The Portuguese Parliament enacted the Intelligence System Act in August 2015. The decree was sent to the President of the Republic of Portugal in 6^th August 2015, who asked for an anticipatory constitutional review. According to the CPR, the President of the Republic of Portugal has the right to ask for an anticipatory constitutional review. The President has decided to exercise the mentioned right, expressing his doubts about the constitutionality of the decree. From the President’s point of view, two questions ought to be answered: first, one needs to know if the access to metadata should be qualified has an interference in the correspondence through telecommunications; second, one needs to assess whether the authorization of the Prior Control Commission is equivalent to a criminal procedure.

The court starts by presenting three categories of personal data: the basic data, the content data and the traffic data. According to the court, the decree in analysis covers only the last category which can be defined as any data processed for the purpose of using an electronic communications network, including data relating the routing, duration or time of a communication.

Subsequently, the court describes the applicable international legal framework. Considering the normative framework, the court highlights article 12 of the Universal Declaration of Human Rights, article 8 of the European Convention on Human Rights and articles 7 and 8 of the EU Charter. Regarding the jurisprudential framework, the court briefly quotes the above mentioned CJEU case-law. Moreover, the court also mentions the case Malone v. United Kingdom (Judgment of the European Court of Human Rights, app. no. 8691/79, 2^nd August 1984).

 According to the court, the processing of personal data related with communications defies the fundamental rights of the people involved. Even if there is no access to the content of that communication, processing traffic data is enough to gather personal information (with whom a person talks most, his or her favourite locations, his or her schedules, etc.).

Therefore, from the court’s perspective, the norm extracted from article 34 (4) of the CPR is a natural result of having the right to protection of private and family life and the right to protection of personal data enshrined in article 26 of the CPR.

Having said that, the court concludes that electronic communications must have the same level of protection as the one granted to communications in person.

The right to communicative self-determination, enshrined in article 34 (4) of the CPR, is also highlighted by the court. This right comprehends both a negative and a positive dimension. The former means that the State must refrain from abuses; the latter entails positive actions such as an obligation to enact legislation to protect citizens as far as the protection of personal data in communications is concerned.

The court recognizes that, besides content data, traffic data are also included in the mentioned right. Therefore, the court must determine whether the right to communicative self-determination was violated by this decree.

Article 34 (4) includes a prohibitive provision (The interference of public authorities in the correspondence through telecommunications as well as other means of communication shall be forbidden) and a permissive provision (except when foreseen in the law and only in the criminal procedure domain), the former being the ordinary rule and the latter being the exception.

The lawfulness of this measure depends on whether it falls in the ordinary rule or in the exception. Were this measure to fall in the exception it would be seen as lawful. On the contrary, falling in the rule entails a necessary unconstitutionality. Therefore, one needs to analyse if the procedure that results in the authorization of the Prior Control Commission is equivalent to a criminal procedure.

The court defines criminal procedure as an ordinated sequence of acts carried out by legitimate organs and aiming to provide a decision about a potential criminal offense and its legal consequences. The criminal procedure provides the minimum guarantees to criminal defendants and demands the intervention of a judge.

The court concludes that it is not possible to endorse a broad interpretation of the mentioned exception. Consequently, considering the following statements, it is clear that the procedure prescribed by the decree cannot be qualified as a criminal procedure:

First, the traffic data are not collected for the purposes of an undergoing criminal investigation. In fact, the information is given to the Intelligence Service of the Republic of Portugal and not to the Criminal Police Bodies. However, only the latter are responsible for gathering evidences.

Second, the authorization enacted by the Prior Control Commission does not solve the problem. In fact, the Prior Control Commission is an administrative body and, according to the CPR, the criminal procedure belongs exclusively to courts. Therefore, the CPR prohibits the existence of prior administrative procedures.

Third, the decree in analysis does not provide the necessary guarantees to the data subject. Indeed, the decree does not clarify in which circumstances the commission has the power to authorize the access to personal data. Moreover, nothing is said about the duration of the authorization or about the need to erase the data after a period of time.

Considering this topic, the court mentions the case-law of the European Court of human Rights and also two judgements from Spain and Germany. Bearing in mind those decisions, the court concludes that the law ought to employ sufficiently clear terms, as well as determine under which specific cases the access to personal data may occur. The law should also define the duration of the measure and the rules and deadlines for erasing the data.

The court points out that even the Law no. 32/2008, 17th July (which transposed the Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006) presents a greater level of protection as far as data protection is concerned.

In conclusion, the court states that the right to communicative self-determination was violated by the decree in analysis. However, it was not a unanimous decision: two judges have expressed their opposition. One of the judges agreed with the decision but did not endorse the reasoning. The other judge voted against the entire decision. Considering this topic, the court mentions the case-law of the European Court of human Rights and also two judgements from Spain and Germany. Bearing in mind those decisions, the court concludes that the law ought to employ sufficiently clear terms, as well as determine under which specific cases the access to personal data may occur. The law should also define the duration of the measure and the rules and deadlines for erasing the data.

The court points out that even the Law no. 32/2008, 17th July (which transposed the Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006) presents a greater level of protection as far as data protection is concerned.

Even though the case has a relation with article 8 of the Charter, this article is not mentioned in the court’s decision. Unfortunately, this is a quite common phenomenon: despite mentioning and applying EU sources such as Directive 95/46/EC and article 10 of Regulation (EU) 2016/679, the court completely obliterates the Charter. Nevertheless, the Court mentions article 8 of the European Convention on Human Rights.

Following the declaration of unconstitutionality, which was influenced by the CJEU Case Digital Rights Ireland Lda., the Portuguese Parliament was forced to enact another Intelligence System Act, which only occurred in 2017 (Law no. 4/2017, 25^th August).

Directive 95/46/EC

Directive 2002/58/EC

Directive 2006/24/EC

Arts. 7 and 8 CFR