By Alessandra Silveira (Editor) and Tiago Sérgio Cabral (Managing Editor)

▪

As we have highlighted in this blog, in the recent judgment 268/2022 of 19 April, the Portuguese Constitutional Court finally declared the unconstitutionality of some provisions of Law 32/2008.  Law 32/2008 transposed the rules of Directive 2006/24, which were declared invalid eight years ago by the Court of Justice of the European Union (“CJEU”) in the Digital Rights Ireland judgment, for introducing a system of generalised and indiscriminate retention of personal data. This case-law of the CJEU has recently (again) been confirmed in the G. D. judgment, according to which: Article 15(1) of Directive 2002/58 (Directive on privacy and electronic communications), read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter of Fundamental Rights of the European Union (“CFREU”), must be interpreted as precluding legislative measures which, as a preventive measure for the purposes of combating serious crime and preventing serious threats to public security, provide for the general and indiscriminate retention of traffic and location data (recital 129).

Fortunately, the idea of amending the Portuguese Constitution to overcome the problem of the generalised and indiscriminate retention of metadata – which is, first and foremost, a matter of EU law – is losing steam. But there have been some voices that, surprisingly, suggest a change of course in the case-law of the CJEU and the Portuguese Constitutional Court. It is worth remembering that, in a State governed by the rule of law and a Union based on the rule of law, judicial decisions against which there is no appeal must be respected – whether one agrees with them or not. This is our most precious constitutional heritage. In fact, one could argue that if we had carefully considered the implications and respected the decision of the CJEU in Digital Rights Ireland when it was originally ruled, we could have avoided this entire issue.