The Portuguese Constitutional Court has declared a new data retention law proposal to be unconstitutional. The law proposed, among other things, general and indiscriminate retention of people’s telecommunications data – like traffic and location data – for up to six months for the purpose of investigating serious crime.

The proposal had been approved in the Parliament and it was supposed to replace the previous data retention law invalidated by the same court in 2022. The law was declared invalid following a complaint presented to the Justice Ombudsman by EDRi Member D3 – Defesa dos Direitos Digitais, in 2017.

In response to the Constitutional Court’s decision, the Parliament has swiftly approved another dubious data retention regime in the beginning of 2024, which might face the same fate of being declared unconstitutional…for the third time.

The proposed regime

Following the Constitutional Court decision from 2022, the Portuguese Parliament looked into several options for the future of data retention in Portugal. The Parliament’s Committee on Constitutional Affairs, Rights, Freedoms and Guarantees created a data retention working group, which lasted for 476 days, had 13 meetings and made 7 hearings. Criminal investigation police and public prosecutors participated in the hearings, complaining about the lack of a data retention regime and asking for its reinstatement.

Initially, as reported by the press, a solution involving accessing metadata retained by internet service providers for billing purposes seemed to be favoured as an alternative to a specific database with retained data for criminal investigation purposes. However, in the end, the three biggest parties PS, PSD e Chega approved a law proposal which addressed some minor issues raised by the Court but maintained general and indiscriminate retention of traffic and location data, for the purpose of investigating serious crime, for six months.

Oddly, the period would be reduced to 3 months in case the user expressly opposed to it. In both cases, this period would still be longer than what the Court of Justice of the European Union (CJEU) had already refused for Germany in the Spacenet decision more than one year ago.

D3 in the Parliament, and a predictable outcome

Last September, D3 participated in a hearing at the Parliament by the data retention working group, where it warned against the obvious Constitutional failure ahead. In opinion pieces published in newspapers,several legal experts offered the same prediction. Law Prof. Francisco Pereira Coutinho, who has written about data retention in Portugal, stated:

“This proposal is unlikely to survive further review by the Constitutional Court. (…) The widespread and indiscriminate preventive conservation of metadata is common practice in police and autocratic states such as China or Russia. Its enshrinement in the European Union was the result of a security drift that I hope will never be repeated”.

In this context, it was with no surprise that on December 4 2023, the Constitutional Court declared the unconstitutionality of the proposed law, due to general and indiscriminate retention of traffic and location data, following the CJUE’s case law.

D3 considered this decision “the most predictable Constitutional defeat ever”.

Third attempt: data retention regime delegated in the Supreme court

The law proposal was then sent back to Parliament, which was facing a pre-announced dissolution by the President of the Republic, effective on 15 of January 2024, and with elections scheduled for the 10th of March. As such, members of the Parliament rushed to approve a solution. On January 5 2024 a new law proposal was approved in the plenary.

However, as argued by D3, the new data retention regime is not any less problematic. The new law does not dictates a data retention scheme directly, but allows it through an authorisation from a special section of the Supreme Court. It will be up to the Supreme Court to define the terms of each data retention authorisation, with the law solely requiring them to be proportional and for the purpose of investigating serious crime. The law does not set duration limits, specific legal grounds for data retention to be authorised, or the criteria for it to be considered proportional.

As D3 puts it: “Perhaps the legislator thought that if they did not take explicit choices in the law, those could not be rejected by the Constitutional Court. An undefined data retention period could be considered too long, a delimitation of the scope of conservation that does not exist could not be considered excessive, etc.”.

New regime still a violation of fundamental rights

In D3’s opinion, the new data retention regime is a clear violation of fundamental rights. According to the Portuguese Constitution, a restriction of fundamental rights must be set by law, including the core regime of such restriction. Existing Constitutional case law does not allow core parts of a restriction to be set, for example, by lower level regulations. Delegating core elements of a fundamental rights restriction in the Supreme Court makes it impossible to demonstrate the required proportionality of the restriction, namely, its necessity (prohibition of excess). Similarly, it cannot be demonstrated that the restricting law preserves the essential core of the restricted fundamental rights, as it must.

A further legal aspect which apparently went unnoticed so far is that while the law keeps data retention restricted to the purpose of serious criminal investigation, the actual catalog of the crimes considered as “serious” is much wider than what the case law of the CJEU would hint when referring to such a concept.

What’s next?

The President of the Republic has yet to announce whether he will once again be sending the proposal to the Constitutional Court. If he does not, D3 will certainly make sure the law finds its way there. In any case, the next chapters of the Portuguese data retention saga should be written in the upcoming weeks.

Contribution by: Eduardo Santos, EDRi member, D3 – Defesa dos Direitos Digitais