Portugal: Constitutional Court strikes data retention down

This was made possible thanks to a complaint by EDRi’s member D3 – Defesa dos Direitos Digitais to the Justice Ombudsperson, back in 2017.

On 19 April 2022, at the request of the Ombudsperson, the Portuguese Constitutional Court declared the unconstitutionality of the Portuguese data retention law.

This law transposed EU Directive 2006/24/CE, of 15 March, which was declared invalid by the Court of Justice of the European Union (CJEU) in 2014 (Digital Rights Ireland Lts and other, C-293/12 and C-594/12), and subsequent case law.

The Portuguese law determined that providers of telecommunications and electronic communications services must store all traffic metadata, including data necessary for the identification of source and destination, location data, types of communications, IP data, devices used, relating to all communications or attempts thereof, for a period of one year, with a view to their possible future use for the prevention, investigation and prosecution of serious crimes.

Given the CJEU decision and the inaction of the legislative power in Portugal, D3 made a complaint to the Ombudsperson in 2017, requesting its submission to the Portuguese Constitutional Court. Although the Ombudsperson agreed with D3 arguments, she opted initially to issue a recommendation for the Government in office to change the law, instead of sending it directly to the Constitutional Court. Only after the Government inaction and even refusal to change the law, the Ombudsperson decided, in 2019, to request the Constitutional Court to review the constitutionality of articles 4, 6 and 9 of Law 32/2008, of 17 July. On 19 April 2022, the decision was finally issued.

The Portuguese Constitutional Court substantiated its decision on previous CJEU decisions on data retention, following its legal reasoning against the relevant norms of the Portuguese Constitution, but also relied on GDPR provisions. Namely, the Court considered that by not requiring the data to be stored in a EU country, the law could not guarantee the data subject’s rights to control and audit the treatment of personal data. More importantly, it followed CJUE’s data retention case law regarding lack of proportionality, considering that an undifferentiated and generalized obligation to retain all traffic and location data concerning all persons restricts, in a disproportionate manner, the rights to privacy and informational self-determination.

The data retention saga shows how the coordinated work of digital rights organizations in the EU can achieve a significant impact across the EU. Sadly, it also demonstrates how the 2006’s data retention directive is still doing damage to the fundamental rights of European citizens despite its invalidation by the CJEU. It took 14 years for this unconstitutional law to be declared so.

(Contribution by: Nuno Mota & Eduardo Santos, Board members, EDRi member D3 – Defesa dos Direitos Digitais)