On April 19, 2022, the Constitutional Court handed down Judgment No. 268/2022, in which it decided to declare the unconstitutionality, with general mandatory force, of the rules of articles 4 and 6 of Law No. 32/2008, of July 17, which determine the conservation, by telecommunications and electronic communications service providers, of all traffic and location data relating to all communications or their attempt, for a period of one year with a view to their possible future use for the prevention, investigation and prosecution of serious crimes.
First, by not providing for the storage of such data to take place in a Member State of the European Union, it calls into question the right of the person concerned to control and audit the processing of data concerning him, as well as the effectiveness of the constitutional guarantee of review by an independent administrative authority.
On the other hand, the Constitutional Court held that an undifferentiated and generalised obligation to store all traffic and location data relating to all persons — which reveal at all times aspects of the private and family life of citizens, making it possible to trace the location of the individual every day and throughout the day and to identify with whom he contacts, the duration and regularity of these communications – disproportionately restricts the rights to the reservation of privacy and informational self-determination. In particular, by targeting subjects for whom there is no suspicion of criminal activity: electronic communications of almost the entire population are covered, without any differentiation, exception or weighting against the objective pursued.
The Constitutional Court also declared the unconstitutionality of the rule of Article 9 of the same law, in so far as it does not provide for a notification to the person concerned that the data retained have been accessed by the criminal investigation authorities, provided that such communication is not likely to compromise the investigations or the life or physical integrity of a third party. By not providing such information to the persons affected, the persons concerned are deprived of exercising effective control over the lawfulness and regularity of that access, in violation of the rights to informational self-determination (in the dimension of control of third parties' access to personal data) and the right to effective judicial protection.
This judgment should have a huge impact on criminal proceedings whose evidence is based on those metadata.