Portugal: Constitutional Court strikes data retention down 

With Nuno Mota.
This article was published on EDRi-gram.

On 19 April 2022, at the request of the Ombudsperson, the Portuguese Constitutional Court declared the unconstitutionality of the Portuguese data retention law. 

This was made possible thanks to a complaint by EDRi’s member D3 – Defesa dos Direitos Digitais to the Justice Ombudsperson, back in 2017.

On 19 April 2022, at the request of the Ombudsperson, the Portuguese Constitutional Court declared the unconstitutionality of the Portuguese data retention law.

This law transposed EU Directive 2006/24/CE, of 15 March, which was declared invalid by the Court of Justice of the European Union (CJEU) in 2014 (Digital Rights Ireland Lts and other, C-293/12 and C-594/12), and subsequent case law.

The Portuguese law determined that providers of telecommunications and electronic communications services must store all traffic metadata, including data necessary for the identification of source and destination, location data, types of communications, IP data, devices used, relating to all communications or attempts thereof, for a period of one year, with a view to their possible future use for the prevention, investigation and prosecution of serious crimes.

Given the CJEU decision and the inaction of the legislative power in Portugal, D3 made a complaint to the Ombudsperson in 2017, requesting its submission to the Portuguese Constitutional Court. Although the Ombudsperson agreed with D3 arguments, she opted initially to issue a recommendation for the Government in office to change the law, instead of sending it directly to the Constitutional Court. Only after the Government inaction and even refusal to change the law, the Ombudsperson decided, in 2019, to request the Constitutional Court to review the constitutionality of articles 4, 6 and 9 of Law 32/2008, of 17 July. On 19 April 2022, the decision was finally issued.

The Portuguese Constitutional Court substantiated its decision on previous CJEU decisions on data retention, following its legal reasoning against the relevant norms of the Portuguese Constitution, but also relied on GDPR provisions. Namely, the Court considered that by not requiring the data to be stored in a EU country, the law could not guarantee the data subject’s rights to control and audit the treatment of personal data. More importantly, it followed CJUE’s data retention case law regarding lack of proportionality, considering that an undifferentiated and generalized obligation to retain all traffic and location data concerning all persons restricts, in a disproportionate manner, the rights to privacy and informational self-determination.

The data retention saga shows how the coordinated work of digital rights organizations in the EU can achieve a significant impact across the EU. Sadly, it also demonstrates how the 2006’s data retention directive is still doing damage to the fundamental rights of European citizens despite its invalidation by the CJEU. It took 14 years for this unconstitutional law to be declared so.

(Contribution by: Nuno Mota & Eduardo Santos, Board members, EDRi member D3 – Defesa dos Direitos Digitais)

Leave a comment
You should also read:

 Portugal: Data retention sent to the Constitutional Court 

This article was published at EDRi-gram
Please note that this refers strictly to a Portuguese law regarding *intelligence services’ access* to data retention. This is *not* the same case where, following a D3's complaint to the Justice Ombudsman, led to the data retention law in Portugal to be declared unconstitutional in 2022.

A new chapter is expected to soon be written in the long battle between lawmakers and the Constitutional Court in Portugal, regarding the intelligence services’ access to data retention. In January 2018, 35 Members of the Parliament (MP) from three parties officially requested the Constitutional Court to provide a rule on the constitutionality of the new law that grants intelligence services access to retained data.

Panel: Exposing a New Generation of Data Retention Laws

I participated in this panel about new data retention laws in Europe. I covered the recent decision of the Portuguese Constitutional Court, which stroke down our data retention law. It is still a bit too early to know what to expect from the Portuguese Parliament…