CNPD ordered the deletion of communications data retained under a law declared unconstitutional

This decision follows the ruling of the Constitutional Court on metadata (Ruling No. 268/2022, 19 April, of the Constitutional Court), which declared the unconstitutionality of some of the rules contained in Law 32/2008, namely the rule set out in Article 4 in conjunction with Article 6 of that Law.

According to the CNPD, it is unlawful for operators to maintain autonomous data processing with a wide range of personal data, including traffic and location data of all communications, for the purposes of investigation, detection, and prosecution of serious crimes. Thus, the CNPD considers that, to implement and fully comply with the ruling of the Constitutional Court, electronic communications operators must put an end to such data processing.

Therefore, the CNPD decided to order each of the electronic communications providers to eliminate - within 72 hours from the notification of the CNPD's resolution - the personal data stored under Law 32/2008.  Consequently, they must also - within 72 hours after the deletion of the data - send to the CNPD the respective certificate of destruction.

In summary, the Constitutional Court concluded that Law 32/2008, contrary to other national laws aimed at fighting criminality, constitutes an unbalanced legislative solution, as it reaches targets who are not suspected of any criminal activity. By retaining all location and traffic data of all subscribers, the electronic communications of almost the entire population are covered, without any differentiation, exception or weighing against the objective pursued.

Accordingly, the Constitutional Court considered that the limits of proportionality were exceeded, namely the fundamental right to privacy and to informative self-determination. In fact, it also considered that the violation of those fundamental rights occurs in situations that are not balanced by the positive effects in the fight against criminality.

Finally, it should be noted that Law 32/2008 of 17 June had already been held invalid by the Court of Justice of the European Union (CJEU), in its judgment of 8 April 2014, in the case "Digital Rights Ireland and Others", for violation of the principle of proportionality considering the EU Charter of Fundamental Rights.