Other – Fundamental Rights

Judicial Interaction Techniques

Ústavní soud

Constitutional Court

Pl.ÚS 45/17

5/14/2019

ECLI:CZ:US:2019:Pl.US.45.17.1

N/A

Data Retention – Indiscriminate Retention of Telecommunication Metadata – Constitutionality and compliance with EU law of the Czech system

Is the Czech data retention system compatible with the Constitution?

N/A

N/A

Art. 10(2); art. 10(3); art. 13;  of the (Czech) Charter on Fundamental Rights and Freedoms (Listina základních práv a svobod)
§ 97(3); § 97(4) of the act no. 127/2005 Coll., Electronic Communication Act (zákon o elektronických komunikacích)
§ 88a of the act no. 141/1961 Coll., Criminal Procedure Act (trestní řád)
§ 68(2); § 71(a) og the act no. 273/2008 Coll., Police Act (zákon o Policii České republiky)
Decree no. 357/2012 Coll., on storage, transfer and destruction of traffic and location data (vyhláška o uchovávání, předávání a likvidaci provozních a lokalizačních údajů)

A group of lawmakers challenged the Czech data retention law before the Constitutional Court. The challenged legislation required mobile network operators to retain "data packages" of all customers, users of telecommunications services, for six months retroactively. For example, in the case of telephone calls or SMS and MMS messages (including unsuccessful connection attempts), the operator retains data on the telephone numbers of the caller and the called party, the date and time of the start and end of the communication, and the location and movement of the service user. In the case of the use of Internet services and e-mail communication, operators are also obliged to collect, in particular, user accounts, computer and server identification data (IP address, port number), data on the e-mail addresses of the parties to the communication and the e-mail protocol.
The challenged regulation was the second version, as the previous one had been annulled by the Constitutional Court several years earlier as insufficient. Compared to the previously invalidated legislation, the legislator has now shortened the retention period for traffic and location data to six months, explicitly listed the entities entitled to request the retained data, including the purposes for which the entitled entities may request the data, added a statutory definition of traffic and location data, and again referred to the implementing regulation for details.

The Constitutional Court first defined the scope of the right to privacy in the national constitutional order and then in EU law. The Court recalled its earlier annulment decisions on Czech data retention and the fact that the scope of protection of the fundamental right to respect for private life includes not only the protection of the actual content of messages transmitted by telephone or other means of communication, but also traffic and location data. Any restriction of such a right is then only possible on the basis of the statutory provisions, in a proportionate manner and in compliance with the guarantees of protection of the individual against arbitrariness of the public authorities. In relation to EU law, the Court recalls the repeal of the Data Retention Directive and the related conclusions of the CJEU on the need for a targeted link between the data retained and threats to public security. It also referred to the case law of the ECtHR, in which that court criticised the request by investigating authorities for data on a number of telephone numbers, the purpose of which was to reveal the journalist's source of information (not an objective pursuing a defined public interest) and which was not subject to prior independent authority.
The Court then reviewed the challenged provisions. It first assessed the permissibility of the bulk collection of data. Following the case law of the CJEU, it noted that, after the repeal of the Data Retention Directive at European level, there was no political consensus on the form of a unified regulation of the data retention issue, as evidenced by the fact that no new legislation has been proposed to replace the Directive since its annulment. There are therefore different approaches at the level of national legislators. This is illustrated by the situation in neighbouring countries. Consequently, the Constitutional Court refuses to declare the a priori illegality of a data retention system. According to the Court, developments in the field of information technology have progressed considerably and individuals are increasingly using electronic communication services. They are thus a valuable source of important information. Moreover, the data would be collected by the operators in any event, and here the Court preferred the aspect of transparency and control of interference with the privacy of individuals through a clear, precise and sufficiently strict legal framework of the data retention principle, rather than the "legal shadow" in which both operators, when retaining traffic and location data, and public authorities (in particular law enforcement authorities), when seeking access to them, would otherwise operate.The Court explicitly rejected the idea that this was a lower standard of protection than that provided by the CJEU. The Constitutional Court considers that its approach protects the privacy of individuals more than if its intervention had created room for finding other, alternative and less transparent ways of accessing the metadata of electronic communications. The rejection of data retention did not result in the non-collection of data, but only in the loss of legal limits and control over the scope of retention of traffic and location data, the way in which it is secured and the way in which it is disclosed. Responsibility for the handling of traffic and location data by public authorities would then de facto be transferred from the state to the operators, which would be unacceptable under the rule of law. The Constitutional Court therefore concluded that the motion could not be granted for principal reasons alone.
Next, the Court assessed the appropriate definition of the scope of the authorities entitled to access the collected data in relation to the determination of legitimate purposes. Here, the Court found that data could only be collected for a strong public interest, while minimising interference as far as possible to strike a fair balance. This was upheld here because the six-month retention period was not manifestly disproportionate, the level of safeguards was sufficient, and the extent of potential use by the police was appropriate. In short, the state has kept pace with technological developments. It therefore rejected the motion to annul the data retention legislation.

The EU Charter was mentioned only in the context of CJEU case law.

N/A

other – disagreement; comparative reasoning with foreign legislation or foreign caselaw

The Constitutional Court cites its previous decisions annulling the data retention scheme.

The Constitutional Court cites foreign case law - German (decision of the Federal Constitutional Court of 2 March 2010, 1 BvR 256/08), Slovak (decision of the Constitutional Court of 29 April 2015, PL. ÚS 10/2014) and Austrian (decision of the Constitutional Court of 27 June 2014, G 47/2012).

The Constitutional Court refers to the jurisprudence of the CJEU and the ECtHR, in particular when defining the basis for review and the limits of human rights. 

The Constitutional Court had no choice but to refer to international decisions, as the data retention regime was previously established by EU law. Nevertheless, it decided not to follow the conclusions of the CJEU and not to initiate the preliminary reference procedure.

N/A

N/A

N/A

No

Yes

N/A

N/A

N/A

N/A

N/A

Ondřej Kadlec, Šimon Chvojka, Masaryk University

N/A