Preventive abstract review of constitutionality submitted by the President of the republic concerning the cybercrime
Cybercrime; Cybersecurity; Inviolability of communications; electronic communications
RULING No. 687/2021
30 august 2021
Preventive abstract review of constitutionality of provisions of the Cybercrime Law
In Judgement no. 687/2021, the Portuguese Constitutional Court considered a request for preventive abstract review of constitutionality, submitted by the President of the Republic, concerning the norms of article 5 of Decree no. 167/XIV, of the Assembly of the Republic, in the part that amends article 17 of Law no. 109/2009, of 15 September (known as Cybercrime Law).
Article 17 of the Cybercrime Law contains the legal regime on the seizure of electronic mail and records of communications of a similar nature. The changes introduced by article 5 of Decree 167/XIV concerned, firstly, the competent body and the formalities required to seize electronic mail. Where the current version of the rule provides for an exclusive competence of the judge, the version of the Decree referred to the "competent judicial authority". There were also relevant changes regarding the definition of the object of the seizures and the reference to the provisions of article 179 of the Criminal Procedure Code (which contains the legal regime applicable to the seizure of correspondence).
The problems the Court had to face in this case were, in summary, the following:
- Is it permissible to restrict the fundamental rights to secrecy of correspondence and other means of private communication (enshrined in Article 34(1) and (4) of the CRP) and the protection of personal data in the field of IT use (which derives from Article 35(1) and (4) of the CRP), nuclei of the right to privacy specifically and intensely protected by the Fundamental Law, as is the case with the legal regime established by the provisions in question?
- Admitting the possibility of restriction, abstractly considered, and being situated, as is the case, in the scope of criminal proceedings, does the division of powers between the Public Prosecutor's Office and the Investigating Judge, in the investigation phase, which results from the regime under analysis, comply with the relevant legal and constitutional requirements, namely the provisions of Article 32(4) of the Constitution, regarding the exclusive competence of the Investigating Judge to perform acts that directly conflict with fundamental rights, and the principles of necessity and proportionality (under Article 18, paragraph 2, of the CRP)?
Having analysed the norms in question, the Court decided to rule on their unconstitutionality, due to the violation of the norms contained in articles 34, no. 1, 35, nos. 1 and 4, 26, no. 1, 32, no. 4, and 18, no. 2, of the Constitution of the Portuguese Republic. The reason for this is that the norms under review result, on the one hand, in a restriction of the fundamental rights to the inviolability of correspondence and communications and the protection of personal data in the context of the use of information technology, as specific manifestations of the right to privacy, in terms that infringe the principle of proportionality; and, on the other hand, in a violation of the principle of the reserve of the court, the specific competences of the investigating judges and the constitutional guarantees of defence in criminal proceedings.
The main grounds of the Constitutional Court's decision were these:
- First, it is clear that the questioned rules allow the interference in electronic correspondence (article 34 of the CRP), and may also enable the knowledge of a series of personal data that, even if they do not concern an ongoing communication process, will always be protected by the fundamental right to data protection in the field of IT (provided by article 35, paragraphs 1 and 4, of the CRP), as a specific dimension of the right to privacy (protected by article 26, paragraph 1, of the Fundamental Law). In fact, the operations necessary to seize electronic mail during a search of a computer system entail a considerable risk - if not the inevitability - of access to protected personal data relating to the user's correspondence, and to traffic and content data covered by the constitutional guarantee of the protection of personal data.
- Thus, as these are rules that restrict rights, freedoms and guarantees, their effect must be limited to the minimum necessary to ensure the effective pursuit of the jusconstitutional goods and values on which the restriction is based. Now, considering the status of the Investigating Judge and the Public Prosecutor that result from the constitutional text and the applicable legal provisions, it seems unavoidable to recognize that judicial intervention constitutes an additional guarantee of weighting the rights and freedoms affected in the course of the criminal investigation.
Therefore, a legal solution that waives the prior authorisation of a judge for the practice of criminal investigation acts that involve the invasion of citizens' private sphere will only be constitutionally legitimate if there is a full, robust and well-defined justification, and in exceptional cases, which was not what was foreseen by the norms under scrutiny.
The reporting judge was Judge Mariana Canotilho. The decision was unanimous, with a joint concurring opinion by two of the judges (Judges Teles Pereira and Maria José Rangel de Mesquita).
ECLI:EU:C:2014:238. ECLI:EU:C:2010:662. ECLI:EU:C:2011:734. ECLI:EU:C:2017:214. ECLI:EU:C:2020:790. ECLI:EU:C:2021:152.