ĆALOVIĆ v. MONTENEGRO
Inadmissible
Julia Laffranque;Nebojša Vučinić;Paul Lemmens;Robert Spano;Stéphanie Mourou-Vikström
1. The applicant, Ms Vanja Ćalović, is a Montenegrin national who was born in 1978 and lives in Podgorica. She is an executive director of MANS, a Montenegrin NGO. Its avowed aim is, inter alia, “to increase the transparency and responsibility of institutions and improve the civil control thereof”. The applicant was represented by Mr V. Radulović, a lawyer practising in Podgorica. 2. The Montenegrin Government (“the Government”) were represented by their Agent, Mrs V. Pavličić. 3. The facts of the case, as submitted by the parties, may be summarised as follows. 4. On 4 September 2006 the Government adopted an Action Plan for the Fight against Corruption and Organised Crime (“the Action Plan”). The Action Plan, inter alia, provided for “ensuring connection to the databases of telecommunication services providers for the purposes of collecting data, in accordance with police powers (ovlašćenjima) as provided for by the Criminal Procedure Code”. 5. On 27 September 2007, in accordance with this Action Plan, the Montenegro police (Uprava policije Crne Gore) concluded an agreement with M-tel, one of the telecommunication providers operating in Montenegro, which allowed them direct and uncontrolled access to M-tel’s entire database through an adequate interface “whenever possible and necessary”, including access to lists of all calls and their duration, messages, location, date, and time. 6. On 2 July 2008 the applicant, who was subscribed to M-tel’s services, filed a constitutional appeal with the Constitutional Court. She maintained that the police could obtain all the information on her telephone calls without any judicial control; that the police could directly access the computer network and database of mobile telephone operators; and that the scope of the police authority was unknown, given that the agreement was classified as “top secret” (strogo povjerljivo). In doing so, she relied on, inter alia, Article 8 of the Convention and the relevant case-law of the Court. 7. On 24 June 2010 the Constitutional Court rejected the applicant’s constitutional appeal as inadmissible, as it had not been lodged against any individual decision relating to her own rights. The decision was served on the applicant on 13 September 2010. 8. On 5 April 2016 the application was communicated to the respondent Government. In their observations dated 26 July 2016 the Government informed the Court of the following. 9. On 21 January 2011 the Data Protection Agency (“the Agency”) carried out an inspection at M-tel of its own motion. In a report of 4 February 2011 the Agency stated that the impugned agreement, concluded on the basis of Article 230 of the Criminal Procedure Code 2003 in force at the time (see paragraph 23 below), was contrary to certain sections of the Data Protection Act. 10. On 28 March 2011 the Agency, acting upon an objection by M-tel to the previous report, issued a decision ordering M-tel to discontinue providing data contrary to the Data Protection Act, a decision which was upheld by the Agency’s Council on 20 April 2011. The Agency’s Council also cited Article 8 of the Convention and some of the Court’s case-law in its decision, such as Malone v. the United Kingdom (2 August 1984, Series A no. 82), and Copland v. the United Kingdom (no. 62617/00, ECHR 2007I). None of the parties initiated a further administrative dispute before the Administrative Court. 11. On 17 April 2011 M-tel deactivated the login by which the police could access its data. 12. On 14 June 2011 the Agency carried out an inspection at the police offices. In a report of 20 June 2011 it stated that no irregularities had been found. In particular, M-tel had complied with the Agency’s decision and had deactivated the interface through which the police had direct access to its data. 13. Between an unspecified date in 2010 and 30 June 2016 the Agency received 106 protection requests, in relation to which it issued twenty decisions, eight of which were in favour of those who had submitted the requests. Apparently, in the remaining eighty-six cases, the Agency issued reports with recommendations which were complied with, thus no separate decision was necessary, and the proceedings were consequently terminated. 14. On an unspecified date the applicant and two of her colleagues instituted civil proceedings, seeking that the impugned agreement be declared null and void. They did not seek compensation. 15. On 19 July 2013 the Court of First Instance (Osnovni sud) in Podgorica ruled in favour of the applicant and her colleagues. It found that the agreement was contrary to, inter alia, Article 8 of the Convention and the Court’s case-law, and was thus null and void. The court analysed the agreement in detail and found that it had enabled the police to obtain direct and unrestricted access and recover all of M-tel’s data, without defining the scope of those measures or the method of their implementation, or against whom those measures could be applied or for which reasons. All of this, in the court’s opinion, represented an interference with citizens’ privacy and was not necessary within the meaning of Article 8 § 2 of the Convention. It also found that the provider’s clients had no means of establishing if any measures were in place or had been applied in the past in respect of them, nor did they have any “effective control” at their disposal, which also represented a violation of Article 8. The court cited Niemietz v. Germany (16 December 1992, Series A no. 251B); Halford v. the United Kingdom (25 June 1997, Reports of Judgments and Decisions 1997III); Lambert v. France (24 August 1998, Reports of Judgments and Decisions 1998V); and Malone (cited above). 16. That judgment became final on 5 August 2013. 17. On an unspecified date in 2011 the applicant and twenty-four colleagues filed a compensation claim against the police in relation to having their electronic communication put under surveillance in connection with the publication of a certain video on YouTube. 18. On 16 October 2014 the Court of First Instance in Podgorica ruled in their favour and awarded them 1,500 euros (EUR) each under section 207 of the Obligations Act (see paragraph 25 below). The court found that, on the basis of all the evidence, there was a reasonable probability that the communications of the applicant and her colleagues over the internet had been put under police surveillance for the purposes of identifying an IP address from which the said video had been put on YouTube, and that the applicant and her colleagues had never obtained the data thereby collected, even though they had explicitly asked for it. The court held that, even if the police action had been lawful, it did not meet the criterion of necessity in Article 8 § 2. It found a violation of Article 8 of the Convention and relied on the Court’s case-law, notably Gaskin v. the United Kingdom (7 July 1989, Series A no. 160), and Niemietz, Copland, and Halford (all three cited above). 19. On 2 March 2015 the High Court (Viši sud) in Podgorica reduced the damages awarded to EUR 500 each and upheld the remainder of the previous judgment. 20. On 2 July 2008 and 25 November 2011 MANS filed proposals for the assessment of the constitutionality of Article 230 of the Criminal Procedure Code 2003 and Article 257 § 2 of the Criminal Procedure Code 2009 (see paragraphs 23 and 24 below). 21. On 18 July 2013 and 23 July 2014 the Constitutional Court found the relevant part of those Articles unconstitutional and contrary to Article 8 of the Convention, namely the part which enabled the police to ask a telecommunication provider “to check if telecommunication addresses which established a connection at a certain time [were] identical” (see paragraph 23 below). In doing so, the Constitutional Court cited the Court’s case-law, such as Rotaru v. Romania [GC] (no. 28341/95, ECHR 2000V); Klass and Others v. Germany (6 September 1978, Series A no. 28); Kruslin v. France (24 April 1990, Series A no. 176A); Malone; and Copland (both cited above). 22. In accordance with this Act, a person who believes that his or her rights under this Act have been violated can file a request for protection with the Agency, an independent supervisory body, which has to make a decision on the request within sixty days (section 47(1) and (2), and sections 49-50). Those who collect, store, change, use, publish, erase or destroy information will be responsible for any damage caused by a violation of the rights provided for by this Act, in accordance with the general rules on compensation (sections 4a, 9 and 48). The Agency carries out an inspection (nadzor) of its own motion, but anybody else can also file a proposal for an inspection (section 65). 23. Article 230 provided, inter alia, that if there was a reasonable suspicion that a criminal offence prosecuted ex officio had been committed, the police had a duty to implement the necessary measures in order to find the perpetrator, ensure that the perpetrator or an accomplice did not flee or hide, uncover and secure the traces of the criminal offence and objects which could serve as evidence, and collect all the information which could be useful in criminal proceedings. Paragraph 2 of the same Article provided that, in order to fulfill their duties under paragraph 1, the police could ask a telecommunication services provider to “check if telecommunication addresses which established a connection at a certain time [were] identical” (zatraži provjeru identičnosti telekomunikacijskih adresa koje su u određenom vremenu uspostavile vezu). No court order was needed in this regard. 24. This Code entered into force on 1 September 2011 and thereby repealed the previous Code (except for Chapter XXIX, which is not relevant to the present case). The relevant part of Article 257 § 2 corresponded to Article 230 § 2 of the previous Code. 25. Section 151(1) provides that anyone is entitled to ask a court or another competent body to order the termination (prestanak) of an action violating his or her personal integrity, personal and family life and other personal rights (prava njegove ličnosti). Section 166(1) provides that a legal entity, including the State, is liable for any damage caused by one of “its bodies”. Sections 206-207 provide that anyone who has suffered fear, physical pain or mental anguish as a consequence of a breach of personal rights (prava ličnosti) is entitled to sue for financial compensation in the civil courts and, in addition, to request other forms of redress “which might be capable” of affording adequate non-pecuniary relief. This Act entered into force on 15 August 2008. 26. Between 6 June 2013 and 2 October 2015 the High Court in Podgorica issued four judgments (Gž.br. 2182/13, Gž.br. 3884/13, Gž.br. 4669/14 and Gž.br. 4259/15-12) awarding damages to various plaintiffs for violations of their reputation, honour and personal rights (see paragraph 25 above). Two of the judgments were against the State, one against the city of Podgorica and one against a private person.