Fourteen years after the entry into force of Law 32/2008, of 17 July, the so-called “Metadata Law” (In Portuguese, “Lei dos Metadados”), which transposed Directive 2006/24/EC, of 15 March 2006, of the European Parliament and of the Council into national law, questions have been raised as to the conformity of this law with fundamental Portuguese law, due to the violation of various rights, freedoms, and citizen guarantees.
But what actually is Metadata? It is data that allows a much more detailed tracking of certain information, e.g. the location and identity of callers in a phone call or a message; in the case of computers (or any electronic device that can access the internet), it can check the time in and out, the location and duration of accesses to a certain website or any online operation or the IP address itself (a number particular to each device). Metadata excludes, however, the content of calls, particularly what is said.
As they represent traffic and location data of people’s communications, are susceptible to identify a certain subject in a certain moment, and may even translate data of private life, the norms of the “Metadata Law” that determine the conservation of traffic and location data of communications for a period of one year (arts. 4 and 6), as well as the norm that foresees the non-communication of the subject’s data for criminal investigation purposes (art. 9) were declared unconstitutional, with mandatory general force, in the recent Constitutional Court Ruling.(In Portuguese).
The Judges of Palácio Ratton considered that the generalized storage of traffic and location data of individuals, restricts in a disproportionate manner the content of the right to privacy, the secrecy of communications, and the informative self-determination.
Much had already been speculated about a possible decision of this tenor, given the declaration of invalidity of Directive 2006/24/EC of 15 March 2006 by the Court of Justice of the European Union in 2014, and the unconstitutional reflexes that this transposition presented in the national instrument.
Is this intrusion into people’s data – traffic data and not data on content – a flagrant violation of the right to privacy or secrecy laid down in the Constitution of the Portuguese Republic as a fundamental right?
Can the retention periods for these data be shortened in order to avoid unconstitutionality, while at the same time guaranteeing the safeguarding of citizens’ rights, freedoms, and guarantees?
What effect will the Constitutional Court’s decision have on convictions already handed down and on cases still pending?
Is the door open for a new constitutional amendment?
Gonçalo Asper Caro @ DCM | Littler
