By Alessandra Silveira (Editor) and Tiago Sérgio Cabral (Managing Editor)
Metadata retention is first and foremost a matter of EU law: a revision of the Portuguese Constitution will not solve the issue
In the recent judgment 268/2022 of 19 April, the Portuguese Constitutional Court finally declared the unconstitutionality of some provisions of Law 32/2008. Law 32/2008 transposed Directive 2006/24, which was declared invalid eight years ago by the Court of Justice of the European Union (“CJEU”) in the Digital Rights Ireland judgment, for introducing a system of generalised and indiscriminate retention of personal data. Given the resistance of the Portuguese judicial authorities to abide by CJEU case law in this area – or even refer back to the CJEU in order to clarify any remaining interpretative doubt – the result achieved by the Portuguese Constitutional Court was not only necessary but also desirable.
What is the solution when addressing a situation of judicial deadlock such as the one Portugal was experiencing with regard to the generalised and indiscriminate retention of personal data incompatible with EU law? It would be for the Constitutional Court to declare the invalidity of the internal rules incompatible with EU law, due to the violation of the obligations to which Portugal was bound when it joined the EU – in particular, the European loyalty provided for in Article 4(3) TEU, which is reflected in Article 8(4) of the Portuguese Constitution. In this context, it should be noted that the problem was not originally solved by the ordinary courts, but by the independent public administration. Here it is worth highlighting the Deliberation 1008/2017, of the Portuguese Data Protection Supervisory Authority (“CNPD”), which still in 2017 decided to disapply Law 32/2008 in the situations submitted to it for appreciation.Continue reading “Editorial of May 2022”