Case Prokuratuur: Proportionality and the Independence of Authorities in Data Retention

Abstract: Records of electronic communication metadata allow detailed conclusions about habits of daily life, such as places of residence, activities carried out, or social relations. This data can therefore be useful in criminal investigations. The CJEU elaborated in case Prokuratuur (case C-746/18 ECLI:EU:C:2021:152) on the conditions of access to such data. The court interpreted art. 15(1) of the Directive 2002/58/EC on privacy and electronic communications and ruled that access to traffic and location data may be provided to combat severe crime or to prevent serious public security threats. This interference with the fundamental rights enshrined in arts 7 and 8 of the Charter of Fundamental Rights when accessing traffic and location data is grave, regardless of the period granted for data access or the amount of data requested. The prosecution of less serious crimes can therefore not justify such intervention. According to Estonian law, the Public Prosecutor’s Office has the task of conducting the criminal investigation and, if necessary, initiating prosecution in court. Consequently, it cannot be regarded as an independent authority to decide on access to traffic and location data for criminal investigations. As a basis for the presentation and discussion of the Prokuratuur decision by the CJEU, the facts of the case are briefly outlined before previous case law regarding data retention is summarised.

Keywords: data retention – principle of proportionality – independent authority – evidence – fundamental rights – data protection.
 

I. Facts of the case

The person concerned had been sentenced to two years in custody. The alleged crimes were thefts using another person’s bank card and acts of violence against a person involved in the proceedings.[1]

Part of the evidence brought forward was data relating to electronic communications.[2] The Estonian Public Prosecutor’s Office gathered this data from an electronic telecommunication service provider. Estonian law requires providers to store traffic and location data generally and indiscriminately for one year. This obligation involves the following data: name and address of both parties of the call, date and time of the start and end of the call, the device used, the cell ID at the start of the call, and the geographical location. According to national law, data access can be granted if it is essential for use in criminal proceedings.[3]

Subsequently, the verdict was challenged on the grounds of evidence not legally obtained. The court of appeal rejected the claim. The Estonian Supreme Court (Riigikohus) referred the case to the CJEU requesting an interpretation of art. 15(1) of the Directive 2002/58/EC.[4]

II. Directive on privacy and electronic communications

According to Directive 2002/58/EC (the Directive), Member States have to ensure the confidentiality of communication and related traffic data.[5] Traffic data is data that is processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof.[6] Location data is data processed in an electronic communications network indicating the geographic position of the terminal equipment of a user of a publicly available electronic communication service.[7] Electronic telecommunication service providers have to erase traffic data or make it anonymous before processing, except when it is necessary for subscriber billing and interconnection payments.[8] Location data other than traffic data may be processed when made anonymous or with the users’ consent.[9] The Directive seeks to ensure full respect for the fundamental rights set out in arts 7 and 8 of the Charter.[10]

Art. 15 contains exceptions to those principles laid down by the Directive. According to this article, Member States can adopt legislative measures to restrict rights and obligations. However, those restrictions have to be necessary, appropriate, and proportionate.[11]

III. Overview of the existing case-law regarding data retention

This judgment follows widely discussed court decisions concerning data retention regulation[12]. Some of these findings will be presented briefly, as they served as a basis for the referring court’s questions and the decision of the CJEU.

In C-293/12 and C-594/12 (Digital Rights a.o.), the CJEU declared the European Data Retention Directive 2006/24/EG invalid because of its interference with the fundamental rights protected by the Charter.[13] The CJEU’s reasoning for its decision was that the interference allowed by the directive was not limited to the strictly necessary.[14] The Directive did not contain clear and precise rules concerning the scope and application of the measure, nor did it impose minimum safeguards to provide sufficient guarantees against unlawful access or use of data. The directive applied to all means of electronic communication and was not restricted to data pertaining to a particular time period, a particular geographic area, or a particular circle of persons.[15] Furthermore, there was no objective criterion to determine when data access should be allowed, as the directive simply refers in a general manner to serious crime as defined by each Member State.[16] The court also highlighted that substantive and procedural conditions relating to the access of the competent national authorities were missing.[17] The directive also failed to establish an objective criterion to limit the number of persons authorised to access data[18] and to set a data retention period.[19]

In Tele2 Sverige and Watson and Others, the Court evaluated whether a national regulation that obligates private electronic communication providers to retain data that falls under Directive 2002/58/EC is valid or if art. 1(3) is applicable. According to art. 1(3), the Directive does not apply to activities that fall outside the scope of the Treaty establishing the European Community (such as activities concerning public security, defence, state security and the activities of the state in areas of criminal law). The court concluded that the article is not applicable because private entities store the data. The directive is also applicable when evaluating the rights to access stored data. Notably, art. 15(1) would be largely meaningless if the directive was not applicable, as this exception could never come into use.[20]

The court found that the general rule of art. 5(1), which ensures the confidentiality of communications, can be deviated from according to art. 15(1). However, according to the court, art. 15(1) must be interpreted strictly; it exhaustively regulates the list of objectives,[21] and restrictions must be limited to the strictly necessary.[22] The court made clear that stored traffic and location data allow for extensive conclusions on individuals’ private lives;[23] therefore, access should only be granted for the prosecution of serious crimes.[24] In addition, the court stated that unrestricted data retention without fixed limits is inadmissible. The following must be specified: categories of the data stored, the devices and persons concerned, and the duration of the data storage.[25] The court went on to state that Member States have to put forward sufficient guarantees to prevent abuse of data,[26] and national regulation has to be clear and precise concerning the scope and application of a data retention measure. There must be an objective criterion that establishes a link between the data to be retained and the objective pursued. In a special situation, data access could be justified if there were objective expectations that the data could contribute to the purpose. Such a particular situation could be represented by the state’s vital interests, such as combatting severe crime or serious threats to public security.[27] Access to the data has to be authorised by a court or an independent authority.[28]

In decision (C-207/16), Ministerio Fiscal, the question brought forward by a Spanish court was whether the investigation of non-serious crime could justify an exception according to art. 15(1) of Directive 2002/58/EC.[29] The investigating authority asked different electronic communication providers to divulge the name, telephone number, and address related to terminal equipment in order to identify phone thieves. The CJEU ruled that the data request was an infringement of the rights established by the Charter. However, since the requested data was limited and not related to traffic or location data, it would not be possible to draw precise conclusions about the private lives of the persons concerned. Hence, this is not to be classified as a grave infringement and can therefore be justified for the purposes of prevention, investigation, and prosecution of criminal offences. Further, exceptions to art. 15(1) are not limited to the investigation of serious crimes but would also allow an exception for criminal offences in general.[30]

In the decisions La Quadrature du Net a.o. and Privacy International, the court confirmed its previous case law.[31] Further, it specified that general preventive storage could be admissible to prevent a serious threat to national security. The responsibility for national security lies with each Member State. This responsibility enfolds the primary interest of protecting the essential functions of the state and the fundamental interests of society. It encompasses the prevention and punishment of activities capable of seriously destabilising the fundamental constitutional, political, economic, or social structures of a country and, in particular, of directly threatening society, the population, or the state itself, such as terrorist activities.[32] Those threats can be distinguished from general disturbances that affect public security by their nature and particular seriousness. With the objective of safeguarding national security, there are, therefore, more serious interferences with fundamental rights (in regard to art. 52(1) of the Charter) than with other objectives. [33] The retention of traffic and location data of all users of electronic communications systems for a limited period of time can, therefore, be justified when the Member State is confronted with a serious threat to national security. This threat has to be genuine and present or foreseeable.[34] The intrusion has to be limited to the strictly necessary, and the duration cannot exceed a foreseeable time. Limitations and strict safeguards must be put in place to make it possible to effectively protect the personal data of the persons concerned against the risk of abuse. Data retention of a systematic nature would not be admissible.[35]

IV. Highlights of the CJEU judgment

In C-746/18, the court analyses art. 15(1) of Directive 2002/58/EC in light of arts 7, 8, and 11 and art. 52(1) of the Charter. The court starts by examining whether a provision allowing access to traffic and location data to combat general crime is compatible with the fundamental rights if the access is not significant (both in terms of the type of data and its temporal extent).[36]

The court recalls that access to traffic and location data must fulfil the obligation according to art. 15(1).[37] In conformity with fundamental rights, art. 15(1) precludes general and indiscriminate traffic and location data retention. Access can only be justified by an objective that serves the public interest.[38] Since the Directive’s rights and obligations are limited, the severity of the interference by the limitation must be assessed and verified according to whether the public interest pursued by the limitation is proportionate to the seriousness of the interference.[39]

The relevant Estonian provision obligates electronic communication providers to generally and indiscriminately retain traffic and location data for one year. The data in question allows the identification of persons participating in phone communications. Further modalities such as date, time, duration of the phone call, communication device, and location are stored. Additionally, the frequency of phone calls with a certain person can be established with the help of the data.[40] When investigating a crime, the competent authorities can request the retained data regardless of the severity of the alleged offence.

The court refers to its case law, stating that the retention of traffic and location data is a severe interference with the fundamental rights of the Charter. Severe interference occurs regardless of whether the storage is of a general, indiscriminate, or targeted nature. Accordingly, only objectives related to combatting serious crime and preventing serious threats to public security can justify such infringement on fundamental rights.[41] Otherwise, the principle of proportionality would not be respected, as it constitutes a serious infringement into the fundamental rights enshrined in arts 7 and 8 of the Charter.[42] However, if the encroachment on fundamental rights is not severe, the aim of combatting general crime can justify the interference.[43]

The traffic and location data to be stored in casu allow precise conclusions about the individuals’ private lives. Conclusions can be reached regarding daily habits, permanent or temporary places of residence, daily or other regular changes of location, activities carried out, and information on social relations and the social environment.[44]

Other factors relating to the proportionality of an access request cannot justify access to investigate general crime. However, the competent national authority must examine the category of data and the period thereof to be disclosed in each case. These modalities do not play a role when questioning the admissibility of access to a set of traffic and location data itself, since there is always a severe encroachment on the data subjects’ fundamental rights, irrespectively of the period, amount, or type of data. Even access over a short period or a limited amount of data can reveal detailed private information about the user. The precise information that can be drawn from the data and its scope can only be assessed after the access. Therefore, the concrete danger to private life is not known beforehand. Instead, the general danger associated with such an intrusion has to guide the decision.[45] Therefore, the court concludes that access to retained traffic and location data cannot be justified when investigating general crimes.

In the judgment, the CJEU also evaluates the requirements of an independent authority according to Union law,[46] namely, whether a public prosecutor’s office conducting the investigation and, if necessary, undertaking the public prosecution would comply with these requirements.

As has been pointed out in the previous CJEU decisions, the conditions concerning data access circumstances are to be regulated by national law.[47] However, the requirement of proportionality demands that the regulation clearly and precisely provides for the scope and application of the measure, describing the minimum requirements. Only in this way will the persons concerned receive sufficient guarantees to ensure adequate protection against abuse. The national regulation must be binding.[48]

Not only must the purpose comply with art. 15(1), but the material and procedural conditions for the use of data must also be established.[49] General access to all stored data is not limited to what is strictly necessary. Therefore, national regulation must ensure that the determination of the circumstances and conditions for access to data be based on objective criteria Access to traffic and location data may only be granted for the purpose of the prosecution of serious criminal offences, national security interests, national defence, or public safety.[50]

To comply with these conditions, access to data must be subject to prior control by a court or a competent administrative authority. This prior control requires that the competent body have all powers and guarantees necessary to ensure that conflicting interests can be taken into consideration. This means that in the case of a criminal investigation, the court or body must be able to strike a fair balance between the interest in investigating crime and the fundamental rights of respect for private life and protection of personal data.[51] Thus, the body must perform its task objectively and impartially without influence from other parties.[52] On the one hand, this means that the competent authority must not be involved in the investigation procedure and, on the other hand, that it is has a neutral stand towards the parties to the criminal proceedings.[53]

The Estonian Public Prosecutor’s Office, which conducts preliminary investigations and represents the public in prosecutions, is not independent as required by EU law. It cannot make independent decisions regarding evidence when it is expected to pursue a case in court. The office is obliged to examine the incriminating and exculpating aspects of the evidence and is only bound by the law. However, these constraints are insufficient to adequately consider the interests as if weighed by a third party.[54] Furthermore, subsequent judicial review cannot compensate for this lack of independent review since prior control aims to ensure that only necessary data is disclosed.[55] The judgment is, therefore, that a body such as the Public Prosecutor’s Office, which conducts preliminary investigations, lacks the necessary independence to ensure an unbiased preliminary review of data access.

V. Commentary

With this ruling, the CJEU has further clarified its case law on data retention regarding which objectives can justify access to stored traffic and location data and which bodies are competent to decide on the question of access.[56] The court confirms that access to stored traffic and location data is a severe interference with fundamental rights and, therefore, can only be justified when serving the prosecution of severe crimes. The court confirmed that the period of data access and the categories of data requested must be considered when evaluating the proportionality of an interference. However, the data access modalities cannot lead to a situation where severe intrusions could be justified for the prosecution of general criminal offences. Here, the arguments of the court differ from those of the Advocate General. According to the Advocate General, very limited access, ranging from only a few hours to days, cannot be compared to retrieving data over several months. He argues that the conclusions that can be drawn from the data are likely more extensive when the period covered by the access is longer.[57] Very limited access could, therefore, be justified by the prosecution of general criminal offences as the infringement would not be severe. The length of the required access and the type of data concerned would need to be taken into account when deciding whether data access for the prosecution of general offences is justified.[58]

Here, the Court of Justice’s arguments are convincing, as they confirm that various factors must be assessed in each case when deciding whether to allow the requested data. Thus, the competent authority has to examine ex-ante whether the requested period and data categories are necessary to investigate a criminal offence. However, traffic and location data are generally sensitive because they allow for far-reaching conclusions about private life. It is impossible to know what information can be derived from the data in advance, which is why access to this data must generally be considered a severe intrusion.

While the court’s first decisions clearly upheld the necessity of protecting privacy, the subsequent decisions specified and relativised the conditions for data retention. This decision, however, prevents softening the requirements even further. Instead, the interpretation of art. 15 regarding access to traffic and location data is restricted to investigating serious crimes. Traffic and location data may include information on sensitive areas such as sexual orientation, political opinions, religious, philosophical, social or other beliefs, and health status, with such data otherwise enjoying special protection under Union law. Moreover, these data can lead to accurate conclusions concerning private life when combined (i.e., a personality profile). In terms of respect for private life, this profile is information that is just as sensitive as the content of the communication. In this respect, the limitation to data access for the prosecution of serious crimes is to be welcomed.

However, defining what constitutes a serious crime is still up to the Member States. As with the concept of national security, there is a risk that Member States will interpret it broadly.[59] Interestingly, constitutional courts that have treated similar questions did not always specify what constitutes a serious crime.[60]

The other aspect of the judgment regarding the Estonian Public Prosecutor’s Office, which is in charge of the investigation and, if appropriate, the public prosecution in court (i.e., the premise that it cannot be considered an independent authority with access to the stored data), is also convincing. The requirement of a court or an independent body to review access is the most important procedural requirement.[61] This requirement would be undermined if the authority in charge of investigating the crime could decide on data access.

Another point touched on by the Advocate General that might be examined in prospective proceedings was whether an independent internal authority could be considered to have the necessary independence to make decisions on data access. In the discussed case, the investigating authority was organised hierarchically. Even if there was a clear internal distinction between investigation and deciding on data access, this would probably not be easily visible from the outside. It can therefore be questioned if this would constitute a sufficiently independent authority.[62]

One can observe the difficulty of balancing different legitimate goals in these decisions on data retention by the highest courts of Europe.[63] After all, when evaluating data retention, the interest in public security and law enforcement’s efficacy must be weighed against fundamental rights and principles of the rule of law, especially the principle of proportionality.[64] Both sides are important public interests in a democratic constitutional state.[65] The balancing and assessment of the significance of the conflicting interests are subject to change with time. Notably, after major events such as terrorist attacks, there has been a shift towards a demand for more security measures and, therefore, also for data retention.[66] Data retention is also seen as a useful instrument to prevent or investigate serious crime such as drug trafficking or sexual exploitation of children.[67] Depending on how access is implemented, bulk data retention could be less intrusive into private life than targeted interceptions.[68]

However, it is worth noting that laws that were made for the purpose of combatting terrorism and organised crime have been used afterwards for different purposes.[69] As discussed here in the case of Prokuratuur, these laws have been used, at times, to combat ordinary crime.[70] As already mentioned, electronic communication metadata is likely to result in a high risk to the rights and freedoms of natural persons. The storage of data may prevent people from exercising their opinions.[71] Also, arts 7 and 8 of the Charter are an embodiment of the universal human need for privacy. [72]

Privacy and data protection are fundamental to democratic decision-making and a precondition for exercising other fundamental rights.[73] Simultaneously, however, the CJEU recognised positive obligations to take legal measures to combat crime to protect fundamental rights (arts 3, 4, and 7 of the Charter).[74] This means that not only public interests but also guarantees protected by fundamental rights must be weighed against each other.

Directive 2002/58/EC, discussed in this judgment, will prospectively be replaced with the e-privacy regulation, which is currently being negotiated.[75] The e-privacy regulation should align the existing legal bases with the GDPR.[76] However, the goal to replace the Directive by 2018 was missed by far. After different drafts, the Council finally agreed on a proposal on 5 January 2021.[77] This proposal allows the start of a trilogue between the Commission, the Council, and the Parliament. In this new proposal, some changes were made compared to the original proposal of 2017, although no material changes were made to the articles relevant to this Insight. The confidentiality of electronic communications is upheld in art. 5. According to art. 11 of the proposed regulation, the Union or a Member State can adopt legislative measures to restrict the obligations and rights provided for in arts 5 through 8. These restrictions may be made under the condition that they respect the essence of fundamental rights and freedoms. They must also be necessary, appropriate, and proportionate measures to safeguard the public interest in a democratic society according to art. 23(1)(c) to (e), (i) and (j) of Regulation (EU) 2016/679 (GDPR).

The European Data Protection Board (EDPB) has expressed its opinion on the proposal,[78] emphasising how important it is to adapt the GDPR framework.[79] After all, the e-privacy regulation is not intended to diminish the protection provided by the current Directive.[80] Therefore, the EDPB is advocating that the e-privacy regulation not deviate from the aforementioned CJEU case law. Accordingly, current or future legal bases that provide for non-targeted data retention for purposes of law enforcement and safeguarding national security would not be compatible with the Charter. Further, the EDPB emphasises that legislation should not derogate from the obligation for strict temporal and material limitations and a review by a court or an independent authority.[81]

Therefore, the principles outlined in this judgment should not change under the new regulation. However, the discussion and mitigation of colliding interests will continue in the future. Further preliminary ruling proceedings concerning this question are pending,[82] and there are Union level political efforts for a new data retention regulation.[83]

--------------------
European Papers, Vol. 6, 2021, No 1, European Forum, Insight of 11 June 2021, pp. 199-210
ISSN 2499-8249 - doi: 10.15166/2499-8249/469

* Research Assistant, University of Fribourg, sophia.rovelli@unifr.ch.