Over the past two years, a trio of high-profile cases before the European Court of Human Rights that concern the United Kingdom’s large dragnet surveillance programs—and the country’s collaboration with the NSA—have become the focus of many activists’ hopes that the Court will effectively outlaw indiscriminate surveillance in Europe once and for all. With yesterday’s release of a judgment in a little-known case against Hungary, which builds on an equally important judgment issued against Russia in December, it turns out that the Court may effectively have just done exactly that.

In the Russian case, Roman Zakharov v. Russia, a St. Petersburg publisher (who also chaired an NGO that promotes journalists’ rights) challenged laws allowing the Russian security services to intercept any telephone conversation without a judicial order through surveillance equipment that had been installed at mobile phone companies. Meanwhile, in the case that was the subject of yesterday’s judgment, Szabó and Vissy v. Hungary, two activists challenged sweeping legislation adopted in 2011 that allows the Hungarian police to search houses, postal mail, and electronic communications and devices without judicial approval when seeking to prevent terrorism or otherwise protect Hungary’s national security. CDT submitted a third-party intervention in the latter case, and—in a rare move—the Court cited our analysis multiple times, including in a remarkable forward-looking paragraph suggesting that the judges hope to flesh out the European Convention on Human Rights’ (ECHR) constraints on ever-increasing ability of governments “to acquire a detailed profile … of the most intimate aspects of citizens lives” in future cases.

Both of these cases alleged that the governments involved had violated the right to respect for private life and correspondence, which is enshrined in Article 8 of the ECHR. Article 8 requires that any government interference with this right to privacy must meet two criteria. First, the interference must be done “in accordance with the law”: that is, the country’s own law, international law, and what the Court has described generally as the “rule of law.” Second, it must be “necessary in a democratic society” to achieve one of a limited set of purposes such as the protection of national security or the prevention of crime. The Court’s previous cases have established that where secret surveillance is concerned, any interference with privacy must in fact be “strictly necessary for safeguarding the democratic institutions.”

In Zakharov, the Court alluded to the possibility of broad indiscriminate surveillance only in passing, since the scenario it was considering was one in which the security services could start intercepting a telephone conversation at any time, but were not explicitly alleged to be intercepting all conversations (or related data such as the time and duration of calls) at all times. The Court found that a government may only intercept telephone communications where the body authorizing the surveillance has confirmed that there is a “reasonable suspicion” of wrongdoing on the part of “the person concerned.” This language, along with the Court’s statement that a surveillance authorization “must clearly identify a specific person … or a single set of premises” as the subject of the monitoring, seemed to set the stage for a ruling that UK-style society-wide surveillance programs such as Tempora are illegal under the ECHR.

In other words: no gathering of an enormous indiscriminate haystack in order to search for a needle.

In an unexpected form, that ruling may have arrived. Noting (as the Zakharov judges also did) that “a system of secret surveillance … may undermine or even destroy democracy under the cloak of defending it,” the Court in Szabó and Vissy considered whether the challenged Hungarian laws provide “adequate and effective guarantees against abuse.” The answer was no: the phrase “strictly necessary in a democratic society,” the Court explained for the first time, means not only that a surveillance measure must be strictly necessary for “safeguarding the democratic institutions” at a general level, but must also be “ strictly necessary … for the obtaining of vital intelligence in an individual operation .” Crucially, the Court added that the Hungarian authorities must therefore interpret a law allowing surveillance authorizations to apply to “a range of persons”—which, as the Court observed, could potentially include everyone in Hungary—very narrowly. According to the Court, the body authorizing the surveillance must “verify whether sufficient reasons for intercepting a specific individual’s communications exist in each case.”

In other words: no gathering of an enormous indiscriminate haystack in order to search for a needle.

Zakharov was decided by the European Court’s Grand Chamber—the Court’s highest body—while yesterday’s judgment in Szabó and Vissy was issued by the Court’s Fourth Section: a subset of judges who, as it happens, also decide cases brought against the UK. (The Fourth Section’s judgment will remain the Court’s final word in the Hungarian case unless one of the parties successfully obtains a referral to the Grand Chamber.) As far as the Court is concerned, the substance of both sets of findings will apply to the surveillance schemes of any of the 47 Member States of the Council of Europe. This means that if Szabó and Vissy did indeed outlaw large-scale dragnet surveillance, it effectively did so for the entire continent.

The Court’s apparent finding that surveillance must be individualized deserves marquee billing.

Importantly, a concurrence in the Hungarian case suggests that the Fourth Section watered down the “reasonable suspicion” standard found in Zakharov, and implies that far from banning (as the majority termed it in one passage) “massive monitoring of communications,” the Szabó and Vissy judgment has embraced it. It is unclear whether this interpretation may rest on a misreading of certain dicta (that is, nonessential language) in the majority opinion, but it means that activists should expect at least some level of debate concerning this case to continue until rulings in the UK cases arrive. Yet, notwithstanding this dissonant note, the Court’s requirement of individualized targeting appears to be unambiguous.

Both Zakharov and Szabó and Vissy are multifaceted cases, and their findings regarding how surveillance must be authorized and overseen—as well as their profound implications for the UK’s Investigatory Powers Bill, a deeply flawed piece of proposed legislation—will be the subject of future CDT analysis. Regarding the authorization of surveillance, the Court in the Hungarian case has indicated more strongly than ever that it expects authorization to be carried out by judges, (or at least officials qualified to hold judicial office), although the Court appears to be reluctant to overturn its prior holdings that non-judicial authorization systems may comply with human rights if they are sufficiently independent. It stressed the need for any authorization body to have—and use—the power to examine all the relevant evidence, and said that it will subject any non-judicial system to “close scrutiny.”

For now, however, the Court’s apparent finding that surveillance must be individualized deserves marquee billing.