Czech Constitutional Court takes on data retention rules

In less than a year, the Constitutional Court of the Czech Republic issued two decisions that repealed most of the data retention legislation.

By its first judgment from 22 March 2011, the court repealed the obligation of telecoms operators and ISPs to retain traffic and location data for the minimum period of six months and maximum period of 12 months and to provide such data to authorised bodies upon request (First Judgment).

Already in its decision, the court mentioned also Section 88a of the Czech Criminal Procedure Act, No. 141/1961 Coll., which entitles investigative and prosecuting bodies to obtain data from providers of electronic communications services which are otherwise subject to a telecommunication secret or where data protection applies. This provision, being directly linked to the repealed provisions relating to telco operators and ISPs, was also problematic according to the Constitutional Court. However, as the constitutional complaint did not address the Criminal Procedure Act, the court could not decide about Section 88a. It was therefore for someone else to pick up the hint, and it did not actually last long. The District Court of Prague 6 filed a constitutional complaint challenging Section 88a on 1 July 2011, and the Constitutional Court issued its decision on 20 December 2011 (Second Judgment).

In the reasoning of its motion, the District Court contrasted the general restrictiveness of requirements for ordering wiretapping and recording of the telecommunication operation to extensive indulgency of requirements for ordering the detection of data about telecommunication operations as laid down by Section 88a, the Repealed Section. The District Court especially argued that such indulgency inevitably leads to inflation of motions to order the detection made by the police, the customs as well as the military police, thus undermining the court’s position as a guardian of constitutional rights guaranteed in the criminal proceedings. Not surprisingly, the District Court predominantly referred to the aforementioned First Judgment.

In the First Judgment, having repealed Section 97 (3) and (4) of the Act No. 127/2005 Coll., the Telecommunications Act, on basis of which the collection of telecommunication data by operators and providers of Internet connection was possible, the Constitutional Court said that from the collected data it could be, with 90-percent accuracy, deduced how often and who the user met, who were the user's friends or colleagues and what the user's activities were. The Constitutional Court ruled that such a global collection of personal data constituted a breach of the rule of law and invaded the privacy of each phone or Internet user.

Having invoked the factual coherence, in the Second Judgment the Constitutional Court also reiterated to great extent its argumentation from the First Judgment. As it is repeatedly mentioned in the Constitutional Court's case law, despite not being explicitly mentioned in the Charter of Fundamental Rights and Freedoms which forms part of the Czech constitutional order, the confidentiality of communications shall encompass not only the content of messages as such but also other data detected during the telecommunication operation concerning one's person, since the dynamically evolving right to privacy needs to be apprehended in its time context, especially with respect to the development of technical and technological possibilities which inevitably increase the state's potential to interfere with the rights and liberties of its citizens.

In reference to the German Federal Constitutional Court's judgment from 15 December 1953 (Volkszählungsurteil) and to the case law of the European Court of Human Rights, the Constitutional Court primarily emphasised everyone's fundamental right for the informational self-determination as a facet of the right to privacy: "In other words, the right to privacy also guarantees the right of an individual to decide at one's own discretion if and to which extend, in what ways and under which circumstances should personal data and information be disclosed to other entities."

Subsequently, using the test of proportionality, the Constitutional Court scrutinised the Repealed Section from the viewpoint of the constitutionality of its interference with the fundamental right to informational self-determination. Although the Repealed Provision was found to effectively pursue a legitimate objective consisting in the protection of public interest in the prosecution of crimes and the prevention of criminality and, moreover, to comply with the EU Data Retention Directive 2006/24/EC, and therefore passed the first step of the test of proportionality, it failed its second step.

The second step consists of assessing whether the detection of data concerning telecommunication operations by authorised bodies is subject to the requirement of necessity. Under the Repealed Section, the only condition for the ordering of detection of data on a telecommunication operation was that such a measure should lead to "clarification of facts important for criminal proceedings." In view of the Constitutional Court this was excessively broad, enabling authorised bodies to request data literally whenever any connection with the criminal proceedings occurred. In that context, it was pointed out that the respective authorities overused this and requested even data concerning petty crimes. The Constitutional Court also made the point that, taking into consideration the intensity of the interference with the right to privacy, such a measure cannot be understood as a usual or routine means of crime prevention. Simultaneously, the Constitutional Court criticised the absence of legal rules for securing the collected data and the absence of a legal obligation to subsequently inform the data subjects about the collection and retention of the data.

For the purposes of completeness, the Constitutional Court added that the Repealed Section would have also failed the last, third step of the test scrutinising the proportionality in the strict sense since it did not assign any importance to the nature and seriousness of the crime for which the criminal proceedings had been conducted.

On 27 February, in response to both the First and the Second Judgment, the Czech Government proposed a bill to replace the repealed provisions. As it is explained in the reasoning report to the proposal, the importance of traffic and location data which can reveal who, from where, with whom and how long communicated, lies in the fact that such data can be cardinal in order to detect a perpetrator of a crime. Traffic and location data may also serve to find missing persons, such as minors, seniors suffering from dementia or suicides. The proposal came into existence as a result of a struggle that the government underwent in order to present a draft of legislation which would enable the retention of traffic and location data in such a way that requirements posed both by the Directive and the Constitutional Court would be accommodated.

The proposal, which is likely to be passed, should finally bring a solution to the most problematic points of the preceding legal regulation: the body authorised to request traffic and location data are to be enumerated in a strictly exhaustive way; traffic and location data are to be retained for a period of six months from the date of the communication, which is the shortest period required by the Directive, and, in the end, traffic and location data can be requested by authorised bodies only for purposes of criminal proceedings conducted either for a defined serious willful crime or a specifically listed crime. It is going to be interesting to observe if the proposal will effectively reduce the number of requests for traffic and location data by the authorised bodies.