31.08.2017
Practice Areas: Intellectual Property and Information Technology
Industries: Technology, Media & Telecommunications
Type: Articles
Access to metadata
Organic Law 4/2017, published on August 25th, 2017, regulates the access by the Security information Service (SIS) and the Strategic Defense Information Service (SIED) to telecommunications and internet data. This Law will enter into force on August 30th, 2017.
Therefore, the Information Services will now be able to access the identification, location and traffic data relating to the users of electronic communications services, for purposes of national defense, internal security and prevention of acts of sabotage, espionage, terrorism, proliferation of weapons of mass destruction and highly organized crime.
However, the access by the Information Services to such data is not unrestricted and is subject to certain conditions, including prior and subsequent judicial control.
Thus, Organic Law 4/2017 largely respects the recent case law of the European Union Court of Justice that, both in the Digital Rights Ireland judgment of 8 April 2014 and in the Tele2/Watson judgment of 21 of December 2016, has reinforced the need of the intrusion in the electronic communications to be subject to clear limits and objective material and procedural conditions.
We recall that an attempt to regulate the access of the Information Services to metadata had already been made in 2015. However, following a preventive control of the constitutionality, said access was declared unconstitutional by the Portuguese Constitutional Court (Judgment 403/2015, of 27 August 2015).
Although this Organic Law 4/2017 has not been subject to a control of constitutionality before it has been published, there is notice that two political parties with parliamentary seat have now expressed their intention to request such control of constitutionality to the Constitutional Court, as said parties understand that Organic Law 4/2017 does not comply with the Constitution of the Portuguese Republic.
This is also the position of the Portuguese Data Protection Authority, which, in its opinion of May 30th, 2017 on this Law, has considered that the same “infringes the prohibition of intrusion in the electronic communications provided for in the Constitution of the Portuguese Republic, as well as the rules of the Constitution, the Charter of Fundamental Rights of the European Union and the European Convention on Human Rights regarding private and family life, personal data protection and privacy in the communications.”
We shall, therefore, have to wait to see if this question of constitutionality will be effectively brought before the Portuguese Constitutional Court, and, if so, whether this Court will once again consider the access to metadata by the Portuguese Information Services unconstitutional.
