By Alessandra Silveira (Editor) and Tiago Sérgio Cabral (Managing Editor)

▪

Metadata retention is first and foremost a matter of EU law: a revision of the Portuguese Constitution will not solve the issue

In the recent judgment 268/2022 of 19 April, the Portuguese Constitutional Court finally declared the unconstitutionality of some provisions of Law 32/2008.^[1] Law 32/2008 transposed Directive 2006/24, which was declared invalid eight years ago by the Court of Justice of the European Union (“CJEU”) in the Digital Rights Ireland judgment, for introducing a system of generalised and indiscriminate retention of personal data. Given the resistance of the Portuguese judicial authorities to abide by CJEU case law in this area – or even refer back to the CJEU in order to clarify any remaining interpretative doubt – the result achieved by the Portuguese Constitutional Court was not only necessary but also desirable.

What is the solution when addressing a situation of judicial deadlock such as the one Portugal was experiencing with regard to the generalised and indiscriminate retention of personal data incompatible with EU law? It would be for the Constitutional Court to declare the invalidity of the internal rules incompatible with EU law, due to the violation of the obligations to which Portugal was bound when it joined the EU – in particular, the European loyalty provided for in Article 4(3) TEU, which is reflected in Article 8(4) of the Portuguese Constitution. In this context, it should be noted that the problem was not originally solved by the ordinary courts, but by the independent public administration. Here it is worth highlighting the Deliberation 1008/2017, of the Portuguese Data Protection Supervisory Authority (“CNPD”), which still in 2017 decided to disapply Law 32/2008 in the situations submitted to it for appreciation.

However, the logical path followed by the Portuguese Constitutional Court appears to push against the obligations to which all courts of the Member States are bound as functionally European courts. As stated in the concurring opinion submitted jointly by six judges of the Constitutional Court – almost half of its thirteen judges, including the President of the Court, who disagreed with the methodical approach adopted by the majority – “the judgment starts from a mistake“.  Which mistake?  That the ordinary courts and the Constitutional Court are called to assess and decide different issues: the ordinary courts assessing a question of the disapplication of national law that is contrary to EU law by invoking the principle of primacy; and the Constitutional Court assessing a question of validity – and not of mere disapplication – of national rules that are contrary to EU law by invoking an improper reading of the principle of interpreting national law in conformity with EU law. Such a judgment of validity would be based on a hermeneutic exercise of conformity of the Portuguese constitutional rules with the rules of the Charter of Fundamental Rights of the European Union (“CFREU”). What is the issue with this? Well, this interpretative strategy introduced by the Constitutional Court will always involve the possibility, even if eventual, of reaching different results from those corresponding to the standard set by the CJEU. It is ultimately a way of subverting the primacy of EU law over constitutional rules and encroaching upon the sphere of competences of the CJEU, in disagreement with Article 8(4) of the Portuguese Constitution itself. But we will get to that in a moment, so let us put the data retention problem into context.

The Directive 2006/24 regulated the retention of data by service providers for the purpose of investigating, detecting and prosecuting serious crime, irrespective of any prior request by the Member States’ law enforcement officers or judiciary. The directive was applicable to traffic data and location data, relating to both natural and legal persons, including information consulted using an electronic communications network – albeit it did not apply to the content of the communication. The heart of the matter laid in the fact that the directive covered all those who used electronic communications services in Europe – even those whose data was not criminally relevant. By adopting Directive 2006/24, the EU legislature had exceeded the limits imposed by the principle of proportionality in the light of Articles 7 (privacy), 8 (data protection) and 52(1) (proportionality on limitations) of the CFREU, and for that reason the CJUE ruled the invalidity of that directive integrally, without reservations as to the temporal effects of its decision (ex tunc).

The decision of the CJEU raised the problem of the effects of that invalidity in relation to the national provisions transposing the directive which have been declared invalid. Following the Digital Rights Ireland judgment, the reaction of the Member States was not consensual, which led to an unlawful differentiation of treatment between European citizens. According to data released by the Portuguese Public Prosecutor’s Office, following the CJEU judgment ten of the EU Member States have declared invalid the national laws that transposed the data retention directive, either by parliamentary decision or through their constitutional courts. In other Member States, including Portugal, this was not the case because the substantial requirements of the CJEU’s decision were deemed satisfied by the national legislation that transposed it.^[2]

In the Tele2 case the CJEU was asked to clarify the consequences of the invalidity of Directive 2006/24 for national authorities and to determine whether a general obligation to retain data would be compatible with Article 15(1) of Directive 2002/58 (on the privacy in the electronic communications sector). This Article allows Member States to adopt legislative measures for the retention of data for a limited period, subject to compliance with the general principles of the EU law and fundamental rights therein protected.

The CJEU decided that this Article, read in the light of  Articles  7, 8 , 11 (freedom of expression and information) and Article 52(1) of  the CFREU, must be interpreted as precluding national legislation which, for  the  purpose  of   fighting  crime,  provides  for  the  general  and  indiscriminate  retention of all traffic and location data of  all subscribers and registered users relating to all means of  electronic communication.^[3] In other words, if it were to be data retention consistent with Article 15 (1) of Directive 2002/58, it should be targeted and limited with respect to the categories of data to be retained, the means of communication affected, the persons concerned and the retention period adopted. With this in mind, the legal-material incompatibility of the Portuguese Law 32/2008 with EU law was evident.

It clearly results from the Tele 2 judgment that i) the declaration of invalidity of the provisions contained in a directive inevitably affects the legal act of transposition of those provisions into the legal system of the Member States; and ii) a Member State cannot rely on the Directive 2002/58 to enforce a generalised and undifferentiated obligation to retain traffic and location data following the declaration of invalidity of Directive 2006/24.

With great frequency and in a number of different places^[4] we have warned that was urgent to draw conclusions from that CJEU’s case law, especially because in Member States where the transposed legislation continued to apply following the declaration of invalidity of Directive 2006/24 – as was the case in Portugal – many criminal convictions relied upon a potentially illegitimate access to data. Before being a problem of conformity with the Portuguese Constitution, the problem would have to be solved in the light of EU law. This is the most elementary aspect of the correct application of EU law since a court in Oporto referred the matter to the CJEU, which gave rise to the Mecanarte judgment (the first referral from a Portuguese court after accession): the question of conformity with the Constitution should not be confused with or prejudge the question of conformity with EU law. In other words, the problem of EU law is resolved first, because it takes precedence over domestic law – including constitutional law. And no alternative or fanciful interpretation of the principle interpreting national law in conformity with EU law can contradict it!

This also means that a decision of the Constitutional Court restricting the temporal effects of its decision would, in fact, bear little effect, as it would not and cannot restrict the temporal effects of the incompatibility of Law 32/2008 with EU (only the CJEU can do that). In fact, in the La Quadrature du Net judgment (C-511/18, 6 October 2020, Recitals 213-217), the Court of Justice held that “[i]n the light of the primacy principle, where it is unable to interpret national law in compliance with the requirements of EU law, the national court which is called upon within the exercise of its jurisdiction to apply provisions of EU law is under a duty to give full effect to those provisions, if necessary refusing of its own motion to apply any conflicting provision of national legislation, even if adopted subsequently, and it is not necessary for that court to request or await the prior setting aside of such provision by legislative or other constitutional means” and “[o]nly the Court [of Justice] may, in exceptional cases, on the basis of overriding considerations of legal certainty, allow the temporary suspension of the ousting effect of a rule of EU law with respect to national law that is contrary thereto. Such a restriction on the temporal effects of the interpretation of that law, made by the Court, may be granted only in the actual judgment ruling upon the interpretation requested”. The Court then states that “the primacy and uniform application of EU law would be undermined if national courts had the power to give provisions of national law primacy in relation to EU law contravened by those provisions, even temporarily”.

Thus, national courts would still be required to disapply the provisions of Law 32/2008 and draw the necessary conclusions regarding the lawfulness of the evidence obtained illegally. In fact, the Constitutional Court itself heavily implies that ordinary courts should not have waited for it and should have stopped applying (and arguably refer to the CJEU) the provisions of the law requiring the retention of metadata.

It was not difficult to see that the failure to remove the rules of Law 32/2008 allowed unequal treatment between European citizens prohibited by Article 18 TFEU: citizens living in other Member State other than Portugal, who are not suspects of a crime, are no longer subject to the retention of their personal data after the Digital Rights Ireland judgment, while those living in Portugal continued being subject to illegal retention of their data for years. This undermines the effectiveness of EU law, undermines the homogeneity of its application in the different Member States, and leads to unjustified differences of treatment between European citizens in the protection of their fundamental rights. The disparity between the Member States following the declaration of invalidity of Directive 2006/24 suggests that there are serious divergences between the applicable EU law^[5] – which is incompatible with the idea of a Union based on the rule of law. In this context, if the Portuguese courts had doubts as to the continued application of Law 32/2008, a dialogue with the CJEU was required by way of preliminary ruling in order to i) disclose the scope or consequences of declared invalidity, and ii) to exclude the risk of misinterpretation or breach of EU law.

Things did not follow this path and the Portuguese Constitutional Court was called to assess the constitutionality of the norms of Law 32/2008.  Starting from a dichotomy between disapplication and invalidation of rules, the Constitutional Court judgment concluded that, in the case of ordinary courts, they should disapply internal rules based on the principle of primacy of EU law. In the case of the Constitutional Court, the problem of contradiction arises in the context of a control of constitutionality that generates the invalidity of the norm, and such invalidity should be mobilised for the cases of contradiction of the internal norm with EU law. It happens that the parameter of constitutionality will always be the Portuguese Constitution and not EU law – in other words, the invalidity of the national norm always depends on its non-compliance with the Constitution; internal norms are invalid due to the violation of fundamental rights enshrined in the Portuguese Constitution. This subverts Article 8(4) of the Portuguese Constitution itself, according to which the provisions of the Treaties governing the EU and the norms issued by its institutions, in the exercise of their respective competences, are applicable in the internal order under the terms defined by EU law.

Thus, instead of defending the invalidity of the internal norms due to the violation of the obligations to which Portugal was bound by its EU membership, the Constitutional Court has chosen to sustain the invalidity of the internal norms using the principle of interpreting national law in conformity with EU law. This does not seem adequate because the interpretation in conformity with EU law requires the national judge to solve a contradiction between internal norms and EU law by adapting the interpretation of the national law to conform with EU law. This principle does not serve to disapply or invalidate norms that are incompatible with EU law – but rather to maintain them in a sense compatible with EU law.

This outcome would have been avoidable if the ordinary courts had heeded the CJEU’s response in the La Quadrature du Net judgment (Recitals 213 to 227).^[6] Faced with the question whether a national court may validate the use of traffic and location data obtained by virtue of a national rule incompatible with EU law, the CJEU concluded that the principle of effectiveness of EU law (i.e., the obligation on Member States to ensure the effectiveness of European provisions) requires the national criminal court to reject/refuse information or evidence obtained through a generalised and undifferentiated retention of traffic and location data incompatible with EU law, if, in the context of criminal proceedings brought against persons suspected of having committed a criminal offence, those persons are not in a position to make an effective statement on that information and evidence, which originates in a field of which the judges have no knowledge and which is liable to have a significant effect on the assessment of the facts.

How did the CJEU come to this conclusion? The CJEU first explained that, at the current stage of EU law and in principle, it is for national law to determine the rules concerning the admissibility and assessment of evidence, obtained through retention of data contrary to EU law in the context of criminal proceedings brought against persons suspected of serious crimes.  Why is this so? Because in the absence of rules of EU law on the matter, it is for the legal order of each Member State to regulate the procedural arrangements for safeguarding rights under the European legal order. But provided that this procedural autonomy of the Member States respects the tests of equivalence and effectiveness. In other words, the applicable domestic procedural rules may not be less favourable than those governing similar situations under national law (equivalence); and the applicable domestic procedural rules may not render practically impossible (or excessively difficult) the exercise of rights conferred by the European legal order (effectiveness).

What is the purpose of national rules on the admissibility and exploitation of information and evidence in criminal proceedings? It is to prevent evidence obtained illegally from unduly prejudicing a person suspected of having committed criminal offences. If this is the case, this level of protection cannot be lowered when it is a question of safeguarding rights provided for by the EU, especially when the admissibility of information and evidence poses a risk to the right to adversarial proceedings and to a fair trial, because the use of such evidence leads to an imbalance between the parties. Therefore, if a national court considers that one of the parties is not in a position effectively to comment on a piece of evidence –  which concerns a field that is not known to the judges and which may significantly affect the assessment of the facts –, then the national court must declare a violation of the right to a fair trial and exclude that piece of evidence in order to avoid such a violation.

---

[1] See http://www.tribunalconstitucional.pt/tc/acordaos/20220268.html.

[2] See Portuguese Public Prosecutor’s Office, Report no. 7 on traffic data retention and Law no. 32/2008, 2015, http://cibercrime.ministeriopublico.pt/sites/default/files/documentos/pdf/nota_pratica_7_retencao_de_dados.pdf.

[3] See Judgment Tele2, recitals 108 to 112.

[4] See Alessandra Silveira/Pedro Freitas, Implicações da declaração de invalidade da Diretiva 2006/24 na conservação de dados pessoais (“metadados”) nos Estados-Membros da UE: uma leitura jusfundamental, “Revista de Direito, Estado e Telecomunicações, Universidade de Brasília (UnB)”, vol. 9, no. 1, 2017 (https://periodicos.unb.br/index.php/RDET/article/view/21513/19828); Alessandra Silveira/Pedro Freitas, The recent jurisprudence of the CJEU on personal data retention: implications for criminal investigation in Portugal, “UNIO – EU Law Journal”, vol. 3, No. 2, julho/2017 (https://revistas.uminho.pt/index.php/unio/article/view/213); Alessandra Silveira/Pedro Freitas, Conservação de dados pessoais no setor das comunicações eletrónicas e modalidades de acesso para efeitos de investigação criminal (a propósito do acórdão Ministerio Fiscal do TJUE),  Rogério Gesta Leal/ Carlos Aymerich Cano/ Alessandra Silveira (coords.), “V Seminário Internacional Hispano-Luso-Brasileiro sobre Direitos Fundamentais e Políticas Públicas”, Universidade de Santa Cruz do Sul (UNISC), Santa Cruz do Sul/RS/Brasil, 2019 (https://www.unisc.br/pt/home/editora/e-books?id_livro=493); Alessandra Silveira/Pedro Freitas, Implications of the declaration of invalidity of the Directive 2006/24 on the retention of personal data (metadata) in the EU Member States: an approach to the judgment Tele 2 of 21 December 2016, 22 January 2017 (https://officialblogofunio.com/2017/01/22/implications-of-the-declaration-of-invalidity-of-the-directive-200624-on-the-retention-of-personal-data-metadata-in-the-member-states-of-the-eu-an-approach-to-the-judgment-tele-2-of-21-december-20/); Tiago Sérgio Cabral, The Council’s Position regarding the proposal for the ePrivacy Regulation: out of the frying pan and into the fire?, 15 february 2021 (https://eulawlive.com/oped-the-councils-position-regarding-the-proposal-for-the-eprivacy-regulation-out-of-the-frying-pan-and-into-the-fire-by-tiago-sergio-cabral/).

[5] In addition, it is not irrelevant that service providers in Portugal were, for years, made to pay for the storage of a significant amount of data.

[6] The CJEU reached similar conclusions in Privacy International and, more recently,G.D.

Picture credits: jeshoots.