Portugal, Porto Court of Appeal, Decision of 13th March 2013
Accountability; personal data.
Tribunal da Relação do Porto
Porto Court Appeal
Not applicable.
2013
ECLI:PT:TRP:2013:11074.11.9TDPRT.P1.0D
Collection and processing of personal data by the Judiciary
Who and with what purpose, in the context of a trial, may have access to the defendant’s personal data?
Article 35 of the Portuguese Constitution.
Ahead of trial, the Court requested that the General Directorate of Social Reintegration should provide an assessment of the defendant's social conditions.
For this purpose, a public official had to access certain data. It was later decided, however the public official in question could not have access to the defendant’s personal data.
The reasoning of the Court was as follows:
Firstly, Law no. 34/2009 of 14 July 2009 establishes the legal framework applicable to the processing of data regarding the judicial system, adopting rules on the collection of data necessary for the exercise of the powers of magistrates and justice officials, as well as for the exercise of the rights of the other parties involved in judicial proceedings and within the jurisdiction of the Public Prosecution Service.
This law imposed, in particular, the security of the processing of such data, making it incumbent on the controller to implement appropriate technical and organisational measures to protect such data, which includes preventing access by unauthorised persons.
Article 50 of Law no. 34/2009, of 14 July, punishes the agent, a person who is not duly authorised or to whom access is denied, who accesses personal data, as defined by law, and who acts with intent, in any of its forms.
In terms of article 29 of Law no. 34/2009, of 14 July, the senior technicians of the General Directorate for Social Reintegration (“DGRS”) are not included in the list of persons who have access to the data provided for in article 3 of that legislation, namely to criminal investigations.
Within the scope of the technical advice they provide to the Courts, the experts of the DGRS, by virtue of their professional duties, in order to ensure technical support in the decision making process in criminal proceedings, have, however, the duty to obtain a broad and in-depth knowledge of the person who is the object of a criminal investigation and, in some cases, of the offended person/victim, with the aim of contributing to the individualization of the criminal reaction, on the one hand and, on the other hand, to satisfy the need to guarantee procedural means and adequate data for the pursuit of the judicial purposes of reinsertion of the perpetrator in the social fabric.
The pursuit of this purpose implies the prior collection of a vast set of elements, namely on subjective aspects of the crime, of elements related to the person about whom the criminal investigation falls, which will then be translated either through social reports, social information or expertise on personality.
The intervention of the social rehabilitation services, in this field as in any other, is fully subject to jurisdictional control exercised by the competent judicial authorities, both in the pre-sentence phase and in the subsequent phase, by the sentencing courts and by the sentence enforcement courts.
For the Oporto Court of Appeal, and regarding this case, a senior technician of the General Directorate for Social Reintegration, who elaborates a social report, at the request of the Court, within the scope of the functional content inherent to his condition as a technician of the DGRS, and who states that there are numerous cases pending at the Department of Investigation and Prosecution (“DIAP”) in which the assistant appears as a suspect or as a plaintiff, does not commit the crime foreseen in article 50 of Law 34/2009.
Furthermore, as this information was obtained from the official of the DIAP, it is not even apt to constitute illicit access to personal data, given that he did not have access to it in a technical-juridical sense.
Thus, this decision is important because not only explains what is meant by access to personal data in the judicial context, but also concludes that if a Court, in a certain and given context, requests that certain social data must be collected from an accused, that is not a crime.
Once again, there was a problem of conflicts of rights: on the one hand, the right to privacy (in the context of the processing of personal data) and, on the other, the need for a social profile of the citizen who will be judged, for the purpose of fair trial.
The resolution of that conflict is determinant for the purposes of the response to be given to the case.
In other words: the Court concluded that the access to the data operated by the official in question was lawful. Consequently, it did not apply Article 50 of Law 34/2009. Indeed, if the Court had reached a contrary conclusion, then, and in accordance with the cited article:
“1- Whoever, without due authorization, by any means, accesses any of the personal data provided for in this law, shall be punished with imprisonment of up to 1 year or a fine of up to 120 days.
2 - The penalty shall be doubled when the access
(a) is achieved through violation of technical security rules;
b) Has made it possible for the agent or a third party to know personal data; or
c) Provided the perpetrator or a third party with the benefit of a patrimonial advantage”.
N/A
The 2021 EU Justice Scoreboard (p. 25), states that Portugal has undertaken several reforms with the aim of simultaneously increasing the efficiency of its judicial system and thus promoting effective access to justice. Thus, and for example, (i) there are procedural rules that allow the use of digital technology in civil, commercial, administrative, and criminal courts; and (ii) Portugal continues to rank highly with regard to secure electronic communication channels.