Tag: metadata

Again: on the prohibition of generalised and indiscriminate retention of metadata for the purpose of combating serious crime

On By officialblogunioIn Case notesLeave a comment 
By Alessandra Silveira (Editor) and Tiago Sérgio Cabral (Managing Editor)
▪

The CJEU has recently added further pieces to the puzzle of retention of traffic and location data by providers of electronic communications services for the purpose of making them available to competent national authorities in the fight against serious crime.[1] In addition to reiterating its constant jurisprudence on the matter, this CJEU judgment is particularly valuable to Member States that are legislating in order to adapt to EU law – as is the case of Portugal (judgment of 20 September 2022, SpaceNet, joined cases C-793/19 and C‑794/19, ECLI:EU:C:2022:702).[2]

In several Recitals of the judgment, the CJEU left some clues as to its resistance to the generalised and indiscriminate retention of metadata, and it is possible to perceive that it lies in the uncontrolled profiling of users of electronic communications services. Profiling is often used to make such predictions about individuals. It involves the collection of information about a person and the assessment of their characteristics or behavioural patterns in order to place them in a certain category or group and drawing upon that an inference or prediction – be it of their ability to perform a task, of their interest or presumed behaviour.[3]

Continue reading “Again: on the prohibition of generalised and indiscriminate retention of metadata for the purpose of combating serious crime” →

Some additional thoughts on metadata retention – points to consider when adopting new legislation [on joined cases C‑793/19 and C‑794/19 (SpaceNet) and the German legislation on this matter]

On By officialblogunioIn Essays1 Comment 
By Alessandra Silveira (Editor) and Tiago Sérgio Cabral (Managing Editor)
▪

As we have highlighted in this blog, in the recent judgment 268/2022 of 19 April, the Portuguese Constitutional Court finally declared the unconstitutionality of some provisions of Law 32/2008.  Law 32/2008 transposed the rules of Directive 2006/24, which were declared invalid eight years ago by the Court of Justice of the European Union (“CJEU”) in the Digital Rights Ireland judgment, for introducing a system of generalised and indiscriminate retention of personal data. This case-law of the CJEU has recently (again) been confirmed in the G. D. judgment, according to which: Article 15(1) of Directive 2002/58 (Directive on privacy and electronic communications), read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter of Fundamental Rights of the European Union (“CFREU”), must be interpreted as precluding legislative measures which, as a preventive measure for the purposes of combating serious crime and preventing serious threats to public security, provide for the general and indiscriminate retention of traffic and location data (recital 129).

Fortunately, the idea of amending the Portuguese Constitution to overcome the problem of the generalised and indiscriminate retention of metadata – which is, first and foremost, a matter of EU law – is losing steam. But there have been some voices that, surprisingly, suggest a change of course in the case-law of the CJEU and the Portuguese Constitutional Court. It is worth remembering that, in a State governed by the rule of law and a Union based on the rule of law, judicial decisions against which there is no appeal must be respected – whether one agrees with them or not. This is our most precious constitutional heritage. In fact, one could argue that if we had carefully considered the implications and respected the decision of the CJEU in Digital Rights Ireland when it was originally ruled, we could have avoided this entire issue.

Continue reading “Some additional thoughts on metadata retention – points to consider when adopting new legislation [on joined cases C‑793/19 and C‑794/19 (SpaceNet) and the German legislation on this matter]” →

Editorial of May 2022

On By officialblogunioIn Editorials2 Comments 
By Alessandra Silveira (Editor) and Tiago Sérgio Cabral (Managing Editor)
▪

Metadata retention is first and foremost a matter of EU law: a revision of the Portuguese Constitution will not solve the issue

In the recent judgment 268/2022 of 19 April, the Portuguese Constitutional Court finally declared the unconstitutionality of some provisions of Law 32/2008.[1] Law 32/2008 transposed Directive 2006/24, which was declared invalid eight years ago by the Court of Justice of the European Union (“CJEU”) in the Digital Rights Ireland judgment, for introducing a system of generalised and indiscriminate retention of personal data. Given the resistance of the Portuguese judicial authorities to abide by CJEU case law in this area – or even refer back to the CJEU in order to clarify any remaining interpretative doubt – the result achieved by the Portuguese Constitutional Court was not only necessary but also desirable.

What is the solution when addressing a situation of judicial deadlock such as the one Portugal was experiencing with regard to the generalised and indiscriminate retention of personal data incompatible with EU law? It would be for the Constitutional Court to declare the invalidity of the internal rules incompatible with EU law, due to the violation of the obligations to which Portugal was bound when it joined the EU – in particular, the European loyalty provided for in Article 4(3) TEU, which is reflected in Article 8(4) of the Portuguese Constitution. In this context, it should be noted that the problem was not originally solved by the ordinary courts, but by the independent public administration. Here it is worth highlighting the Deliberation 1008/2017, of the Portuguese Data Protection Supervisory Authority (“CNPD”), which still in 2017 decided to disapply Law 32/2008 in the situations submitted to it for appreciation.

Continue reading “Editorial of May 2022” →

Implications of the declaration of invalidity of the Directive 2006/24 on the retention of personal data (metadata) in the EU Member States: an approach to the judgment Tele 2 of 21 December 2016

On By officialblogunioIn Case notes1 Comment

6498637005_ab8645216a_o

by Alessandra Silveira, Editor
and Pedro Freitas, Member of CEDU
▪

In the decision Digital Rights Ireland of 2014[i], the ECJ was called upon to assess the validity of the Directive 2006/24 (on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks) in the light of Articles 7 (Respect for private and family life) and 8 (Protection of personal data) of the Charter of Fundamental Rights of the European Union (CFREU) and considered that the obligation imposed by the Directive 2006/24 on providers of electronic communications services constituted an interference with the aforementioned fundamental rights. [ii]

The issue at hand is that the directive concerned all those who used electronic communications services in Europe – even those whose conduct were not in any way linked with criminal activities.  Furthermore, while seeking to fight against serious crime, the Directive did not provide for any differentiation, limitation or exception to the retention of data of persons whose communications are subject to professional secrecy. In addition to a general absence of limits, the Directive 2006/24 did not lay down any objective criterion to limit the access of the competent national authorities to the data and its subsequent use. Furthermore, the Directive did not require that the data in question should be kept within the territory of the Union, and thus a supervision by an independent body was not fully guaranteed.

While it is true that the fight against serious crime is of prime importance in ensuring public safety and that its effectiveness may depend on the use of modern investigative techniques, such objective, be that as it may, cannot in itself justify a retention measure such as the one established by Directive 2006/24 as necessary for those purposes[iii]. By adopting Directive 2006/24, the European Union legislature had exceeded the limits imposed by the principle of proportionality in the light of Articles 7, 8 and 52(1) of the CFREU, and for that reason the ECJ ruled the invalidity of the directive, without reservations as to the temporal effects of its decision (ex tunc).

However, following the judgment in the Digital Rights Ireland case, the reaction of the Member States was not consensual, which led to an unlawful differentiation of treatment between European citizens. The decision of the ECJ raised the problem of the effects of that invalidity in relation to the national provisions transposing the directive. According to data released by the Portuguese Public Prosecutor’s Office, ten of the EU Member States have declared invalid the national laws that transposed the data retention directive, either by parliamentary decision or through their constitutional courts. In other Member States, including Portugal, this was not the case because the substantial requirements of the ECJ’s decision were deemed satisfied by the national legislation that transposed it. [iv]

Continue reading “Implications of the declaration of invalidity of the Directive 2006/24 on the retention of personal data (metadata) in the EU Member States: an approach to the judgment Tele 2 of 21 December 2016” →