interceptions (through programmes such as KARMA POLICE, Black Hole, TEMPORA, etc.), did not comply with the standards set out in the ECtHR’s previous case law.¹⁰

In its analysis of the Big Brother Watch case, the Court reiterated: ¹¹

(…) the lawfulness of the interference is closely related to the question whether the ‘necessity’ test has been complied with and it is therefore appropriate for the Court to address jointly the ‘in accordance with the law’ and ‘necessity’ requirements.

However, the Court did not merely invoke its earlier case law on bulk interceptions, but also assessed whether that case law from ten years earlier was still applicable to the present digital environment.¹² The Court concluded that a new approach was required, as not all the safeguards for interceptions directed against specific persons are applicable in the case of bulk interceptions, for example the requirement of probable cause.¹³

Before analysing the specific safeguards that must be adopted for the bulk interception of communications, the Court outlined the different stages of this measure: (1) the initial search for information, which takes place for the most part in an automated manner; (2) the application of selectors; (3) the analyst’s initial examination of the material resulting from the search, following the application of the selectors; and (4) the use of the intercepted material. It then specified that control mechanisms and effective safeguards must be present at each stage.

According to the Court, “the process must be subject to ‘end-to-end safeguards’, meaning that, at the domestic level, an assessment should be made at each stage of the process of the necessity and proportionality of the measures being taken.”¹⁴ The Court paid particular attention to the aforementioned second stage, the “application of selectors,” as this stage is especially sensitive, since the choice of selectors may trigger the interception against individual persons.¹⁵ It confirmed that states can use measures for the bulk interception of communications and that each member state must delimit the scope of application, depending on their needs assessment in terms of national security.

In contrast to the Grand Chamber majority, not all of the judges were convinced by the argument that information obtained through bulk interception would have no evidential impact. As expressed in the joint, partly concurring opinion:¹⁶

It appears that on the basis of the information thus obtained, law enforcement agencies could act, for example, by proceeding to conduct investigative measures or even arrests, this in turn producing evidence for the purpose of prosecution. It is likely that in a not so distant future, by exploring this particular ground, crime investigation might move from targeted surveillance to bulk interception of data.

This statement can only be endorsed, as evidenced by the rapid development of AI tools since this judgment was issued.

b) Subsequent case law

The ECtHR has subsequently ruled in several cases on the extent to which systems for the interception of communications, whether preventive in nature or operated by intelligence services, comply with the ECHR, specifically the right to respect for private life recognised in Art. 8 ECHR. In the judgment in Ekimdzhiev and Others v. Bulgaria,¹⁷ the Court held that there had been a violation of Art. 8 ECHR due to the lack of adequate legal provisions ensuring that secret surveillance — and the subsequent system for the retention of and access to the intercepted communications — was limited to what was strictly necessary.

In Haščák v. Slovakia,¹⁸ the Court found a violation of Art. 8 ECHR due to the lack of safeguards against arbitrary interferences, as required by the principles of the rule of law, and the fact that the retention of the intercepted communications had not been subject to external supervision.

Similarly, in Pietrzak and Bychawska-Siniarska v. Poland,¹⁹ involving surveillance measures adopted preventively under Poland’s anti-terrorism legislation, the ECtHR confirmed a violation of Art. 8 ECHR, due to the lack of adequate supervision of communications monitoring carried out under anti-terrorism legislation.

c) The ByLock case

Another important case is the Yüksel Yalçinkaya v. Turkey case,²⁰ also known as the ByLock case or the “Turkish EncroChat”. The case concerned the use of evidence that was obtained from access to an encrypted communication system, questioning the admissibility of evidence and its conformity with Arts. 6 and 8 ECHR. The applicant alleged that the lack of judicial control over the obtaining and processing of data from the ByLock platform made it impossible to verify the authenticity and integrity of those electronic communications. Despite this evidence having been decisive and incriminating, the defence was unable to challenge its reliability, authenticity, and lawfulness.

The ECtHR first reiterated its general doctrine on the admissibility of evidence, i.e., that the assessment of evidence is essentially a matter for the national courts and that the Court’s role is limited to reviewing whether that assessment is unreasonable or arbitrary, since the ECtHR is not a fourth instance. The reasoning of the national judgment should shed light on these matters. Regarding the use of the encrypted communication system, in this case, the ECtHR stated that the mere downloading or using such a system, or even the use of any other method to safeguard the private nature of the messages exchanged, neither constitutes a criminal offence in itself (in this case membership of a terrorist organisation), nor can it be considered an evidential element capable of convincing an objective observer that unlawful activity or even a criminal offence is being committed.²¹

Having analysed the manner in which the evidence had been obtained, the safeguards adopted in respect of the integrity and authenticity of the evidence, and the response to the accused’s appeals, the ECtHR concluded that Art. 6(1) ECHR had been violated. The Strasbourg Court did not call into question the legitimacy of access to the ByLock platform. On the contrary, it stated: ²²

The use of electronic evidence showing that an individual is using an encrypted messaging system that has been specifically designed and used exclusively by a criminal organisation in the internal communications of a criminal organisation may be very important in the fight against organised crime.

The Court recognised that the use and assessment of electronic evidence in criminal proceedings may entail specific difficulties for judges, due to its complexity, which may affect the ability of national courts to decide on its authenticity, accuracy and integrity. It also stated that, in criminal proceedings, national courts may increasingly rely on electronic data or other data gathered by intelligence services, whose activities in this respect may or may not be subject to the rules governing the obtaining of evidence within criminal proceedings.²³

The ECtHR also held, however, that the right of access to the sources of evidence — and therefore the right to comment effectively on them — is not an absolute right and may be subject to limitations.²⁴ Therefore, it took into consideration whether the applicant’s lack of access to the sources of evidence had been counterbalanced by adequate procedural safeguards and whether he had been given a proper opportunity to prepare his defence.²⁵ It is important to emphasise that the ECtHR does not call into question the use of intelligence information as evidence, leaving this matter to national legislation.

2. The bulk interception of communications and the EncroChat case at the CJEU

In the field of transnational evidence gathering and the admissibility of evidence obtained through the bulk interception of communications in the European Union (EU), perhaps no case has had greater resonance as the EncroChat case, on which the CJEU ruled on 30 April 2024.²⁶

To briefly recall the facts of the case:²⁷ In the context of an investigation conducted by French law enforcement authorities, it emerged that some individuals under criminal investigation were using encrypted mobile phones operating under a licence called “EncroChat”. The Lille magistrate authorised the use of a “Trojan horse” to access the entire messaging platform Specifically, the initial partial decryption of 3477 text files created as “notes” revealed that almost all of them were related to communications connected with criminal activities perpetrated by criminal organisations. The intercepted material was then distributed among the Member States for use in their own criminal investigations.

I will consider the case as establishing certain principles to be observed with regard to procedural safeguards in criminal proceedings having a transnational dimension and involving electronic data and access to encrypted communication platforms in the Union.²⁸

It may be argued that, strictly speaking, the case did not involve bulk surveillance, since access to the encrypted data was not carried out under a national security or intelligence scheme. Accessing the communications of users of the platform against whom no prior suspicion had been established, however, allows us to draw analogies with surveillance measures for preventive purposes and to approach the Encrochat case as if it were another bulk interception of communications. In this context, the CJEU had to deal with an unprecedented issue as to the use of non-targeted accessed communications as evidence in criminal proceedings and the rights of defence in cross-border digital environments.

Here, the Court in Luxembourg followed the criterion already adopted in the Strasbourg Court’s case law²⁹ as well as in its own case law on data retention,³⁰ holding as follows:³¹

As regards specifically the right to a fair trial, it must be noted in particular that if a court takes the view that a party is not in a position to comment effectively on a piece of evidence that is likely to have a preponderant influence on the findings of fact, that court must find an infringement of the right to a fair trial and exclude that evidence in order to avoid such an Infringement.

Interestingly, while the CJEU mentioned the lack of specific knowledge in digital matters on the part of the trial court as a factor to be taken into account when assessing defence rights in data retention case law, this was omitted in the ruling in the EncroChat judgment. Nevertheless, in defining the defence rights, the CJEU goes beyond the standards set out by the ECtHR in the ByLock case, in which the latter held that the right to comment effectively on digital evidence is not absolute. Furthermore, the CJEU ruled on the admissibility of evidence, by contrast to the ECtHR, which does not enter into establishing exclusionary rules of evidence, but analyses the case mainly from the fair trial rights’ perspective (see also above 1.).

It remains to be seen how national courts interpret this rationale for inadmissibility of evidence, as defined by the CJEU. In the context of electronic evidence, the rights of the defence revolve around the ability to verify the lawfulness, authenticity, integrity, and proportionality of the evidence.

It follows that several questions arise: How can the integrity of the data be verified if access to the data in its entirety is not possible? Would the right to comment effectively imply a right of access to the raw data? How can the defence comment on bulk electronic data if sophisticated software is required to do so? Should data sifting always be done in the presence of the defence, as it is required for the cross-examination of witnesses? Does the state have to inform the defence about which AI tool was used to collect, process, and filter data?³² Is there a need in the areas of freedom, security and justice for the EU Member States to always use a certified AI system? Should this be the same in all Member States?

3. Interim conclusion

As can be seen, both the ECtHR's case law and the CJEU's decision in Encrochat have already established a number of standards regarding bulk surveillance and bulk access to data. However, neither has defined which information gathered in this way can be used in criminal proceedings. While ECtHR and CJEU case law provide some guidance on the use of bulk surveillance and emphasise the need to ensure fair trial rights when encrypted messaging platforms are accessed, they do not prevent bulk data intercepted without prior identification of a suspect from flowing into criminal proceedings. On the one hand, the ECtHR expressly refrains from setting any standards on the admissibility of evidence in this context; on the other hand, the CJEU only establishes the need to ensure the possibility of “effective comment” on evidence obtained from a “suspected” platform. The question is whether these general standards are sufficient to ensure, in a digital context, not only the protection of privacy rights, but also that information gathered for preventive purposes and/or without suspicion does not become incriminating evidence. Should procedural safeguards be activated earlier, given that the rules on evidence seem to offer only limited protection against state interference in individuals' privacy rights via bulk surveillance?

III. Prevention, Mass Surveillance, and Open Data Analysis: The Challenges for Criminal Proceedings

The gathering and processing of information for security purposes (what is usually understood as intelligence) is not only a necessary and useful task but also indispensable if action is to be taken effectively against criminal phenomena in general, and organised crime, terrorism, money laundering, and environmental crime in particular.³³ However, given the scale of information gathering and the technological possibilities of mass surveillance, we should question whether an alternative or additional system for the prevention and/or prosecution of crime is being introduced surreptitiously, permeating procedural structures without an adequate and transparent legal framework and effective procedural safeguards.1. “Persons of interest” and the changing rules of the game to open criminal proceedings

As has been widely pointed out, the boundaries between prevention and repression have become increasingly blurred in many areas, especially, but not only, in the fields of terrorism and organised crime. The reason for this is because criminal law has increasingly moved from repression to prevention³⁴ on the one hand and, on the other, measures of administrative law tend to acquire a punitive character.³⁵ This impacts not only fundamental rights, but also the very conception of criminal proceedings. The use of extensive preventive measures³⁶ has also led to the emergence of a new category of individuals who are not classified as suspects for the purposes of criminal proceedings, but who are identified as “persons of interest” or “pre-suspects” by algorithm-based mass surveillance systems.³⁷

Classifying individuals as “persons of interest” based on their potential risk of committing criminal offences and subjecting them to continuous surveillance not only turns them into sources of information but also into objects of evidence, insofar as the data obtained from surveillance could acquire evidential value. Bulk data analysis can be initiated without the need to establish specific suspicions against particular individuals before a judge.³⁸ In many cases, a mere risk assessment is sufficient, and this assessment is regularly carried out by means of an algorithm.³⁹ In short, law enforcement authorities can access or purchase data analyses from companies that have the appropriate software to draw up not only profiles of potential risks, but, in particular, also profiles of those persons who represent a risk or who may directly be classified as criminal suspects. Thus, automated suspicion algorithms (ASAs) have come to increasingly replace informants and traditional police surveillance, while multiplying their reach exponentially. However, judges who must assess suspicions based on those ASAs within the criminal proceedings do not have clear criteria for determining their reliability.⁴⁰

The consequence of all this is that the prerequisites for opening a criminal investigation may be completely altered by the new “rules of the game”, because a thorough risk assessment can be carried out through the bulk analysis of data. This would then underpin the standard of probable cause required to open criminal proceedings. In short, it is worrying that an intrusive investigation can be initiated on the basis of the bulk processing of data for security purposes, without prior suspicion, since these surveillance measures only concern “persons of interest.”⁴¹ The joint, concurring opinion on the ECtHR Big Brother Watch judgment (II.1.a above) indirectly pointed out this risk, which is dramatically increased by the development of AI tools.

I neither contend that this is generally the case, nor that law enforcement or intelligence services are acting outside the law. However, even if we accept this premise and that these activities are carried out within legal limits — and I am not aware of any data contradicting this —, the truth is that any surveillance system lacking transparency and not being public must be subject to a rigorous oversight. It must be borne in mind that the bulk interception of communications and the retention of the data thus obtained constitute a significant interference with the right to privacy, even when the data are in fact not analysed.⁴² Naturally, the risks are even greater when certain persons become surveillance targets owing to the selectors applied and the content of their communications is monitored and analysed. In Big Brother Watch, the ECtHR underlined the importance of oversight at all stages of the “surveillance procedure” (end-to-end safeguards), specifically highlighting oversight in the application of selectors (see II.1.a above).

The usefulness of bulk interception for security operations is scarcely disputed, and a proactive approach towards identifying threats to national security is regarded as a legitimate and reasonable aim. There are, however, two basic elements that clearly differentiate the levels of safeguards in criminal proceedings and in the preventive system aimed at security: In the field of criminal proceedings, there exists the requirement of prior suspicion and, usually, of a judicial warrant before investigative measures entailing an intrusion into fundamental rights can be taken; this warrant includes prior checking of the necessity and proportionality of the interference. In the case of non-targeted surveillance, the approach differs from the aforementioned criminal procedure scheme, since there is no initial judicial decision based on prior suspicions against specific individuals, simply because there is no specific target or suspect.⁴³ The risk of circumventing the safeguards of criminal proceedings seems to be clear.

While the case law of the ECtHR stresses the importance of oversight at all stages, it does not prevent the information gathered for security purposes to flow into criminal proceedings. Yet, the CJEU does not ban access to large amounts of data without prior suspicion against an identified suspect, as seen in the Encrochat case. This shows that, even if we can already count on a number of standards from the ECtHR and CJEU, the issue of implementing procedural safeguards in a digitalised surveillance environment has not yet been addressed.

2. Mass surveillance and criminal evidence standard

It could be argued that mass surveillance is not intended to gather evidence for criminal investigation purposes, since its focus is on prevention. But does this mean that the principle of respect for privacy does not apply? If these data are the basis for obtaining evidence (having established a “reasonable suspicion” for a judicial warrant in order to initiate investigative measures), as outlined under 1. above, are we not caught in a vicious circle?

The fact that certain countries already use ASAs underpins these risks. As a result, criminal proceedings are no longer the place where facts and criminal liability are established, because, according to the algorithm used, data have already been collected against a “person of interest” and the next step is merely to present this data set as evidence. The evidence then secures the criminal conviction of an individual or, as a simpler solution, a plea agreement.⁴⁴ This phenomenon can be observed in criminal justice systems in which trials are slowly losing their previous importance and becoming the exception rather than the rule.⁴⁵

This handling of evidence necessitates reconsideration of the system of procedural safeguards centered on the liberal model and, specifically, on the principle of a public and oral trial hearings, i.e., the moment at which adversarial proceedings reach their fullest expression in the taking of evidence. In order to solve the problem of using data from bulk interceptions as criminal evidence, the correct approach should be to reinforce the safeguarding prerequisites that may give rise to the opening of a criminal investigation against a specific person in the first place. We should rethink the role of “rational indications,” “well-grounded suspicions,” or “probable cause” (the term used in the Fourth Amendment of the United States Constitution).⁴⁶ Indeed, the term “probable cause” is ambiguous and as yet undefined, referring to a calculation of probabilities/to a non-quantitative or statistical probability that moves within a variable range.

The requirement of probable cause should become the decisive criterion when authorising access to and seizure of electronic data. In this context, it should not be overlooked, however, that the activation of an algorithm to identify or compile data by means of bulk processing could generate indications or suspicion criteria in respect of practically any individual. This could mitigate the normative and conceptual uncertainty of the probable cause standard and serve as the basis for initiating criminal proceedings, as well as for adopting criminal investigative measures that restrict fundamental rights (though they must still be subject to the additional criteria of necessity, suitability and proportionality).

In other words, if we wish to continue maintaining the traditional safeguards of criminal proceedings, the standard for activating investigative measures based on the processing of big data or for indiscriminately accessing retained user data, must be strengthened. It is worth noting here that the standard of probable cause “may not ultimately address any one right specifically, but instead protect all of liberty generally,”⁴⁷ thus safeguarding the rule of law principle.

We could still hope that the exclusionary rule of evidence would apply to data obtained prior to criminal proceedings or that evidence obtained solely on the basis of “reasonable suspicion” arising from mass surveillance would be declared invalid. This would be the procedural safeguard that governs the use of bulk data as evidence in criminal proceedings. However, this approach cannot be taken for granted. Since the risk entailed is that it would suffice to confront the accused with all the data available to the prosecution to persuade the defendant to accept the conviction upon a plea agreement, without validity of the evidence never being assessed at trial.

IV. Concluding Remarks

A number of conclusions can be drawn from the discussion of the above-mentioned challenges:

Firstly, and perhaps most importantly, there is a need to continue the struggle for procedural safeguards in a digitalised world. Secondly, the prerequisites that allow the state to access and process citizens’ data for preventive purposes need to be redefined. Thirdly, stricter control is also required over the application of the probable cause or “reasonable suspicion” requirement, as it could become the only way to prevent a criminal investigation from being opened and, subsequently, from turning any data already obtained into incriminating evidence. In a system that is primarily focused on prevention and technology, the defence can only assert its right to “comment effectively” on the evidence thus obtained.⁴⁸

As the ECtHR held in ByLock, the right to effectively respond to the evidence obtained does not, however, necessarily include the right to review the integrity of the intercepted data or to have knowledge of the software used to access the communications. Any effort to strengthen the rights of the defence must include effective access to digital tools (knowledge of how the data was processed) and appropriate software (ability to analyse the raw data) in order to ensure the equality of arms. Otherwise, it will be impossible to comply with the adversarial principle as means of establishing facts in criminal proceedings.⁴⁹

In any event, requiring prior suspicion as a prerequisite for taking notably intrusive measures into the citizens’ sphere of privacy does not appear to protect us against mass surveillance. This became readily apparent in the EncroChat case, when national courts accepted the intercepted communications as evidence against individuals despite there being no prior grounds for suspicion. It might be considered to revisit the standard of probable cause against the new digital reality and the resorting to data brokers for establishing ASAs.

In the EU, some progress has been made in protecting the rights of individuals facing criminal proceedings. The procedural rights directives adopted so far indicate that the European legislature has taken an increasingly progressive interest in establishing a framework of procedural safeguards. Yet, we must press on, as artificial intelligence and, in the near future, quantum computing usher in a new digital reality, bringing with it new challenges for criminal procedure. The time seems to be is ripe to articulate a new framework of procedural safeguards at the European level to cope with the increasing digitalisation of law enforcement.