Data retention

La disciplina di data retention prevista dall’art. 132 codice privacy è stata oggetto di numerose riformulazioni. Il presente scritto mira ad analizzare le modifiche da ultimo apportate dal d.lgs. 10 agosto 2018 n. 101. Accanto ad opportune chiarificazioni normative, emergono aspetti più critici. Il tema centrale è  rappresentato dalle tempistiche di conservazione dei dati. Al riguardo, l’autrice dimostra come, da una lettura sinottica dell’art. 132 codice privacy e dell’art. 24 cd. legge europea 2017, emerga la tendenziale dilatazione a settantadue mesi di tali tempistiche in rapporto alla repressione di tutte le tipologie di reato.

The material scope of the research problem presented in the text encompasses the issues concerned with operational surveillance that the Polish civilian counter-intelligence service, i.e. the Internal Security Agency (in Polish abbreviated as ABW-Agencja Bezpieczeństwa Wewnętrznego), is authorised to. The main purpose of the analysis is to assess the changes introduced as a result of the passing of the so-called Surveillance Act in 2016. The Act was supposed to introduce new regulations with regard to the powers concerning operational surveillance and obtaining of ICT data, granted to particular secret and police services. The said changes were enforced by the judgment of the Constitutional Tribunal, which in 2014 found numerous violations of the provisions of the Constitutions of the Republic of Poland caused by the existing regulations authorising the services to engage in particular operational and investigative actions. In order to elaborate the material scope of the research problem, and to present the conclusions, the following research questions have been presented in the text: Do the legal regulations concerning the powers vested in the Polish civilian counter-intelligence service within operational surveillance infringe individual rights and freedoms (e.g. the right to privacy, protection of personal information, privacy of correspondence), and if so, then to what extent? Functional and pro-constitutional interpretations have been applied to assess the provisions regulating the powers of the Internal Security Agency with regard to operational surveillance and obtaining of ICT data. The functional interpretation focuses on the function of selected legal solutions, whereas the pro-constitutional interpretation focuses on the assessment of legal solutions in the context of the principles of a democratic state ruled by law, as well as human rights and freedoms. As regards the pro-constitutional interpretation, the tool used for assessment is the test of proportionality, i.e. the rule used for interpreting legal norms according to the degree and legitimacy of the interference in individual rights and freedoms.

Acquisizione di tabulati, tutela della privacy e rispetto del principio di proporzionalità La riforma della disciplina acquisitiva dei tabulati, imposta dalla giurisprudenza europea, presenta ancora notevoli zone d'ombra, soprattutto per quanto concerne il rispetto del principio di proporzionalità fra l'intervento statuale e la tutela della privacy.

Telephone records' acquisition, protection of privacy and respect for the principle of proportionality The acquisitive discipline of telephone records' reform, imposed by European jurisprudence, still has significant grey areas, especially as regards the proportionality between State intervention and the protection of privacy.

This article focuses on the balance between public security and the rights to privacy and data protection in the light of the strong restrictions placed on these rights by directive
2006/24/EC (the so called Data Retention Directive). The first part of the article examines the main features of the Data Retention Directive in order to underline the switch from data protection to data retention embraced by the European Union in the post 9-11 era. The second part analyses some of the problematic aspects of the data retention framework both at European and national levels. In particular, focusing on the issue of the indiscriminate monitoring of ordinary citizens due to the generalized collecting of metadata, the article examines the domestic Courts’decisions and the recent judgment of the CJEU. In this regard, the article outlines possible future developments both at European and national levels.

The European Union introduced the Data Retention Directive (“the Directive”) after the terrorist attacks in Madrid and London in 2004. The purpose of the Directive was to obligate telecommunication service providers to retain specified phone and internet-related metadata in order to ensure that the data were available for the purpose of the investigation, detection and prosecution of serious crime (art. 1(1) of the Directive).

The Directive was heavily criticised for its strong interference with fundamental rights, particularly the right to privacy and the right to protection of personal data. It required Member States to oblige telecommunications companies to store all traffic data about all phone calls, internet access and e-mail communications that take place in their network. The data was to be retained for a period of 6–24 months, depending on the national implementation of the Directive. Access to the data was not regulated in the Directive, as it is outside the jurisdiction of the EU. The European Data Protection Supervisor, the Article 29 Working Party, and digital rights organisations expressed strong concerns about the necessity and proportionality of the proposal.

The constitutionality of the data retention regime was challenged in several Member State courts, with each challenge leading to an annulment of the domestic retention law. An EU-level judgment was finally given in April 2014 when the Court of Justice of the European Union (“the CJEU”) gave its ruling in the joined cases of Digital Rights Ireland and Seitlinger. The judgment declared the Directive invalid on the grounds that it violated the rights to privacy and data protection and exceeded the limits of what was acceptable in the view of the principle of proportionality. Although counted as a victory by privacy advocates, the ruling has not led to the uniform consequences which one might expect. Several court decisions were given after the ruling, again striking down the national data retention laws, yet governments in other Member States have taken a completely different direction, either by keeping their data retention laws unchanged—or even expanding them.

In this article, compliance of the Member States with the judgment is studied. The purpose of directives and the interpretations given by the CJEU is to harmonise the law in the Union. This begs the question: Why do the readings of the directive and judgment lead to such different outcomes? Also, as long as the status of data retention remains unclear—with some Member States still retaining data—does the Charter of Fundamental Rights effectively protect the rights to privacy and data protection?

This article constitutes a short version of my forthcoming Ph.D. thesis. It delivers a human rights-based analysis of anti-terrorism policies in a European context, looking at the cases of the UK, Germany, and the EU. The article claims that all three players have at times breached human rights norms, either in terms of legal standards or in terms of the wider aims of the concept of human rights. The EU, however, provides at the same time as it breaches human rights, safeguards for the protection of the same. Human rights breaches could for the mentioned cases be detected both in terms of a more narrow legal approach to human rights connecting to legally binding rights documents and court rulings (e.g. in terms of data retention), but also in terms of a broader understanding of human rights, connecting to the wider aims of rights, such as the guarantee of dignity, freedom and justice (the ‘spirit of rights’). I further try to give some points on which short and long-term strategies might be alternatives to the rights-infringing policies that often are applied by European states when trying to counter-act the phenomenon of terrorism.

Las medidas de retención de datos y registro de teléfonos móviles constituyen restricciones a los dere-chos fundamentales a la privacidad y a la libertad en las comunicaciones. Como tales, deben cumplir con una serie de requisitos mínimos que garanticen el respeto a los estándares internacionales en  materia de derechos humanos. Frente a la tendencia regional y global que lleva a gobiernos y a pro-veedores de servicio a acumular una cantidad cada vez mayor de información sobre sus usuarios, este estudio intenta una aproximación comparada a la manera en que las legislaciones de México, Brasil, Colombia, Perú, Argentina y Chile abordan la retención de datos y el registro de teléfonos móviles, de cara a sus obligaciones y compromisos internacionales en el marco interamericano, y en particular en relación a los proyectos legislativos que en Chile buscan realizar cambios al actual marco regulatorio de las telecomunicaciones.

The Information and Communication Technology nowadays plays a core role in the execution of crimes of economic criminality. This seems to be due to two factors, that can be defined as the structural factor and the instrumental factor. Moreover, every time we use the new technologies we leave behind us some sorts of “traces”, i.e. the traffic and location data on both legal entities and natural persons and to the related data necessary to identify the subscriber or registered user. Such data can be extremely useful in the context of criminal investigations. The regulation on the obligation of the States to require the retention of such data by service providers for investigative purposes, for the discovery and repression of crimes is called “data retention”. Data retention has some general features that are valid at global level.
Within the European Union the respective regulation set out by the Directive 2006/24/EC has been declared invalid by the Court of Justice of the European Union.
Therefore it seems necessary to adopt a new European regulation on data retention, regarding to which the article traces in its conclusions the possible reference points.

The Data Retention Directive is one of the most controversial acts adopted by the eu. The storage of an indeterminate amount of data – concerning every citizen of the eu – requires finding a balance between the need to fight terrorism and the rights to privacy and data protection, as declared in the Charter of Fundamental Rights of the eu, the echr, and by the common constitutional values shared by Member States.
According to the cjeu (joined cases C-293/12 and C-594/12), the Directive ‘treats everyone as a suspect’, ‘monitors everyone’ and ‘puts everyone under surveillance’ and represents a ‘serious interference’ to citizens’ rights to privacy. The aim of this paper is to define – through a comparative analysis – the main features of the cjeu balancing process, trying to assess possible future scenarios for data retention in the European and domestic legal frameworks. The challenge remains the same: how to prevent serious crime and terrorism while preserving our fundamental rights?

La normativa sulla protezione dei dati personali è particolarmente complessa e stratificata, composta da leggi europee, generali e speciali, e nazionali, completate
e interpretate dalle indicazioni delle competenti Autorità, anch’esse sia unioniste sia nazionali, che costituiscono un vero e proprio “diritto vivente”.
Dubbi e le incertezze sulla corretta applicazione delle norme possono condurre ad effetti deleteri per il rischio di non individuare correttamente il perimetro di tutela e, come ha evidenziato la recente pandemia, quale sia la normativa applicabile nelle varie situazioni da parte dei vari soggetti coinvolti.
Molti sono ancora i dubbi interpretativi o le errate  convinzioni, derivanti molto spesso dall’assenza di una reale conoscenza della normativa e delle sue implicazioni pratiche e giuridiche da parte di chi è tenuto ad attuarla: che differenza c’è fra analisi del rischio e DPIA, o fra diritto di accesso e portabilità dei dati? Come si fa a determinare correttamente i tempi di conservazione dei dati personali? Come si fa a dimostrare la conformità? In quali responsabilità può
incorrere il DPO? Quali sono i soggetti tutelati dal GDPR e quali quelli tutelati dalla complessiva normativa privacy?
Il libro cerca di rispondere a questi e altri quesiti fondamentali in modo semplice ma completo, accompagnando il lettore nella soluzione delle diverse
problematiche con un costante riferimento ai testi normativi, a metodologie e modulistica “ufficiale” e a buone pratiche. Chiudono il testo un paio di casi che illustrano nella pratica la complessità di una normativa nella quale ogni scelta implementativa si ripercuote su molteplici adempimenti.

Within the context of the SURVEILLE project, which offers a legal and ethical analysis of issues surrounding the use of surveillance technologies in the three phases of countering serious crime (prevention, investigation and prosecution) at the national as
well as at the EU level, this deliverable focuses on the use of
retained data in the fight against serious crime.
This research aims at conducting a comparative study of the use of retained data within selected national jurisdictions for the purpose of investigating and prosecuting serious crime.
The authors are testing in this paper a hypothesis, which is
used to describe a trend underlying a current evolution in
this domain. The hypothesis relates to the so-called catalysing effect of serious crime on the increasing use of data retention for the purpose of investigating and prosecuting serious crime.
The catalysing effect of serious crime on the use of such a measure
is amplified by the fact that the Data Retention Directive leaves a wide discretion to Member States and that the implementing legislation broadens the scope of application of data retention both regarding offences and authorities involved. T
hus, the access of data retained by the private sector for investigation purposes and the subsequent use for prosecution
purposes has been studied in nine EU Member States, namely Belgium, France, Germany, Italy, the Netherlands, Poland, Romania, Spain and the United Kingdom.
The comparative analysis of these case studies allow us to highlight potential differences in those legal provisions that
regulate the retention and subsequent use of information between European Member States with an authoritarian past and Member States without such a past.
The human rights dimension is the normative background of the
project as a whole, and thus of the present work.

Gherasim-Proca, O. (2009). Cooperarea internaţională pentru combaterea terorismului şi noua cultură a comunicării globale. In G. Pascariu & R. Frunză (Eds.), Europe on the Move/Dinamici europene (pp. 152–160). Iași: Editura Universităţii „Al. I. Cuza”.


Gherasim-Proca, Ovidiu, „Cooperarea internaţională pentru combaterea terorismului şi noua cultură a comunicării globale”, în Gabriela Pascariu, Ramona Frunză (ed.), Europe on the Move/Dinamici europene, Editura Universităţii „Al. I. Cuza”, Iași, 2009, pp. 152-160.


Gherasim-Proca, Ovidiu. “Cooperarea Internaţională Pentru Combaterea Terorismului Şi Noua Cultură a Comunicării Globale.” In Europe on the Move/Dinamici Europene, edited by Gabriela Pascariu and Ramona Frunză, 152–60. Iași: Editura Universităţii „Al. I. Cuza”, 2009.

Abstract: The fundamental issues of social media are the ways that people relay something of themselves to others and how this shapes society. Plus, increasingly, there is the breadth of social media reach, and the depth of what is kept in terms of related history of a person, captured constantly by postings and connections. As a consequence, much can be gleaned about people, especially as to their networks, actions and opinions. This leads to an additional matter of the concern generated when the massive amount of personal and socialised data is accessible, not only by befriended users of social media applications, but by government agencies, as is done for the purpose of pursuing political objectives. This gives social media a rather less than fresh and innocent appearance to any who see past the vast popularity of seemingly innocuous interchanges between old friends and new acquaintances met online.

In recent years, public attention has been increasingly drawn to the problem of the constantly expanding surveillance powers of public authorities. Although these powers are intended to protect public security, there is a lot of evidence indicating their suitability
for achieving non-legal purposes, such as social control. Unlimited control in the hands of government is a way to create an undemocratic state.

In the judgment of Centrum för Rättvisa v. Sweden (CfR), issued on 19 June 2018, the ECtHR again examined national surveillance laws, considering that the Swedish legislation introducing electronic surveillance mechanisms contained sufficient legal safeguards and, as a result, did not lead to a violation of the Convention. For the first time in
almost 10 years, the ECtHR had found no violation of standards arising from the European Convention when examining national surveillance regulations.

The judgment in the CfR case leads to the need to reassess whether and to what extent the use of mass surveillance can be reconciled with the provisions of the Convention. However, the purpose of the article is not only to discuss the judgment in detail, but also to indicate practical consequences for assessing the compliance of national surveillance regulations with the Convention. In addition, it will be considered whether the interpretation of convention provisions in the CfR case indicates a departure of the Court from its previous case-law, or whether this case-law may evolve in a direction that takes into account arguments of the supporters of strengthening the state’s powers in the field of national security.

Following the ECJ decision that declared the Data Retention Directive invalid, the Data Retention and Investigatory Powers Act 2014 (DRIP) has been enacted. It is not indisputable whether the DRIP gives more powers to the intelligence services at the detriment of both citizens’ privacy and freedom of enterprise or whether it simply clarifies the nature and extent of obligations that can be imposed on telecommunications service providers based outside the UK under Part 1 of the Regulation of Investigatory Powers Act 2000 (RIPA). The article provides news also on Data Retention Regulations 2014, R (David Davis MP and Tom Watson MP) v Secretary of State for the Home Department and the proposed Counter-Terrorism and Security Bill, making some final comment on the balance among security, privacy and competition.

Il presente articolo si prefigge l’obiettivo di analizzare l’effettiva portata del Data Retention and Investigatory Powers Act 2014, che è stato accusato di fornire nuovi poteri ai servizi segreti per controllare specialmente le società straniere (ponendo, quindi, problemi di bilanciamento fra sicurezza, diritto alla riservatezza e libertà d’impresa), mentre nelle intenzioni dichiarate dal Governo si tratterebbe semplicemente di chiarire poteri preesistenti.

Caspar Bowden, Director of the Foundation for Information Policy Research (FIPR), explains the technical and legal context of unprecedented new surveillance capabilities, with particular reference to the UK's Regulation of Investigatory Powers (RIP) Act 2000. He discusses why these powers are unlikely to be effective in detecting or disrupting the communications of terrorist cells or organized crime, but present significant new threats to the security, privacy, and freedom of expression of the law-abiding.

This article presents an analysis of public debate about a pressing political issue on a novel Web arena in a small linguistic community: the debate on Twitter about the implementation of the European Union’s Data Retention Directive in Norway. Who participates in this communication, and how can we characterize different forms of use? The analysis is based on data gathered from more than 12,000 tweets over a 16–week period. Findings reveal a heavily skewed distribution of activity among users, favoring a tiny core, which consists of five groups with different patterns of use. Discussing Twitter as an arena for public debate, I argue that, although its impact comes across as minuscule, Twitter does seem to facilitate direct engagement among adversaries. These adversaries do, however, still belong to groups that share characteristics with offline elites.

This article constitutes a short version of my forthcoming Ph.D. thesis. It delivers a human rights-based analysis of anti-terrorism policies in a European context, looking at the cases of the UK, Germany, and the EU. The article claims that all three players have at times breached human rights norms, either in terms of legal standards or in terms of the wider aims of the concept of human rights. The EU, however, provides at the same time as it breaches human rights, safeguards for the protection of the same. Human rights breaches could for the mentioned cases be detected both in terms of a more narrow legal approach to human rights connecting to legally binding rights documents and court rulings (e.g. in terms of data retention), but also in terms of a broader understanding of human rights, connecting to the wider aims of rights, such as the guarantee of dignity, freedom and justice (the ‘spirit of rights’). I further try to give some points on which short and long-term strategies might be alternatives to the rights-infringing policies that often are applied by European states when trying to counter-act the phenomenon of terrorism.

The article analyses the legitimacy of citizens telecommunications data retention usage in the fight against terrorism.  Data retention, that is the preventive storage of information on the source, data, hour and duration of a connection, type of the connection, communication tool and location of a recipient, is a powerful source of knowledge about citizens and their use should be soundly justified. However, both the European Union and Polish practices show that behind this interference in privacy there is neither a guarantee that the data stored would be used exclusively to fight terrorism and severe crimes, nor a sufficient access control mechanism. The efficiency of data use in the fight against organized crimes, including terrorism, is also dubious.
In her work the author analyses Polish studies concerning information disclosure issues, Internet publications of the European Union and American reports on retention programmes, as well as Polish and foreign positions of non-governmental organizations engaged in the civil rights protection in this respect.

Artykuł poświęcony jest problemowi wykonania wyroku Trybunału Konstytucyjnego o sygn. K 23/11 oraz wyroku Trybunału Sprawiedliwości UE o sygn. C-293/12 w sprawie przepisów regulujących retencję danych telekomunikacyjnych i warunki ich udostępniania służbom policyjnym i specjalnym. Autor stawia tezę, że warunkiem poprawnego wykonania tych orzeczeń jest wprowadzenie co do zasady mechanizmu uprzedniej zgody sądu lub niezależnego organu państwa.

La revelación de distintos programas de vigilancia estatal a nivel mundial ha puesto en el ojo público las políticas públicas de retención de metadatos. Durante el 2017, el gobierno de Michelle Bachelet se propuso extender el período de retención de los mismos, a través del apodado “Decreto Espía” que modificaba el reglamento de interceptación de comunicaciones. La declaración de ilegalidad de este Decreto por parte de la Contraloría se presenta como una oportunidad para discutir cómo compatibilizar la retención de metadatos, como forma de generar evidencia criminal, con el derecho fundamental a la privacidad y la inviolabilidad de las comunicaciones.

On 30 July 2014, the Constitutional Tribunal delivered a long-awaited judgment in which it assessed the compatibility of particular provisions of domestic law on covert electronic surveillance with the Constitution and the Convention for the Protection of Human Rights and Fundamental Freedoms. The case was heard after seven joint motions were filed in 2011 and 2012 by the Human Rights Defender (Ombudsman) and the Attorney General. The Tribunal did not deal with the provisions imposing on telecommunication providers the obligation to retain traffic and localisation data. It assessed only the statutory provisions on police and secret services’ access to retained data. The chapter discusses the roots of data retention in Poland, previous case law as well as legal effects of the Tribunal’s judgment of 2014 and its implementation by the legislator.