This is an old revision of the document!
Table of Contents
Data and surveillance
As of 30 September 2026.
Overview
This subject area concerns the protection of privacy and personal data against State surveillance and the rules governing cross-border data flows. At the universal level, Art. 17 ICCPR protects against arbitrary or unlawful interference with privacy and correspondence; since 2013 the UN General Assembly has affirmed in its resolutions on “the right to privacy in the digital age” that the rights people have offline must also be protected online. In the European Union, the Charter of Fundamental Rights and the GDPR set the standard against which access to transferred data by foreign intelligence services is assessed, as in Schrems II. Cybercrime treaties add investigative powers and cooperation in obtaining electronic evidence, each with its own safeguards. Surveillance capabilities and data access are recurring points of friction and of cooperation between States.
Main points of debate
- Extraterritorial reach. How far a State's obligations under Art. 2(1) ICCPR extend to surveillance of persons outside its territory is discussed.
- Intelligence access. In Schrems II the Court of Justice found that certain US surveillance programmes were not limited to what is strictly necessary; the subsequent EU-US Data Privacy Framework has again been challenged before the EU courts.
- Law enforcement access. States and human rights organisations assess differently whether the safeguards in the Budapest Convention, its Second Additional Protocol and the UN Convention against Cybercrime are adequate.
- Data governance. How the non-binding commitments of the Global Digital Compact on data relate to regional regimes is open.
Entries
- International Covenant on Civil and Political Rights (1966) – right to privacy (Art. 17).
- CJEU, Schrems II (2020) – intelligence access to data transferred from the EU.
- Budapest Convention on Cybercrime (2001) – procedural powers and cross-border evidence.
- UN Convention against Cybercrime (2024) – procedural measures and safeguards.
- Global Digital Compact (2024) – data governance commitments.
- Council of Europe Framework Convention on AI (2024) – privacy in the lifecycle of AI systems.