Assessing Damage, Urging Action activities and counter-terrorism operations”. The legislation, however, sets no clear criteria or safeguards for the sharing and use of such data by different agencies.157 At the Hearing in Brussels, the Panel was informed that EU countries have increased the exchange of information between domestic intelligence services and law enforcement bodies. At the regional level also, the collection, storage and sharing of data regarding terrorism and counter-terrorism within EU institutions, and between Member States and third countries (including the United States), has been streamlined and extended. Several participants expressed concern that the safeguards regarding information sharing are not clearly set out and, for example, information is shared without requiring equivalence in protection as between sending and receiving States.158 The Panel was made aware of the fact that the data shared might be of a personal and very sensitive nature and, once shared, might then be used for different purposes than those for which they have been gathered, shared with third parties, or otherwise misused. In some specific cases, information sharing has already had very serious consequences on individuals and their families.159 The conclusion must be that, while it is useful to share information where there are genuine reasons of national security the need should be documented and safeguards have to be in place. In the European context, there is the added problem (discussed at the Brussels Hearing) that many information sharing measures adopted within the European Union are placed within the inter-governmental pillar of the European Union Treaty (the area of Justice and Home Affairs). The fact that this function is located in the Third Pillar, as it is called, mirrors many of the negative trends the Panel saw at the domestic level: decisions are thereby subject to limited control of the judiciary (in this case European Court of Justice) and do not require approval by the legislature (the EU Parliament).160 Ordinary EU data and privacy protections do not apply. The fact that the data-sharing measures are adopted long before agreement on a EU data protection framework decision was said to be symptomatic of the steady move towards adopting security measures without ensuring in advance that adequate protection is built in. International human rights law allows many rights, such as that to privacy, to be limited in specific circumstances.161 Yet care must be exercised: data gathering, data sharing, and covert surveillance, are all sensitive, since measures may interfere with several important rights, for example the right to privacy (in terms of one’s 157 See Section 54 (4) of the Human Security Act 2007 of the Philippines. 158 See summary of the EJP European Union Hearing. See in particular oral and written submissions by Ben Hayes (Statewatch) and Hielke Hijmans, Legal adviser to the European Data Protection Supervisor. 159 See case-study of Maher Arar and other cases explored in more detail later in this chapter. 160 See on the scope of judicial review by the European Court of Justice, Article 35 of the EU Treaty. 161 UN Human Rights Committee, General Comment No. 16: The right to respect of privacy, family, home and correspondence, and protection of honour and reputation (Article 17) (hereinafter: General Comment No. 16), 8 April 1988, reprinted in UN Doc. HRI/GEN/1/Rev.6, para. 4. 71