Article 7 - Respect for private and family life
Article 8 - Protection of personal data
Article 11 - Freedom of expression and information
Article 52 - Scope and interpretation
Key facts of the case:
The applicant sought to annul an order issued by a lower court for access to his data by the police. The lower court had granted to the police the right to access IP addresses and dialled numbers on the basis of an affidavit sworn by the police which stated that the applicant was suspected of serious criminal offences relating to child pornography. Τhe applicant claimed that the order for accessing his data relied on the data retention law which had been declared invalid in 2021 by the Supreme Court in Hadjioannou for violating for infringing Directive on personal data and privacy in electronic communications, as well as the CJEU ruling in Tele Sveringe. The Court relied on national judicial precedent which found that the invalidation of the Data Retention Directive by the Digital Rights Ireland case did not affect IP addresses.
Key legal question raised by the Court:
Whether the IP address at the critical time was a personal data of the user. Τhe Court considered the CJEU ruling in La Quadrature which established that IP addresses are created for the purpose of identification of the physical person in possession of the terminal from which internet communication takes place. To the extent that the IP addresses retained are those referring to the source of communication and not to the receiver of the communication, these IP addresses do not reveal any information about third parties and as such, this category of data is less sensitive than other data. The CJEU underlined that since IP addresses can also be used to trace the navigation path of internet users and their online activity, they provide the means to identify the user's profile and therefore the necessary information for the tracing, the retention and analysis of IP addresses constitutes a serious interference with the fundamental rights of the internet user as enshrined in Articles 7, 8 and 11(1) of the Charter. The Supreme Court found that a legislative measure which provides for the general and indiscriminate retention only of the IP addresses assigned to the source of the connection is not, in principle, contrary to Article 15(1) of Directive 2002/58/EC, or Article 52(1) of the Charter, so long as the retention is subject to strict compliance with the substantive and procedural conditions surrounding the use of the data. The Supreme Court further stated that, in the more recent CJEU ruling in Bundesrepublik Deutschland v. SpaceNet AG and Telekom Deutschland Gmbh of 2022, the CJEU found that article 15 of Directive 2002/58/EC, interpreted through the lenses of Charter articles 7, 8, 11 and 52(1), permits member states to adopt, for the purpose of combating serious crime, measures of not only targeted and emergency retention but also general and indiscriminate retention as regards data concerning the identity of users and IP address attributed to the source of connection. The general retention of IP address amounts to an infringement of Charter articles 7 and 8 if they can lead to conclusions regarding the private life of the user and can have an impact on the right to free expression safeguarded under Charter article 11. When investigating dissemination of child pornography, the IP address can be the only means of investigation for identifying the person to whom the IP address was attributed at the time of committing the crime. Taking into account the seriousness of interfering with the rights guaranteed in Charter articles 7 and 8, only the combating of serious crime and preventing threats against public security can justify such interference and the retention must be of such duration that does not exceed what is absolutely necessary and must be regulated by strict safeguards. The Supreme Court cited the findings of the CJEU in Asociatia "Forumul Judecatorilor din Romania" v. Inspectia Judiciara (2021) regarding the supremacy of EU law over national law and in particular the duty of national courts to disapply national provisions, irrespective of their chronological sequence of adoption, in order to ensure the effective implementation of Union law, without having to wait for the prior elimination of the national provision which conflicts with the EU acquis. The Supreme Court found that the Hadjioannou case could not have led to the invalidation of the data retention law but only to a conclusion of its non-applicability; this means that article 15(1) of Directive 2002/58/EC, interpreted through the lenses of Charter articles 7, 8, 11 and 52(1), permits national law to adopt measures for combating serious crime, such as the general and indiscriminate retention of IP addresses attributed to the source of a connection for a duration limited to what is absolutely necessary for the purpose with precise regulations and safeguards against abuse.
Outcome of the case:
The Court concluded that the IP address is not personal data of the user but belong to the provider. It becomes personal data of the user only if and when the service provider provides the data of the user that can lead to the user’s whereabouts. As a result the user cannot claim that access to the IP address was unlawful; only the service provider can raise such a claim. The IP address is traceable and there public and, contrary to a telephone number, the IP address belongs to the provider and not the user; for this reason there is no need for a court order in order to access the IP address. The service provider lends the IP address to the user for temporary use and it is only to the extent that the IP address becomes personal data that a court order is needed for its recovery. The Supreme Court upheld the lower court decision regarding access to the IP address and overturned the lower court’s finding as regards telephone data of the dialled number.
Although the protection of telecommunication data is not absolute, the national legislator is obliged to implement the Directive in a way that is compatible with the Charter. In this regard, Articles 3, 6, 7, 7, 8, 9 and 10 of the Law contain provisions on the general and indiscriminate retention of telecommunication data, in that they provide for the retention of all traffic and location data of all subscribers and registered users relating to the means of electronic communication, for the purpose of investigating serious criminal offences, giving rise to the question whether such 'universal' data retention is compatible with European Union law, as interpreted in the case-law of the Court of Justice of the European Union, and in particular with the rights enshrined in the Charter.
…
The CJEU further stressed that since IP addresses can also be used to fully trace the navigation path of the internet user (and his online activity), the data provide the means to detail the user's profile and therefore the necessary information for the tracing, retention and analysis of IP addresses constitutes a serious interference with the fundamental rights of the internet user as enshrined in Articles 7, [4] 8 [5] and 11(1)[6]of the Charter of Fundamental Rights of the European Union ("the Charter").
In the circumstances, continued the CJEU, although it is accurate that a legislative measure to maintain the IP addresses of all persons who own terminal equipment through which access to the internet can be obtained, concerns persons who are prima facie unconnected to the intended purposes (and regardless of whether internet users have a legitimate expectation that their identity will not be disclosed), a legislative measure which specifies general and indiscriminate retention only of the IP addresses assigned to the source of the connection is not, in principle, contrary to Article 15. 1, Directive 2002/58/EC, or Article 52.1 of the Charter, provided that the discretion is subject to strict compliance with the substantive and procedural conditions surrounding the use of the data.
The fact that SpaceNet was issued later than Hadgioannou does not preclude judicial review of the legality of the order on the basis of the (fresh) reasoning of SpaceNet, because the present issue is also whether the order appears to be compatible with the acquis communautaire, which, under Article 1A of the Constitution, has increased force over the Constitution, and this is because - and I say this by paraphrase and by analogy - the interpretation given to Directive 2002/58/EC in SpaceNet by the CJEU to the protection of the fundamental rights protected by the Charter, this (the interpretation) is considered to have existed since the adoption of the Directive" (In re Kkolos, Application, P.C. 26/17, 26.4.18 ["the Kkolos"]).
Taking into account the above legislative and jurisprudential provisions - EU and national - I respectfully consider that the approach to the present case, and by extension the judgment on the legality (or not) of the order, should be considered in the light of the aforementioned provisions of Directive 2002/58/EC, together with similar references to the Charter, but also to the clear case law of the CJEU on IP addresses and the impact on the efforts to combat child pornography (online and otherwise).
In view of the above, it appears that Article 15. 1, Directive 2002/58/EC, interpreted in the light of Articles 7, 8, 11 and 52(1) of the Charter, permits the national legislature to adopt measures to combat serious crime - such as the general and indiscriminate retention of IP addresses attributed to the source of the connection - for a period of time limited to what is strictly necessary, provided that the measures ensure (by means of clear and precise rules) that the retention of the data is subject to compliance with the relevant essential and formal conditions, and that the persons to whom the data relate have effective safeguards against any risks of misuse.
Παρόλο που η προστασία των τηλεπικοινωνιακών δεδομένων δεν είναι απόλυτη, ο εθνικός νομοθέτης υποχρεούται να εφαρμόσει την Οδηγία κατά τρόπο που να είναι συμβατός με τον Χάρτη. Εν προκειμένω, τα άρθρα 3, 6, 7, 8, 9 και 10 του Νόμου περιλαμβάνουν πρόνοιες για τη γενική και χωρίς διάκριση διατήρηση τηλεπικοινωνιακών δεδομένων, με την έννοια ότι προβλέπεται η διατήρηση όλων των δεδομένων κινήσεως και των δεδομένων θέσεως όλων των συνδρομητών και των εγγεγραμμένων χρηστών που αφορούν τα μέσα ηλεκτρονικής επικοινωνίας, με σκοπό τη διερεύνηση σοβαρών ποινικών αδικημάτων ώστε να εγείρεται το ερώτημα κατά πόσο, η «καθολική» αυτή διατήρηση δεδομένων είναι συμβατή με την ενωσιακή νομοθεσία, όπως έχει ερμηνευθεί στη νομολογία του ΔΕΕ, και ειδικότερα με τα δικαιώματα που κατοχυρώνονται στο Χάρτη.
……
Το ΔΕΕ υπογράμμισε προσέτι πως δοσμένου ότι οι Διευθύνσεις ΙΡ είναι δυνατόν να χρησιμοποιηθούν και για την ολοσχερή ιχνηλάτηση τής διαδρομής πλοήγησης του διαδικτυακού χρήστη (και της διαδικτυακής του δραστηριότητας), τα δεδομένα παρέχουν το μέσο λεπτομερούς προσδιορισμού τού προφίλ τού χρήστη και συνεπώς η απαιτούμενη για την ιχνηλάτηση, διατήρηση και ανάλυση των Διευθύνσεων ΙΡ, συνιστά σοβαρή επέμβαση στα θεμελιώδη δικαιώματα τού διαδικτυακού χρήστη ως τούτα κατοχυρώνονται στα Άρθρα 7, [4] 8 [5] και 11(1)[6] του Χάρτη των Θεμελιωδών Δικαιωμάτων της Ευρωπαϊκής Ένωσης («ο Χάρτης»).
Υπό τις συνθήκες, συνέχισε το ΔΕΕ, αν και ακριβές πως ένα νομοθετικό μέτρο για τη διατήρηση των Διευθύνσεων ΙΡ τού συνόλου των προσώπων που είναι ιδιοκτήτες τερματικού εξοπλισμού διά του οποίου μπορεί να επιτευχθεί πρόσβαση στο διαδίκτυο, αφορά σε πρόσωπα τα οποία, από μια πρώτη όψη, δεν συνδέονται με τους επιδιωκόμενους σκοπούς (και ασχέτως αν οι χρήστες τού διαδικτύου έχουν νόμιμη προσδοκία πως η ταυτότητα τους δεν θα αποκαλυφθεί), ένα νομοθετικό μέτρο που προσδιορίζει γενική και αδιάκριτη διατήρηση, μονάχα των Διευθύνσεων ΙΡ που εκχωρούνται στην πηγή της σύνδεσης δεν είναι, κατ' αρχήν, αντίθετο προς το Άρθρο 15.1, Οδηγία 2002/58/ΕΚ, ή και το Άρθρο 52.1 του Χάρτη,[8] υπό τον όρο ότι η ευχέρεια υπόκειται σε αυστηρή τήρηση των ουσιαστικών και διαδικαστικών προϋποθέσεων που περιβάλλουν τη χρήση των δεδομένων.
…..
Το γεγονός ότι η SpaceNet εκδόθηκε μεταγενέστερα της Χατζηιωάννου, δεν αποκλείει τον δικαστικό έλεγχο της νομιμότητας του Διατάγματος στη βάση του (νωπού) σκεπτικού της SpaceNet, επειδή το ενεστώτως ζητούμενο είναι και το κατά πόσο το Διάταγμα εμφανίζεται συμβατό «. με το Κοινοτικό Κεκτημένο, το οποίο, με βάση το Άρθρο 1Α του Συντάγματος, έχει αυξημένη ισχύ έναντι του Συντάγματος .», και τούτο γιατί - και το λέγω κατά παράφραση και κατ' αναλογία - με την ερμηνεία που έτυχε η Οδηγία 2002/58/ΕΚ στην SpaceNet «. από το ΔΕΕ στην προστασία των Θεμελιωδών Δικαιωμάτων που προστατεύονται από το Χάρτη .», τούτη (η ερμηνευτική) «. θεωρείται πως υπήρχε από τη θέσπιση της Οδηγίας» (Αναφορικά με την Αίτηση του Κκολού, Π.Ε. 26/17, ημ. 26.4.18 [«η Κκολού»]).
Συνεκτιμώντας τις παραπάνω νομοθετικές και νομολογιακές προβλέψεις - ενωσιακές και εθνικές - θεωρώ με κάθε σεβασμό ότι η προσέγγιση στην παρούσα, και κατ' επέκταση η κρίση επί της νομιμότητας (ή όχι) του Διατάγματος, θα πρέπει να εξεταστεί υπό το πρίσμα των προαναφερθεισών προνοιών τής Οδηγίας 2002/58/ΕΚ, συνταιριαζόμενων προς ανάλογες αναφορές στον Χάρτη, αλλά και στη σαφή νομολογία του ΔΕΕ για τις Διευθύνσεις ΙΡ και την επίδραση τους στον μόχθο εξουδετέρωσης της παιδικής πορνογραφίας (διαδικτυακής και άλλης). … Των ως άνω, δοθέντων, αναφύεται ότι το Άρθρο 15.1, Οδηγία 2002/58/ΕΚ, ερμηνευμένο υπό τον φακό των Άρθρων 7, 8, 11 και 52(1) του Χάρτη, επιτρέπει στον εθνικό νομοθέτη να θεσπίζει μέτρα για την καταπολέμηση της σοβαρής εγκληματικότητας - όπως η γενική και αδιάκριτη διατήρηση Διευθύνσεων ΙΡ οι οποίες αποδίδονται στην πηγή της σύνδεσης - για χρονικό διάστημα περιοριζόμενο στο απολύτως αναγκαίο δεδομένου πως τα μέτρα διασφαλίζουν (με σαφείς και ακριβείς κανόνες) πως η διατήρηση των δεδομένων εξαρτάται από την τήρηση των σχετικών προς τούτο ουσιωδών και τυπικών προϋποθέσεων, και ότι τα πρόσωπα στα οποία αφορούν τα δεδομένα, διαθέτουν αποτελεσματικές εγγυήσεις έναντι των όποιων κινδύνων κατάχρησης.
