Subject matter: Retention of personal data relating to communications Keywords: Data Communications Personal data |
Ruling. No. 268/2022 – Sucessive
Subject Matter – Retention of personal data relating to communications
Keywords of the Alphabetical Index:
Data
Communications
Personal data
Summary
At the request of the Ombudsman, the Constitutional Court declared the unconstitutionality of the provisions of articles 4 and 6 of Law no. 32/2008, of 17 July, which determine the retention of all traffic and location data relating to all communications or attempts thereto by telecommunications and electronic communications service providers, for a period of one year, with a view to their possible future use for the prevention, investigation and prosecution of serious crimes.
On the one hand, by not determining that the storage of those data should take place in a Member State of the European Union, the right of the person concerned to control and audit the processing of personal data is jeopardised, as well as the effectiveness of the constitutional guarantee of supervision by an independent administrative authority.
On the other hand, the Constitutional Court considered that an undifferentiated and generalised obligation to store all traffic and location data concerning all persons - which reveal at all times crucial elements of citizens’ private and family life, allowing to track the location of individuals every day and throughout the day and identify with whom they contact, the duration and regularity of such communications -, is a disproportionate restriction to the rights to privacy and information self-determination. Namely because it extends to subjects in relation to whom there is no suspicion of criminal activity: it covers the electronic communications of almost the entire population, without any differentiation, exception or weighing against the pursued goal.
The Constitutional Court also declared the unconstitutionality of the provision of article 9 of the same law, where it does not provide for a notification to the person concerned that the data stored were accessed by the criminal investigation authorities (as long as such communication is not likely to compromise the investigations or the life or physical integrity of a third party). By not providing that information, the persons concerned are deprived of any effective control over the lawfulness and regularity of that access, in breach of the rights to informative self-determination (in the dimension of control of third-party access to personal data) and the right to effective judicial protection.