Rule of law and predictive Justice

Predictive Justice

Ustavno sodišče Republike Slovenije

Constitutional Court of Slovenia

U-I-152/17-13

4 July 2019

ECLI:SI:USRS:2019:U.I.152.17

N/A

Constitutional right to personal data protection, right to privacy, automatic number plate recognition (ANPR), legality of the interference (the “prescribed by law” legal standard), rule of law.

The main legal issue is whether the use of automatic number plate recognition technology has a sufficiently clear and predictable legal basis and whether the Constitution requires a separate legal basis for the use of this special technical means (ANPR) and for automatic access and/or comparison of data obtained with such measure with other databases.

N/A

N/A

ZNPPol (Police Tasks and Powers Act - PTPA), Articles 113/IV, 123/II/32, 125/32, 128/I/22, 122a/VI-VIII, 114a/II/3, 112
Articles 35, 38, 32, 15/III, 2 of the Constitution
ZUstS (Constitutional Court Act) Article 6
ZPP (Civil Procedure Act), Article 314
ZVOP-1 (Data Protection Act), Article 6

Constitutional court cases:
-    U-I-238/99, 09.11.2000.
-    U-I-98/11, 26.09.2012
-    U-I-411/06, 19. 6. 2008. 
-    U-I-92/01, 28. 2. 2002.
-    U-I-298/04, 27. 10. 2005. 
-    U-I-57/06, 29. 3. 2007. 
-    U-I-312/11, 13. 2. 2014.
-    U-I-18/02, 24. 10. 2003.
-    U-I-65/13, 3. 7. 2014.

The Human Rights Ombusdman of the Republic of Slovenia launched a constitutionality review of several provisions of the Law on Police Tasks and Powers, claiming that the automatic number plate recognition (ANPR) (which the law newly introduced) was regulated unconstitutionally. This technical device consists of an optical unit to capture a photograph of the number of a licence plate, and software, which recognizes the character data and cross-checks it with other personal data records. If the data from other records match (a so-called hit), the system alerts the police officer, who can then stop the vehicle and driver for a more detailed check. The Human Rights Ombusdman argued that the tool's interference with the right to privacy and data protection was disproportionate to the aim pursued, as it collects data on a massive scale and as such amounts to mass surveillance. Additionally the 7-day data retention period is excessively long. Lastly, it claimed that the tool could also infringe on the right to freedom of movement, as individuals might become more wary when entering public spaces.

At the outset, the Constitutional Court provides the relevant national legislation introducing automatic number plate recognition:

“The fourth paragraph of Article 113 of the PTPA reads as follows: Article 113 (4) “In order to ascertain the conditions for drivers and vehicles to use roads and for searching for persons and objects, police officers may also use, in or on police vehicles, technical means for the optical recognition of licence plates. The mentioned technical means must be used in a manner that does not enable mass surveillance or facial recognition.”

Point 32 of Article 125 of the PTPA determines the content of the database resulting from the optical recognition of licence plates: “[...] the date, time, and location of the recording, a photograph of the licence plate, and the licence plate number.”

The twenty-second indent of the first paragraph of Article 128 of the PTPA determines that the data from the database resulting from the optical recognition of licence plates shall be retained for seven days.”

The Court begins by emphasizing the importance of the constitutional right to informational privacy, which is explicitly included in the Slovenian constitution. It explains that the fundamental value of this right is the recognition that the individual has the right to keep certain information about themselves private and that it is for the individual to decide how much of their personal information they are willing to disclose and to whom. It stresses that a degree of secrecy in one's personal life is a precondition for the free development of intellectual and spiritual autonomy, and an accelerator of free creation and transfer of thought and ideas thus strengthening a pluralistic democratic society.

Nevertheless, this right is not absolute and can be interfered with. The Court explains that, according to its case law, every processing of personal data already constitutes an interference with the right to informational privacy. This interference is permissible if (1) it has a sufficient basis in law, which must necessarily specify which data is being collected and processed, (2) if the processing of data pursues a legitimate aim (which must also be specified in law), and (3) if it is proportionate to the aim pursued. The legal basis for the interference must not only exist but also be sufficiently clear and precise, so as to rule out any arbitrary conduct by the authorities and allow individuals to predict the consequences of the legal provision’s application. In cases related to the right to personal data protection, the ECtHR has established that sufficiently precise regulations of data processing measures must include rules on the scope and application of the measure, as well as minimum guarantees regarding the duration, storage, use, access by third parties, procedures to ensure the integrity and confidentiality of the data, and the procedure for the destruction of the data.

The Court then defines the legal term "personal data," asserting that personal data is any information relating to an identified or identifiable individual; an identifiable individual is one who can be identified directly or indirectly. The Court concludes there is no doubt that a license plate number represents a piece of personal data, as it relates to an identified or identifiable individual. Moreover, the main aim of collecting license plate number data is to identify individuals on whom the police must conduct a more thorough check.

The Court notes that the essential element of the ANPR technical tool is not only the collection of license plate numbers, but also the automatic comparison and matching of the collected number with different data records. Without this data matching, the tool loses its purpose. However, the Court opines that the legal basis for the process of data comparison and matching is not evident from the law (the law does not include a provision prescribing that the collected data will be automatically compared with other data records, nor does it specify which records will be used for comparison). The legal basis, upon which the police may verify matching of one (set of) personal data with another personal database in individual cases, is not sufficient for automated comparison and matching, which is the central feature of the ANPR system. 

Since, in line with the Court's case law, there must be a legal basis for every act carried out in relation to personal data—meaning for every processing step, including the collection, storage, access, comparison, etc.—the legal basis for the use of the ANPR is not sufficient. Because both data processing steps (collection and automatic comparison) constitute independent interferences with the right to informational privacy, they each require a separate legal framework for such processing of personal data. 

As a sufficient legal basis for this interference with the right to informational privacy is not provided, the Court found the impugned provisions to be unconstitutional and not in line with the principle of the rule of law.

The EU Charter was not used, the Court only referenced one CJEU case.

N/A

consistent interpretation, proportionality.

The Court cites a large number of its own case law relating to general principles of the right to informational privacy. The Court also cites two decisions of the German Federal Constitutional Court (No. 1 BvR 1299/05 of 24 January 2012, and No. 1 BvR 142/15 of 18 December 2018) for emphasising the argument that every (independent) step of data processing must have its own legal basis.

The Court cites a couple of the ECtHR judgements and one joined case of the CJEU. Both were cited for sources of interpretation of the legal standard “prescribed by law” and element to determine if a legal provision is sufficiently clear and precise.

By citing the ECtHR and CJEU case-law the court mainly aimed at constructing the upper premise and thus bolstering the standards from national law.

As this was a constitutionality review, the provisions of the Law on Police Tasks and Powers relating to the APNR were repealed and new provisions relating APNR have not yet been adopted by the legislator.

N/A

N/A

N/A

Yes, national case law on fundamental rights was taken into account.

N/A

N/A

N/A

Appellate Court:
-    VSK VI Kp 31182/2019, 14.1.2021.
-    VSC PRp 99/2021, 27.8.2021.

Supreme Court:
-     Sodba Vrhovnega sodišča RS I Ips 26906/2014, 22.7.2021

English translation of the case is available at:
https://www.us-rs.si/decision/?lang=en&q=ANPR&caseId=&df=&dt=&af=&at=&pri=1&vd=&vo=&vv=&vs=&ui=&va=&page=1&sort=&order=&id=113512 

Nika Sluga, University of Ljubljana