Newsletter
08 January 2024 METADATA: Constitutional Court declares that access for the purpose of investigating serious crimes is unconstitutional

The Constitutional Court declared, in a preventive review of constitutionality, the unconstitutionality of certain rules of Assembly of the Republic Decree 91/XV, which aimed to regulate access to metadata relating to electronic communications for the purposes of criminal investigation, in order to bring Law 32/2008 of 17 July into line with Constitutional Court Ruling 268/2022.

Specifically, the Constitutional Court declared the unconstitutionality, on the grounds of violation of the fundamental rights to privacy and informational self-determination, of the normative solution presented by the Assembly of the Republic regarding the retention by providers of publicly available electronic communications services or public communications networks of traffic and location data for the purposes of investigation, detection and prosecution of serious crimes.

Considering the obligation to store data in Portugal or in the territory of another Member State of the European Union, the Constitutional Court did not, however, declare the unconstitutionality of the normative solution contained in the same Decree with regard to the storage, for the same purposes, of subscriber and user identification data, as well as so-called "basic data", which, although they relate to the connection to the network, are independent of a specific communication, such as, for example, the telephone number or the IP protocol address assigned to the source of a connection, regardless of its classification as static or dynamic.

The Constitutional Court also did not consider unconstitutional the regime proposed by the Assembly of the Republic regarding the transmission of traffic and location data, subject to judicial authorisation, taking into account the obligation to notify the data subject.

The Constitutional Court did not rule on access by judicial authorities to traffic or location data held by providers of publicly available electronic communications services or public communications networks for commercial purposes, such as billing subscribers or paying for interconnections.

This ruling follows on from Constitutional Court Ruling 268/2022, which declared the unconstitutionality, with general binding force, of several rules of Law 32/2008 of 17 July, following the European case law that has been developed by the Court of Justice of the European Union since the Digital Rights Ireland Ltd ruling (C-293/12).

Following this ruling, the President of the Republic returned the aforementioned Decree of the Assembly of the Republic to the Assembly of the Republic without promulgation, requesting that it consider, if possible during the current legislative session, i.e. by 15 January, a better solution to the unconstitutionality decreed.

Article by: Paulo Lacão