A Constitutional Court decision in Portugal may cancel most of criminal investigations of the last 14 years because storage of personal communications data was unconstitutional.
Portugal Attorney General started a procedure contesting the Constitutional Court decision about the conservation of personal data for criminal investigations.
Lucília Gago’s office reported on May 9 that it decided to claim the nullity of the decision as the legality of most of the criminal investigations in the last 14 years would be at risk.
The Constitutional Court ruled on April 19 that one of the articles of the Metadata Law related to digital data storage was unconstitutional. Article 4 states that telecom operators need to keep various data in case there is a need for criminal investigations.
These data allow identifying the source and destination of communication or the equipment used. It includes for instance the phone number, the identity of a subscriber, the date, duration and recipient of phone calls, the IP address of a computer and the possibility to locate where these communications took place.
The Court voted nearly unanimously – 12 in favor and one vote against – that the article was unconstitutional as it “disproportionately restricts the rights to privacy“ covering almost “the entire population without differentiation, exception or consideration in relation to the objective”. The Court noted that people don’t have control of their personal data as included in the European Union’s general data protection regulation, and the process is not overseen by an independent administrative authority.
It also considered article 9 unconstitutional because people were not notified that their data had been accessed by investigators from the moment when it didn’t jeopardize the probe or didn’t put physical integrity at risk.
Under the metadata law, such data need to be stored for a year with the “exclusive purpose of investigation, detection and repression of serious crimes”. It was voted on in 2008 and transposed a European Parliament directive.
But in 2014, the Court of Justice of the European Union considered it disproportionately invaded citizens’ privacy with stored personal data of people who are not even criminal suspects. The ombudsman, Maria Lúcia Amaral, therefore asked the Constitutional Court to review the law.
In 2019, the Council for the oversight of the intelligence system, which monitors the access and process of digital data, alerted the government on the necessity to change the law.
For Assistant Attorney General Alípio Ribeiro, the court decision was predictable since the CJEU’s ruling. Most other countries limit storage to six months instead of a year; Germany limits it to 10 weeks, Mr. Ribeiro said.
But Justice Minister Francisca van Dunem didn’t want to make any changes as legislative elections were approaching six months later, according to Público. She argued there was not enough time to amend it.
The ministry of Justice spokeswoman acknowledged the Constitutional Court decision “can have a significant impact on the investigation, detection and prosecution of serious crimes”. In fact, if the law is unconstitutional, all investigations and prosecutions that used these data since 2008 could be canceled.
The Public Ministry Magistrates Union also argued that with the veto of the Court, it would be impossible to investigate and prosecute cybercrimes.
The attorney general wants the court decision to be null because she considers there is a contradiction between the justification given and the judgment, according to Diário de Noticias. Moreover, Lucília Gago claims that the decision omitted time limitation which made it retroactively applicable until 2008 instead of being only implemented for future cases.
