Slovenia / Constitutional Court / U-I-65/13-19 Information Commissioner of the Republic of Slovenia National Assembly of the Republic of Slovenia

Key facts of the case:

The Information Commissioner (hereinafter referred to as the applicant) (Informacijski pooblaščenec) requested a review of the constitutionality of Articles 162 through 169 of the Electronic Communications Act (hereinafter referred to as the ECA-1) (Zakon o elektronskih komunikacijah, ZEKom), which entered into force on 15 January 2013. By the challenged provisions the Republic of Slovenia transposed into its legal order Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC (hereinafter referred to as the Data Retention Directive). For the purposes determined by the law regulating criminal proceedings, the law regulating the functioning of the Slovene Intelligence and Security Agency (Slovenska obveščevalno-varnostna agencija, SOVA), and the law regulating the defence of the state (the first paragraph of Article 162 of the ECA-1), the challenged regulation imposed on providers of publicly available electronic communications services and public communications networks the obligation to retain certain traffic, location, and other data necessary for the identification of an individual (Article 164 of the ECA-1). Such data were to be retained for 14 months (for data regarding publicly available telephone services) or 8 months (for other data) following the date of communication. The fundamental allegation brought forward by the applicant was that, on the basis of the Data Retention Directive, Republic of Slovenia imposed on service providers the obligation to retain as a precautionary measure the traffic and location data of all users, i.e. regardless of whether the users themselves gave rise to reasons for such an interference with their rights. The applicant argued that the precautionary retention of data entailed inadmissible interferences with several fundamental rights provided by the Constitution of the Republic of Slovenia (Ustava Republike Slovenije, URS) (for example, the rights regarding the protection of personal data and communication privacy).

Paragraphs referring to EU Charter: 

 

ORDER No. U-I-65/13-16 of 26 September 2013:

5. The applicant explicitly challenges the obligation to retain data that follows from the Data Retention Directive, with regard to which the Directive does not offer Member States the possibility of a different regulation. Therefore, the applicant in fact alleges an inconsistency of the Data Retention Directive with human rights, as the Government also explicitly notes. With regard to this, the Constitutional Court deems that the alleged unconstitutionality essentially pertains, above all, to the rights to communication (Article 37 of the Constitution) and information privacy (Article 38 of the Constitution). The argumentation that due to such severe interference with the aforementioned rights the right to freedom of expression (Article 39 of the Constitution), the right to freedom of movement (Article 32 of the Constitution), and the presumption of innocence (Article 27 of the Constitution) are also consequently jeopardised, essentially entails that the disproportionate weight of the interference with the right to privacy is noted. Within the framework of European Union law, the human rights determined by Articles 37 and 38 of the Constitution are guaranteed as human rights by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union (OJ C 326, 26 October 2012 – hereinafter referred to as the Charter). Therefore, what is at issue is actually the question of whether the provisions of the Data Retention Directive are consistent with the above-mentioned provisions of the Charter.

6. By joining the European Union, the Republic of Slovenia transferred the exercise of part of its sovereign rights to the European Union on the basis of Article 3a of the Constitution.[1] From the third paragraph of Article 3a of the Constitution it follows that legal acts and decisions adopted within the framework of the European Union are applied in accordance with the legal regulation of the European Union.[2] This provision also binds the Constitutional Court, when exercising its competences, to respect the law of the European Union as it stands. The challenged provisions of the ECA-1 transpose the obligations imposed by the Data Retention Directive, i.e. their implementation entails the application of European Union law. In conformity with the first paragraph of Article 51 of the Charter, Member States are bound by its provisions when implementing European Union law.

8. With regard to the fact that the allegations regarding the unconstitutionality of the statutory provisions entail, in terms of substance, an allegation regarding the inconsistency of the provisions of the Data Retention Directive with Articles 7 and 8 of the Charter, a decision on the validity of the Data Retention Directive is of key importance for a review of the constitutionality of the provisions of the national legislation. On the basis of point b) of the first paragraph of Article 267 of the Treaty on the Functioning of the European Union (consolidated version, OJ C 326, 26 October 2012 – hereinafter referred to as the TFEU), the Court of Justice of the European Union has exclusive competence to review the validity of the Directive.[4]

9. The Court of Justice of the European Union has not yet decided on the validity of the Data Retention Directive from the viewpoint of its consistency with Articles 7 and 8 of the Charter. The question of the validity of the Data Retention Directive has nonetheless already been submitted to the Court of Justice of the European Union to be decided on as a preliminary question in case C-301/06,[5] however that case only referred to the issue of the legal basis of the Directive at issue. The question of the validity of the Directive from the viewpoint of Articles 7 and 8 of the Charter has also been submitted in cases C-293/12[6] and C-594/12.[7] The aforementioned proceedings are already pending before the Court of Justice of the European Union; an oral hearing has already been held and also a date for the submission of the opinion of the Advocate General has been set. As the substance of the alleged unconstitutionality matches the reasons due to which the proceedings on the validity of the Data Retention Directive are already pending, the Constitutional Court is not obliged to submit a request for a preliminary ruling to the Court of Justice of the European Union.

 

DECISION No. U-I-65/13-19 of 3 July 2014:

11. By its Judgment in the joined cases Digital Rights Ireland Ltd v. Minister for Communications, Marine and Natural Resources and others and Kärntner Landesregierung and others, C-293/12 and C-594/12, dated 8 April 2014 (hereinafter referred to as the Judgment in the joined cases C-293/12 and C-594/12), the Court of Justice of the European Union declared the Data Retention Directive invalid. It established that by its adoption, the legislature of the European Union exceeded the limits imposed by compliance with the principle of proportionality in the light of Articles 7 and 8, as well as the first paragraph of Article 52 of the Charter of Fundamental Rights of the European Union (OJ C 326, 26 October 2012, p. 391 – hereinafter referred to as the Charter).

15. The retention of such data (also for the purposes envisaged by the challenged regulation) entails, with regard to the established constitutional case law and also the case law of the Court of Justice of the European Union,[8] an interference with the right to the protection of personal data as guaranteed by Article 38 of the Constitution, Article 8 of the Charter[9], and also Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms (Official Gazette RS, No. 33/94, MP, No. 7/94 – hereinafter referred to as the ECHR).[10]

16. From the established constitutional case law it follows that the first paragraph of Article 38 of the Constitution guarantees the protection of personal data as a special aspect of privacy. The purpose of the protection of personal data is to ensure respect for a special aspect of human privacy – so-called information privacy. As the Constitution regulates this right specifically, it has a special place and importance in the general protection of the privacy of an individual. It also has an important place at the level of the European Union itself. Article 8 of the Charter also in a declaratory manner elevated the right to the protection of personal data to the level of a fundamental human right. In conformity with the established constitutional case law, any collecting and processing of personal data entails an interference with the right to the protection of privacy, i.e. with the right of individuals to keep information regarding themselves [private], because they do not want others to be acquainted with it. The fundamental ethical foundation of this right is the realisation that individuals have the right to retain information regarding themselves to themselves and that as a starting point it is they who can decide how much information concerning themselves they will reveal and to whom.[11] However, the right to information privacy is not unlimited and absolute. Therefore, individuals must accept the limitations of information privacy, i.e. allow such interferences that are in the prevailing public interest and if the constitutionally determined conditions are fulfilled. [Such] an interference is admissible under the conditions determined by the third paragraph of Article 15 and Article 2 of the Constitution. In this context, the Constitutional Court must assess whether the legislature followed a constitutionally admissible objective, and if it did, also whether the limitation conforms with the principles of a state governed by the rule of law, namely with that principle that prohibits excessive interferences by the state (the general principle of proportionality).[12] In the law it must be precisely determined which data may be collected and processed, and for what purpose they may be used; supervision over the collection, processing, and use of personal data must be envisaged, as well as protection of the confidentiality of the collected personal data. The purpose of the collecting of personal data must be constitutionally admissible. Only data appropriate and urgently necessary for the implementation of the statutorily defined purpose may be collected.[13] When what is at issue is the processing of personal data for the purposes of police work, the legislature must weigh the measure by which it interferes with a sensitive area of the privacy of an individual without his or her consent in an especially meticulous manner.[14] The same also applies to the processing of personal data by other authorities of the state for the purposes of the defence of the state, national security, and the constitutional system.

24. The challenged regulation provides for the precautionary (in advance) and indiscriminate retention of traffic data [generated by] certain electronic communications. A consequence of such regulation is that service providers retain, for a determined period, the traffic data of all users of phone services in fixed and mobile networks, data on accessing the Internet and e-mail, and data on the use of a phone service over an Internet protocol, such as determined by Article 164 of the ECA-1. By the precautionary and indiscriminate retention of data created daily, service providers are creating vast databases that are being retained for 14 or 8 months and from which, at any moment, very detailed conclusions can be drawn concerning facts regarding the private life of every single individual using these services.[23] With regard to the fact that the modern manner of communicating predominantly entails the use of the aforementioned electronic communications services,[24] such a measure in fact entails a very invasive interference with the (information) privacy of the entire population, both with regard to the scope of the persons affected by the measure and with regard to the data being retained. The interference with the [aforementioned] right is also exacerbated by the fact that by the creation of such an extensive database of personal data on the entire population, the risk that unauthorised persons will access the retained data or that the data will be used for unlawful purposes, despite the obligations imposed on service providers by, among other things, Article 165 of the ECA-1, increases substantially.[25] Such a regulation also substantially interferes with the human rights and fundamental freedoms of individuals since affected persons are not informed of the retention and the potential subsequent use of their data, which can in the minds of these persons generate a feeling of constant surveillance.[26] Such an intangible feeling of constant surveillance can also influence the exercise of other rights, above all the right to free expression and public communication, as guaranteed by Article 39 of the Constitution and Article 11 of the Charter.[27]

Paragraphs referring to EU Charter (original language): 

 

SKLEP št. U-I-65/13-16 z dne 26. 9. 2013

5. Predlagatelj izrecno izpodbija sámo obveznost hrambe podatkov, ki izhaja iz Direktive o hrambi podatkov in glede katere Direktiva državam članicam ne daje možnosti drugačne ureditve. Zato predlagatelj dejansko zatrjuje neskladje Direktive o hrambi podatkov s človekovimi pravicami, na kar izrecno opozarja tudi Vlada. Pri tem Ustavno sodišče šteje, da se v temelju zatrjevana protiustavnost nanaša predvsem na pravici do komunikacijske (37. člen Ustave) in informacijske zasebnosti (38. člen Ustave). Argumentacija, da zaradi tako hudega posega v navedeni pravici prihaja posledično tudi do ogrožanja pravice do svobode izražanja (39. člen Ustave), pravice do svobode gibanja (32. člen Ustave) in domneve nedolžnosti (27. člen Ustave), pa v svojem bistvu pomeni poudarjanje nesorazmerne teže posega v pravico do zasebnosti. Človekove pravice, ki jih urejata 37. in 38. člen Ustave, so v pravu Evropske unije zagotovljene kot temeljne pravice v 7. in 8. členu Listine Evropske unije o temeljnih pravicah (UL C 326, 26. 10. 2012 – v nadaljevanju Listina). Zato gre dejansko za vprašanje skladnosti določb Direktive o hrambi podatkov z navedenimi določbami Listine.

6. Republika Slovenija je s pristopom k Uniji na podlagi 3.a člena Ustave prenesla izvrševanje dela suverenih pravic na Evropsko unijo.[1] Iz tretjega odstavka 3.a člena Ustave izhaja, da se pravni akti in odločitve, sprejeti v okviru Evropske unije, uporabljajo v skladu s pravno ureditvijo Evropske unije.[2] Ta določba zavezuje tudi Ustavno sodišče, da pri izvrševanju svojih pristojnosti upošteva pravo Evropske unije tako, kot to iz njega izhaja. Izpodbijane določbe ZEKom-1 prenašajo obveznosti, ki jih nalaga Direktiva o hrambi podatkov, torej njihovo izvrševanje pomeni uporabo prava Evropske unije. V skladu s prvim odstavkom 51. člena Listine so države članice zavezane z njenimi določbami, kadar uporabljajo pravo Evropske unije.

8. Glede na to, da očitki o protiustavnosti zakonskih določb po vsebini pomenijo očitek o neskladnosti določb Direktive o hrambi podatkov s 7. in 8. členom Listine, je odločitev o veljavnosti Direktive o hrambi podatkov ključnega pomena za presojo ustavnosti določb nacionalne zakonodaje. O veljavnosti Direktive je na podlagi točke b) prvega odstavka 267. člena Pogodbe o delovanju Evropske unije (UL C 326, 26. 10. 2012 – v nadaljevanju PDEU) izključno pristojno presojati Sodišče Evropske unije.[4]

9. O veljavnosti Direktive o hrambi podatkov zaradi njene skladnosti s 7. in 8. členom Listine Sodišče Evropske unije še ni odločilo. Vprašanje o veljavnosti Direktive o hrambi podatkov je sicer že bilo predloženo Sodišču Evropske unije v predhodno odločanje v zadevi C-301/06,[5] vendar se je ta zadeva nanašala le na vprašanje pravne podlage te Direktive. Vprašanje o veljavnosti Direktive z vidika 7. in 8. člena Listine je postavljeno tudi v zadevah C-293/12[6] in C-594/12.[7] Navedena postopka pred Sodiščem Evropske unije že potekata, opravljena je bila že ustna obravnava, določen je tudi datum generalnemu pravobranilcu za predložitev sklepnih predlogov v zadevah. Ker se zatrjevana protiustavnost po vsebini ujema z razlogi, zaradi katerih že poteka postopek odločanja o veljavnosti Direktive o hrambi podatkov, Ustavnemu sodišču ni treba vložiti predloga za predhodno odločanje Sodišču Evropske unije.

 

ODLOČBA št. U-I-65/13-16 z dne 3. 7. 2014

11. Sodišče Evropske unije je s sodbo v združenih zadevah Digital Rights Ireland Ltd proti Minister for Communications, Marine and Natural Resources in drugim ter Kärntner Landesregierung in drugi, C-293/12 in C-594/12, z dne 8. 4. 2014 (v nadaljevanju sodba v združenih zadevah C-293/12 in C-594/12) Direktivo o hrambi podatkov razglasilo za neveljavno ab initio. Ocenilo je, da je zakonodajalec Evropske unije z njenim sprejetjem prekoračil meje, ki jih zahteva spoštovanje načela sorazmernosti, upoštevaje 7. in 8. člen ter prvi odstavek 52. člena Listine Evropske unije o temeljnih pravicah (UL C 326, 26. 10. 2012, str. 391 – v nadaljevanju Listina).

15. Hramba takih podatkov (tudi za namene, kot jih predvideva izpodbijana ureditev) pomeni glede na ustaljeno ustavnosodno presojo in tudi prakso Sodišča Evropske unije[8] poseg v pravico do varstva osebnih podatkov, ki jo zagotavljajo 38. člen Ustave, 8. člen Listine[9] in tudi 8. člen Konvencije o varstvu človekovih pravic in temeljnih svoboščin (Uradni list RS, št. 33/94, MP, št. 7/94 – v nadaljevanju EKČP).[10]

16. Iz ustaljene ustavnosodne presoje izhaja, da se v prvem odstavku 38. člena Ustave kot poseben vidik zasebnosti zagotavlja varstvo osebnih podatkov. Namen varstva osebnih podatkov je zagotoviti spoštovanje posebnega vidika človekove zasebnosti – t. i. informacijsko zasebnost. S tem ko Ustava to pravico posebej ureja, ji daje posebno mesto in pomen v siceršnjem varstvu zasebnosti posameznika. Posebno mesto ima tudi na ravni Evropske unije. Listina je pravico do varstva osebnih podatkov v 8. členu tudi deklaratorno povzdignila med temeljne človekove pravice. Po ustaljeni ustavnosodni presoji pomeni vsako zbiranje in obdelovanje osebnih podatkov poseg v pravico do varstva zasebnosti oziroma v pravico posameznika, da obdrži informacije o sebi, ker noče, da bi bili z njimi seznanjeni drugi. Temeljna vrednostna podstat te pravice je spoznanje, da ima posameznik pravico zadržati informacije o sebi zase in da je v izhodišču on tisti, ki odloča, koliko informacij o sebi bo razkril in komu.[11] Vendar pravica do informacijske zasebnosti ni neomejena, ni absolutna. Zato mora posameznik sprejeti omejitve informacijske zasebnosti oziroma dopustiti posege vanjo v prevladujočem splošnem interesu in ob izpolnjevanju ustavno določenih pogojev. Poseg je dopusten pod pogoji iz tretjega odstavka 15. člena in 2. člena Ustave. V tem okviru mora Ustavno sodišče presoditi, ali je zakonodajalec sledil ustavno dopustnemu cilju, če je ta podan, pa še, ali je omejitev skladna z načeli pravne države, in sicer s tistim izmed teh načel, ki prepoveduje prekomerne posege države (splošno načelo sorazmernosti).[12] V zakonu mora biti določno opredeljeno, kateri podatki se smejo zbirati in obdelovati, za kakšen namen jih je dovoljeno uporabiti, predvidena morata biti nadzor nad zbiranjem, obdelovanjem in uporabo osebnih podatkov ter varstvo tajnosti zbranih osebnih podatkov. Namen zbiranja osebnih podatkov mora biti ustavno dopusten. Zbirati se smejo le podatki, ki so primerni in nujno potrebni za uresničitev zakonsko opredeljenega namena.[13] Ko gre za obdelavo osebnih podatkov za namene policijskega dela, mora zakonodajalec še posebej skrbno pretehtati težo ukrepa, s katerim brez privolitve posameznika posega v občutljivo območje njegove zasebnosti.[14] To velja tudi za obdelavo osebnih podatkov v drugih državnih organih za potrebe obrambe države, nacionalne varnosti in ustavne ureditve.

24. Izpodbijana ureditev predvideva preventivno (vnaprejšnjo) in nediskriminacijsko hrambo prometnih podatkov določenih elektronskih komunikacij. Posledica takšne ureditve je, da operaterji hranijo določen čas prometne podatke vseh uporabnikov telefonskih storitev v fiksnem in mobilnem omrežju, podatke pri dostopu do interneta, elektronske pošte in uporabe telefonije prek internetnega protokola, kot jih predvideva 164. člen ZEKom-1. Z vnaprejšnjo in neselektivno hrambo podatkov, ki nastajajo vsakodnevno, se pri operaterjih ustvarjajo ogromne podatkovne zbirke podatkov, ki se hranijo 14 oziroma 8 mesecev in iz katerih je mogoče v vsakem trenutku izluščiti zelo podrobna dejstva zasebnega življenja vsakega posameznika, ki uporablja te storitve.[23] Glede na to, da sodobni način komuniciranja pomeni v pretežni meri uporabo navedenih elektronskih komunikacijskih storitev,[24] tak ukrep v bistvu pomeni zelo invaziven poseg v (informacijsko) zasebnost celotne populacije, tako po obsegu oseb, ki jih ukrep zadeva, kot tudi glede na podatke, ki se hranijo. Poseg v pravico izostri tudi dejstvo, da se z nastankom tako obsežne zbirke osebnih podatkov celotne populacije izrazito poveča tveganje, da bodo do hranjenih podatkov kljub obveznostim, ki jih operaterjem med drugim nalaga 165. člen ZEKom-1, dostopale nepooblaščene osebe oziroma da se bodo podatki uporabili za nezakonite namene.[25] Taka ureditev izrazito posega v človekove pravice in temeljne svoboščine posameznika tudi zato, ker prizadete osebe o hrambi in morebitni kasnejši uporabi njihovih podatkov niso obveščene, kar lahko pri njih ustvari občutek stalnega nadzora.[26] Takšen neoprijemljiv občutek stalnega nadzora pa lahko vpliva tudi na izvrševanje drugih pravic, predvsem pravice do svobodnega izražanja in obveščanja, kot jo zagotavljata 39. člen Ustave in 11. člen Listine.[27]

Language: 
Slovenian
Deciding body (original language): 
Ustavno sodišče Republike Slovenije
Language: 
Slovenian