A ruling by the EU Court of Justice calls into question how internet traffic data is handled by investigating authorities. An unbalanced interpretation of data protection rules puts European public order and national security at risk. Analysis by Andrea Monti, professor of law of public order and security, University of Chieti-Pescara – Originally published in Italian by Formiche.net
The judgement issued on 2 March 2021 by the European Court of Justice in case C-746-18 re-proposes the legitimacy of carpet data-retention – the mandatory and preventive storage of telematic traffic data by telephone operators and internet providers.
The Court, however, did not merely reiterate a principle already expressed in other rulings, according to which indiscriminate access to traffic data should not be allowed. That judgment affirmed the principle that the EU law precludes national legislation, which renders the public prosecutor, whose task it is to direct criminal investigation proceedings and, where appropriate, to prosecute in subsequent proceedings, competent to authorise access by a public authority to traffic data and location data for a criminal investigation.
In other words, in the Court’s view, traffic data are like wiretapping: they may be used only to prosecute certain offences and may enter a criminal investigation only if a court has given a favourable opinion.
Although it related to an Estonian case, this decision was also hailed in Italy, ‘in the name of privacy’, as yet another blow to the rules on the mandatory retention of traffic data provided for by the Personal Data Code and as a picklock to challenge the rules of the Code of Criminal Procedure allowing the public prosecutor to order operators to hand over the data in question.
This judgment and the consequences that privacy enthusiasts would like to draw from it expose the structural limits that afflict the EU in the field of security and the indirect attempt to condition the choices of individual Member States in areas removed from EU jurisdiction. Defence and state security, not to mention criminal matters, are political, even more than legal, areas of strict national relevance. Nevertheless, the EU still pushes for measures and decisions such as those mentioned in this article. It is a silent trend that has been present for a long time, in the evolution of which the regulations on the processing of personal data play a central role, which does not consider the evolution of the methods of prevention and counteraction to organised crime and terrorist groups.
The traffic data is a very precious asset for the prevention of acts against the security of the State, not only and not so much because it would allow the ‘prediction’ of the occurrence of events through ‘artificial intelligence platforms’ which belong more to the domain of science fiction than to that of reality. Unlike a criminal investigation, which has a limited duration and needs to focus only on those data necessary for the trial, the needs of security require the possibility of being able to ‘re-read’ information which previously had no importance, but which, in light of new elements, acquires significance. In other words, to file all the data of telematic traffic and conserve it so that it is available to the intelligence agencies is a necessity that is difficult to dispute, but in fact, significantly disputed.
As long as, however, the debate remains polarised in a dialogue between deafs in which advocates of ‘privacy’ at all costs and devotees of the sacrifice of individual rights in the name of greater good confront each other, it is difficult to find a concrete balance, as this ruling of the European Court shows.
It is necessary to manage several dossiers to get out of this paralysis. The first, long-standing issue is that of definitively overcoming national competences in criminal justice and security, which presupposes the adoption of a European constitution and thus the transformation of the EU into a political entity fully entitled to influence the security policies of the member states. The second, consequently, is the transformation of national security from a political instrument into a legal institution. As long as national security remains a category outside the system of fundamental rights and public interests, it will be impossible to strike a sufficient balance.
The jurisdictionalisation of national security is not a mandatory choice. Purely political considerations can induce one to keep national security areas outside of a legal perimeter to include them within the sphere of control of the executive power. However, national security has an ambiguous positioning. It floats between politics and law. Its unclear nature created difficult situations between the State’s powers, as is demonstrated by the many cases in which governments have resorted to the imposition of secrecy.