Europe has the words

“Necessary and proportionate” is the legal test for surveillance across Europe. It is in Article 8 of the European Convention on Human Rights and Article 52 of the EU Charter. Every camera, database and intercept on the continent is supposed to pass it.

The United Kingdom has the densest camera coverage of any democracy in Europe. Its national plate reader network logs tens of millions of reads a day and kept them for two years before cutting that to one. It ran for years with no specific statute behind it. In 2020 the Court of Appeal found South Wales Police’s live facial recognition unlawful in Bridges v South Wales Police. The Metropolitan Police expanded live facial recognition afterward, under a rewritten policy. In 2021 the European Court of Human Rights ruled in Big Brother Watch v UK that GCHQ’s bulk interception violated Article 8. The bulk powers are still in the Investigatory Powers Act.

The EU’s own court struck down mandatory telecom data retention in Digital Rights Ireland (2014), again in Tele2 (2016), and again in La Quadrature du Net (2020). Several member states still retain the data. France legalized algorithmic video surveillance for the 2024 Olympics.

The one place the test has consistently worked is Germany. The Federal Constitutional Court struck down automatic plate scanning in 2008 and again in 2018. It did so because German law demands a specific enabling statute for each tool, review before deployment, and strict necessity rather than convenience.

The lesson is procedural. A standard written into law and enforced by a court a decade later is a slogan with a long fuse. The cases where it held share three features: a law per tool, a review before the switch is flipped, and someone with the power to flip it back. Those three features are Stage 1, Stage 2, and Stage 8 of the Standard. The rest is what makes them work.