Legal Basis

The declaration states that access to data by the government is provided for and regulated by the country’s legal framework. Additionally, it is binding on government authorities and adopted and implemented by democratically established institutions operating under the rule of law. This legal framework sets out purposes, conditions, limitations, and safeguards concerning government access, to provide individuals with sufficient guarantees against the risk of misuse and abuse of their data.

Legitimate Aims

Government access must be carried out in a manner that is not excessive concerning its legitimate aims and must comply with necessity, proportionality, and reasonableness principles. Meaning access cannot be used for purposes such as suppressing criticism or dissent or disadvantaging persons or groups solely based on protected characteristics etc.

Approvals

The legal frameworks establish prior approval requirements. It also outlines the procedure for seeking and granting approval for government access. These requirements are commensurate with the degree of interference with privacy and other human rights and freedoms. Stricter standards are imposed for severe interference or emergency exceptions, which the legal frameworks strictly define. Emergency exceptions to approval requirements are also provided for in the legal framework; they must be clearly defined and include justifications, conditions and duration. Decisions on approvals are “appropriately documented” and “made objectively, on a factual basis in pursuit of a specified and legitimate aim and upon satisfaction that the approval requirements are met”. Where approvals are not required, the declaration states that other safeguards in the legal framework are applicable to protect against misuse and abuse, including “clear rules that impose conditions or limitations on the access, as well as effective oversight”.

Data Handling

ersonal data acquired through government access can be processed and handled only by authorized personnel. The handling of this data requires physical, technical and administrative measures to be implemented by the government to safeguard the data (this includes processing personal data with a valid legal basis, retention can only be for as long as prescribed under the legal framework, taking into account the purpose of processing and the sensitivity of the data).

Transparency

The legal framework regulating government access must be accessible to the public. Additionally, each country must have appropriate transparency mechanisms on government access to personal data, such as enabling the proper oversight bodies to report on government compliance.

Oversight

There must be practical and impartial oversight of government access to personal data in compliance with the necessary legal requirements (provided through bodies including internal compliance offices, courts, parliamentary or legislative committees, and independent administrative authorities).

Redress

Individuals are entitled to effective redress where a violation has occurred. The redress mechanisms might contain limitations, particularly the right to be informed, taking into account national security rules. Appropriate remedies may include the deletion of personal data, termination of unlawful processing and providing compensation for damages.