Article 7 - Respect for private and family life
Article 8 - Protection of personal data
Article 11 - Freedom of expression and information
Article 52 - Scope and interpretation
Key facts of the case:
A group of members of the National Assembly (the lower chamber of the Slovenian parliament), requested the review of constitutionality of provisions of the Criminal Procedure Act (the CPA). The Constitutional Court decided to review the case in three separate parts, which led to three partial decisions. The case analysed here is the third partial decision of the Constitutional court. The MPs argued that the regulation for (ex ante and ex post) obtaining the so-called “traffic”, “location” and “subscription” data for the purposes of criminal prosecution (Articles 149.b, 149.c and 149.č of the CPA), is contrary to the right of communication privacy from Article 37 of the Constitution and informational privacy from Article 38 as it is not clear, precise and foreseeable, and disproportionately interferes with the aforementioned rights.
Key legal question raised by the Court:
Whether the provisions of the CPA, regulating the procedure, substantive and procedural conditions for obtaining the so-called “traffic”, “location” and “subscription” data for the purposes of criminal prosecution comply with Articles 37 and 38 of the Slovenian Constitution. More specifically, in relation to the regime for obtaining traffic data ex post (Article 149.b CPA) and the regime for securing and obtaining traffic and location data ex ante (Article 149.c CPA), the Constitutional court had to determine whether the standard of proof was high enough, whether the period for which the data can be obtained was adequately prescribed and whether the list of crimes for which the measures can be taken was narrowly tailored to match the invasiveness of the measures. Regarding the “subscription” data, the Court had to determine whether the regulation was clear, precise and foreseeable enough to satisfy the principle of legality.
Outcome of the case:
The Constitutional court first devoted its attention to the nature of the impugned measures. It found that the measures (ex post and ex ante acquisition of traffic and location data), constitute a serious interference with the right to privacy as such data can be used by the authorities to glean from the data very precise conclusions on the private life of persons, against whom they are used. The Court found the standard of proof, required to trigger these measures, to be inadequate. It amounted only to “reasons for suspicion” which is the lowest standard of proof, required for the Police to start its investigatory activities, and reflects the lowest level of probability that the crime has been committed. Such standard does not have the quality of “reasonable suspicion”, which is preliminary, concrete, specific and articulated. Given the invasiveness of the measures and the requirement of the Constitution that interferences with communication privacy are based on an ex ante judicial warrant, which is reasoned, such a standard is too low. The Court concluded that the legislation is disproportionate strictu sensu and thus contrary to Article 37 of the Constitution. The Court came to the same conclusion with regards to the period for which the data can be obtained for the purposes of criminal prosecutions. In relation to Article 149b of the CPA, the Court found that such period was not defined in the CPA. Article 37 of the Constitution required more than merely relying of the abstract standard of proportionality and certain limitations, determined in the sectorial (non-criminal law) legislation. The CPA should have itself lay down clear temporal limitation of the criminal law interference with the communication privacy by obtaining or accessing traffic data, having regard to the principle of proportionality. As to Article 149.c, the Court acknowledged that the time period is defined by the CPA. However, it found that the time period of max 3 months on the basis of first judicial warrant and additional 3 months based on another judicial warrant does not reflect the requirements of proportionality, as it does not allow for a nuanced approach required by the invasiveness of these measures and the principle of proportionality. The Court indicated that a proportionate period would be 1 month with subsequent potential prolongation for one month each time up to 6 months. Concerning the list of crimes, for which the measures can be taken, the Court referred to the jurisprudence of the CJEU. It ruled that the CPA is too broad as it allows the use of these secret measures not only in relation to serious crime, as the CJEU jurisprudence requires, but also in relation to many “ordinary” crimes. In relation to “subscription” data (Article 149.č of the CPA), the Court found that the CPA can be interpreted in a way compliant with the Constitution. To reach this conclusion, it relied heavily on the ECtHR case of Benedik v Slovenia and the guiding principle in this case: the concept of reasonable expectation of privacy. The Court ruled that when a person reasonably expects privacy (as in the case of Benedik), and the subscription data can be used to identify the user, these data can be legally obtained only under the conditions of Article 149.b and Article 37 of the Constitution (prior judicial warrant etc.). Conversely, when there is no reasonable expectation of privacy, the authorities may rely on Article 149.č (Article 38 of the Constitution – protection of personal data) and do not need a prior court warrant. The group of MPs also argued that the impugned provisions are unclear and unforeseeable. The Court rejected their arguments in relation to the quality of the law (principle of legality), since it found that all the provisions can be interpreted by the established methods of interpretation to find a clear enough content. The Charter featured prominently in this case and had a decisive impact on its outcome. The Court invoked the requirements of the Charter from the CJEU jurisprudence to set the benchmark against which it then assessed the impugled provisions of the CPA. At the same time, the relevant CJEU case law (interpreting the Charter) allowed the Court to enhance the national standards of privacy in this field (Articles 37 and 38 of the Constitution). Henceforth, the Charter standards were not only decisive for the concrete case, as they contributed to the impugned provisions being declared unconstitutional, but the Charter also sets the standards that bind the legislator in this field.
42. The CJEU has also not yet in its case law addressed the level of the standard of proof required by Article 15 of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (OJ L 201, 31 July 2002 - hereafter "the ePrivacy Directive") in order to interfere with the rights set out in Articles 7 and 8 of the Charter. However, in its judgment in Tele2 Sverige, C 203/15, of 21 December 2016, the Court stated that national legislation must be based on objective criteria defining the conditions and circumstances under which access to traffic data of subscribers and registered users may be granted. In general, such access in the context of the fight against criminal offences may be granted to individuals who are suspected of planning, committing or carrying out a serious criminal offence or otherwise being involved in such an offence. In this part of the judgment, the CJEU referred to the analogy with paragraph 260 of the reasoning of the judgment of the Grand Chamber of the ECtHR in Roman Zakharov v. Russia of 4 December 2015, in which the ECtHR stated that the authority granting access to data must be able to verify the existence of a reasonable suspicion (reasonable suspicion, soupçon raisonnable) against a person, in particular that it must be able to verify whether there is a factual basis for suspecting that a person is planning, is committing, or has committed criminal offences or other acts that may form the basis for covert investigative measures (for example, offences against national security).
50. The Constitution itself provides in Article 37(2) that the protection of the secrecy of letters and other communications and the inviolability of a person's privacy may be interfered with only for a limited period of time. The importance of temporal limitations on the acquisition of traffic data stems both from the established pre-judgment of the Constitutional Court and from the case law of the ECtHR. However, the CJEU has repeatedly emphasised in La Quadrature du Net and Others that the retention of traffic and location data for national security purposes, the focused or targeted retention of traffic and location data, the non-discriminatory and general retention of IP addresses of the source of an internet connection for the purpose of protecting national security, the fight against serious crime and the prevention of serious threats to public security, and the accelerated retention of traffic and location data of these users for the purpose of the fight against serious crime and the protection of national security, shall be permissible only for the period strictly necessary, which may be extended in certain cases. The longer the period for which access is requested, the greater, in the view of the CJEU, will be the amount of data that could be stored by providers of electronic communications services concerning the electronic communications made by the user of the electronic means of communication, the places where the user is present and the movements of the user, so that more information about the private life of the user can be gleaned from the data examined. In order to comply with the proportionality requirement, according to which derogations from, and limitations on, the protection of personal data must be limited to what is strictly necessary (judgment of the CJEU in Joined Cases La Quadrature du Net and Others, para. 130), it is therefore for the competent national authorities, in each individual case, to ensure that, in the light of the circumstances of the case, both the type or types of information requested and the period of time for which access to that information is sought are limited to what is strictly necessary for the purposes of the investigation in question. However, interference with the fundamental rights set out in Articles 7 and 8 of the Charter, such as access by a public authority to any traffic or location data from which information may be obtained about the communications of the user of an electronic means of communication or about the location of the terminal equipment used, is, in the view of the CJEU, serious, irrespective of the length of the period of time for which access to that data is requested and irrespective of the amount or type of data available for that period, provided that all that data is capable of leading to an accurate inference as to the private life of the individual or individuals to whom the personal data relate.
53. Notwithstanding the above, in the view of the Constitutional Court, the abstract limitation set out in the sectoral non-criminal legislation and the limitation arising in the specific case from the principle of proportionality (Article 2 of the Constitution), i.e. that it is only possible to obtain data for a period of time that is relevant and strictly necessary for the specific (pre-)criminal case (see paragraph 52 of the reasoning of this Decision), are not sufficient. In its judgment in The Commissioner of the Garda Síochána, the CJEU stated that the retention of such data and access to them are, as can be seen from its case-law (see CJEU judgment in La Quadrature du Net and Others, Joined Cases 115 and 116 and the case-law cited therein), distinct interferences with the fundamental rights guaranteed by Articles 7 and 11 of the Charter, for which separate justifications are required on the basis of Article 52(1) of the Charter. It follows, in the view of the CJEU, that national legislation requiring full compliance with the conditions resulting from the case-law interpreting the Directive on privacy and electronic communications in the field of access to stored data cannot in itself either limit or eliminate the serious interference, resulting from the general retention of those data provided by that national legislation, with the rights guaranteed by Article 5 and 6 of the directive, in with fundamental rights, these provisions give concrete expression. (Judgment of the CJEU in The Commissioner of the Garda Síochána, para. 47) The reverse is also true; the CPA should, on the basis of Article 37(2) of the Constitution, itself determine a clear abstract time limit for the criminal law interference with communication privacy by obtaining or accessing traffic data, taking into account the principle of proportionality and a nuanced approach to interference with human rights and fundamental freedoms, whereas the ZEKom-2 already regulates the time limits for the storage of the traffic data accessed by the contested measure. This would also prevent the possible acquisition of data which, although they should no longer be retained under the ZEKom-2, nevertheless exist.
56. It is also clear from the settled case law of the ECtHR and the CJEU that access to stored traffic data can only be justified by the fight (prevention, detection or prosecution) against serious crime or the most serious crimes (for example, the fight against drug trafficking, organised crime and money laundering). Thus, in the above-mentioned judgment in La Quadrature du Net and Others, the CJEU emphasised that only the prevention of serious threats to public security and the fight against serious crime can justify serious interference with the fundamental right laid down in Articles 7 and 8 of the Charter. Therefore, only milder interferences with the aforementioned fundamental right, i.e. interferences from which the data obtained do not enable precise conclusions to be drawn about the private life of the data subjects, can be justified in general with a view to the prevention, investigation, detection and prosecution of criminal offences. Access by public authorities to any traffic or location data which may reveal information on the communications of the user of an electronic means of communication or on the location of the terminal equipment used, allows for accurate conclusions to be drawn concerning the private life of data subjects. In the view of the CJEU, this can only be justified by the objective of combating serious crime (and preventing serious threats to public security), without other factors relating to the proportionality of the access request, such as the duration of the period for which access to such data is requested, being capable of having the effect of justifying such access by the objective of preventing, investigating, detecting and prosecuting criminal offences in general. It follows from the above case-law of the Constitutional Court, the ECtHR and the CJEU that access to traffic data under Article 149b(1) of the CCP, which may constitute a serious interference with the right to privacy of the person whose data may be obtained, is only relevant for the detection, prosecution and proving of serious criminal offences.
88. The CJEU similarly held, in the aforementioned judgment in La Quadrature du Net and Others, that the collection of (traffic and) location data constitutes an interference with the fundamental rights to privacy and to the protection of personal data laid down in Articles 7 and 8 of the Charter, irrespective of the sensitivity of the data and irrespective of whether the person has suffered any inconvenience as a result of the transaction (CJEU judgment in La Quadrature du Net and Others, recital 115, reasoning). See also CJEU Opinion 1/15 (EU-Canada PNR deal) of 26 July 2017, paras. 124 and 126; and ECtHR judgment in Breyer v Germany of 30 January 2020, para. 81.) The CJEU also takes the view that the collection of (traffic and) location data and access to it by public authorities for the purposes of criminal proceedings or national security falls within the scope of the Directive on privacy and electronic communications. (Joined CJEU judgment in La Quadrature du Net and Others, paras. 68, 104, 117-120)
101. With regard to the definition of the catalogue of offences in respect of which the measure referred to in Article 149c(1) and (3) of the CPA may be adopted, the Constitutional Court also refers to its views on the catalogue of offences in relation to the measure under Article 149b(1) of the CPA (see paras 55-56 of this decision). It further points out that the CJEU, in its judgment in La Quadrature du Net and Others, specifically dealt with the acquisition of real-time traffic data, and in doing so strongly emphasised the requirement that the catalogue of criminal offences be limited. It has allowed access to automated analysis and to the collection of real-time traffic and location data, and to such collection of technical data concerning the location of the use of terminal equipment, inter alia, if (1) the automated analysis is limited to situations in which a Member State is faced with a threat to national security that is serious and present and (2) the collection of real-time traffic and location data is limited to persons in respect of whom there are valid grounds for suspecting that they are in some way involved in terrorist activity. (Judgment of the CJEU in Joined Cases La Quadrature du Net and Others, paragraph 188. See also P. Križnar in M. Šepec (ed.), op. cit.).
176. It follows from the settled case-law of the ECtHR and the CJEU that, as a criterion for assessing the proportionality of the interference with the rights laid down in Articles 7 and 8 of the Charter and Article 8 of the ECHR, respectively, and for assessing access to traffic data, the courts have also laid down that access to stored data is, in principle, granted by a court of law or by an independent administrative authority on a reasoned request, except in duly justified cases of urgency, and that a prosecution order with judicial review is sufficient, but that a court order is required where there is a legitimate expectation of privacy. In Benedik v Slovenia, the ECtHR considered, inter alia, the alleged violation of the complainant's right under Article 8 ECHR due to the acquisition of subscriber data related to his dynamic IP address and, consequently, his identity, without a court order. In particular because its online activity involved a high degree of anonymity, the ECtHR held that the applicant had a legitimate expectation of privacy and had not waived it by his conduct, which would have required a court order to obtain subscriber data relating to the IP address. In the ECtHR's view, the subscriber data relating to certain dynamic IP addresses assigned at certain times was not publicly available and therefore not comparable to data in a traditional telephone directory or a publicly available vehicle registration database. In fact, in order to identify a subscriber to whom a dynamic IP address assigned at a certain time had been assigned, the internet service provider would have had to access the stored data relating to certain telecommunication events (ECtHR, Benedik v. Slovenia, para. 108). The ECtHR further held that the fact that the complainant had not hidden his dynamic IP address on the assumption that it was even possible to do so could not be decisive in assessing whether his expectation of privacy was justified from an objective point of view. On the contrary, in the ECtHR's view, the key issue is whether the complainant had a legitimate expectation of privacy with regard to his identity. The ECtHR answered this question in the affirmative; the anonymous concept of privacy is an important factor to be taken into account in the assessment, as is the fact that it has not been alleged that the complainant has disclosed his identity in relation to the online activity in question, or that he has been identified by a particular online service provider through his account or contact details. The complainant's online activity involved a high degree of anonymity, which is confirmed by the fact that the assigned dynamic IP address, although visible to other users of the network, could not be traced back to a particular computer without the ISP verifying that information at the request of the police. Therefore, from his subjective point of view, the applicant expected that his activity would remain private and that his identity would not be disclosed (Constitutional Court Decision No Up-153/17, para. 17).
42. SEU se v svoji praksi prav tako še ni opredeljevalo do višine dokaznega standarda, ki bi ga za poseg v pravici iz 7. in 8. člena Listine zahteval 15. člen Direktive 2002/58/ES Evropskega parlamenta in Sveta z dne 12. julija 2002 o obdelavi osebnih podatkov in varstvu zasebnosti na področju elektronskih komunikacij (UL L 201, 31. 7. 2002 – v nadaljevanju Direktiva o zasebnosti in elektronskih komunikacijah). V sodbi v zadevi Tele2 Sverige, C 203/15, z dne 21. 12. 2016 pa je navedlo, da mora nacionalna zakonodaja temeljiti na objektivnih kriterijih, ki opredeljujejo pogoje in okoliščine, v katerih je mogoče odobriti dostop do prometnih podatkov naročnikov in registriranih uporabnikov. V splošnem je tak dostop v zvezi z bojem proti kaznivim dejanjem mogoče odobriti za posameznike, za katere obstaja sum načrtovanja, izvrševanja ali izvršitve resnega kaznivega dejanja ali drugačne vpletenosti v tako kaznivo dejanje. V tem delu sodbe se je SEU sklicevalo na analogijo z 260. točko obrazložitve sodbe velikega senata ESČP v zadevi Roman Zakharov proti Rusiji z dne 4. 12. 2015, v kateri je ESČP navedlo, da mora imeti organ, ki odobri dostop do podatkov, možnost preveriti obstoj razumnega suma (angl. reasonable suspicion, fr. soupçon raisonnable) zoper osebe, zlasti da mora imeti možnost preveriti, ali obstaja dejanska podlaga za sum, da oseba načrtuje, izvršuje ali je izvršila kazniva dejanja ali druga dejanja, ki so lahko podlaga za prikrite preiskovalne ukrepe (na primer dejanja zoper nacionalno varnost).
50. Ustava že sama v drugem odstavku 37. člena določa, da je mogoče v varstvo tajnosti pisem in drugih občil in nedotakljivost človekove zasebnosti poseči zgolj za določen čas. Pomembnost časovnih omejitev pridobitve prometnih podatkov izhaja tako iz ustaljene presoje Ustavnega sodišča kot tudi iz prakse ESČP. SEU pa je v sodbi v združenih zadevah La Quadrature du Net in drugi večkrat poudarilo, da so hramba prometnih in lokacijskih podatkov za namene nacionalne varnosti, osredotočena oziroma ciljana hramba prometnih in lokacijskih podatkov, nediskriminatorna in splošna hramba IP-naslovov vira internetne povezave z namenom varstva nacionalne varnosti, boja proti hudim kaznivim dejanjem in preprečevanja resnih groženj javni varnosti ter pospešena hramba prometnih in lokacijskih podatkov teh uporabnikov z namenom boja proti hudim kaznivim dejanjem in varstva nacionalne varnosti dopustne le za obdobje, ki je nujno potrebno, ki pa se lahko v določenih primerih podaljša. Daljše ko je obdobje, za katero se zahteva dostop, večja bo načeloma, po stališču SEU, količina podatkov, ki bi jih ponudniki elektronskih komunikacijskih storitev lahko shranili v zvezi z elektronskimi komunikacijami, ki jih je opravil uporabnik elektronskega komunikacijskega sredstva, v zvezi s kraji, kjer se zadržuje, in z njegovimi premiki, tako da bo mogoče iz pregledanih podatkov razbrati več ugotovitev o zasebnem življenju tega uporabnika. Pristojni nacionalni organi morajo torej zato, da bi izpolnili zahtevo po sorazmernosti, v skladu s katero morajo biti odstopanja od varstva osebnih podatkov in omejitve tega varstva v okviru tega, kar je nujno potrebno (sodba SEU v združenih zadevah La Quadrature du Net in drugi, 130. točka obrazložitve), v vsakem posameznem primeru zagotoviti, da so tako vrsta ali vrste zahtevanih podatkov kot obdobje, za katero se zahteva dostop do njih, glede na okoliščine obravnavane zadeve omejeni na to, kar je nujno potrebno za zadevno preiskavo. [72] Vendar je poseg v temeljni pravici iz 7. in 8. člena Listine, kakršen je dostop javnega organa do vseh podatkov o prometu ali lokaciji, iz katerih so lahko razvidne informacije o komunikacijah uporabnika elektronskega komunikacijskega sredstva ali o lokaciji uporabljene terminalske opreme, po stališču SEU hud, ne glede na dolžino obdobja, za katero se dostop do teh podatkov zahteva, in ne glede na količino ali vrsto podatkov, ki so na voljo za to obdobje, če je mogoče iz vseh teh podatkov natančno sklepati o zasebnem življenju posameznika ali posameznikov, na katere se nanašajo osebni podatki.
53. Ne glede na navedeno pa po stališču Ustavnega sodišča abstraktna omejitev, navedena v področni nekazenski zakonodaji, in omejitev, ki v konkretnem primeru izhaja iz načela sorazmernosti (2. člen Ustave), tj. da je možna le pridobitev podatkov za obdobje, ki je vsebinsko upoštevno in nujno potrebno za konkretno (pred)kazensko zadevo (glej 52. točka obrazložitve te odločbe), ne zadoščata. SEU je v svoji sodbi v zadevi The Commissioner of the Garda Síochána navedlo, da sta hramba teh podatkov in dostop do njih, kot je razvidno iz njegove sodne prakse, (Glej sodbo SEU v združenih zadevah La Quadrature du Net in drugi, 115. in 116. točka obrazložitve in tam navedena sodna praksa) ločena posega v temeljni pravici, zagotovljeni v 7. in 11. členu Listine, za katera sta potrebni ločeni utemeljitvi na podlagi prvega odstavka 52. člena Listine. Iz tega po stališču SEU izhaja, da nacionalna zakonodaja, ki zagotavlja polno spoštovanje pogojev, ki izhajajo iz sodne prakse, s katero je bila Direktiva o zasebnosti in elektronskih komunikacijah razložena na področju dostopa do hranjenih podatkov, sama po sebi ne more niti omejiti niti odpraviti resnega posega, ki bi izhajal iz splošne hrambe teh podatkov, ki je določena s to nacionalno zakonodajo, v pravice, zagotovljene s 5. in 6. členom te direktive, in v temeljne pravice, ki jih ta člena konkretizirata. (Sodba SEU v zadevi The Commissioner of the Garda Síochána, 47. točka obrazložitve.) Navedeno naj bi veljalo tudi obratno; ZKP bi moral na podlagi drugega odstavka 37. člena Ustave sam določati jasno abstraktno časovno omejitev kazenskopravnega posega v komunikacijsko zasebnost s pridobivanjem prometnih podatkov oziroma dostopom do njih, ob upoštevanju načela sorazmernosti in niansiranega pristopa k posegom v človekove pravice in temeljne svoboščine, medtem ko ZEKom-2 že ureja časovne omejitve hrambe prometnih podatkov, do katerih se z izpodbijanim ukrepom dostopa. S tem bi bilo mogoče preprečiti tudi morebitno pridobivanje podatkov, ki po ZEKom-2 sicer ne bi smeli biti več hranjeni, pa vseeno obstajajo.
56. Iz ustaljene prakse ESČP in SEU prav tako izhaja, da lahko dostop do hranjenih prometnih podatkov upraviči le boj (preprečevanje, odkrivanje ali pregon kaznivih dejanj) proti hudemu kriminalu oziroma proti najtežjim kaznivim dejanjem (na primer boj proti trgovini z drogo, organizirani kriminaliteti in pranju denarja). SEU je tako v že omenjeni sodbi v združenih zadevah La Quadrature du Net in drugi poudarilo, da lahko hude posege v temeljni pravici, določeni v 7. in 8. členu Listine, upravičita le preprečevanje resnih groženj javni varnosti in boj proti hudemu kriminalu. Zato je mogoče s ciljem preprečevanja, preiskovanja, odkrivanja in pregona kaznivih dejanj na splošno upravičiti le blažje posege v omenjeni temeljni pravici, tj. posege, od katerih pridobljeni podatki ne omogočajo izpeljave natančnih ugotovitev o zasebnem življenju oseb, za podatke katerih gre. Dostop javnih organov do vseh podatkov o prometu ali lokaciji, iz katerih so lahko razvidne informacije o komunikacijah uporabnika elektronskega komunikacijskega sredstva ali o lokaciji uporabljene terminalske opreme, omogoča natančne ugotovitve v zvezi z zasebnim življenjem posameznikov, na katere se nanašajo osebni podatki. Ta se po stališču SEU lahko opraviči samo s ciljem boja proti hudemu kriminalu (in preprečevanja hudih nevarnosti za javno varnost), ne da bi lahko drugi dejavniki, povezani s sorazmernostjo zahteve za dostop, kot je trajanje obdobja, za katero se zahteva dostop do takih podatkov, učinkovali tako, da bi bilo mogoče tak dostop upravičiti s ciljem preprečevanja, preiskovanja, odkrivanja in pregona kaznivih dejanj na splošno. Iz navedene sodne prakse Ustavnega sodišča, ESČP in SEU torej izhaja, da je dostop do prometnih podatkov po prvem odstavku 149.b člena ZKP, ki lahko pomeni hud poseg v pravico do komunikacijske zasebnosti osebe, katere podatki se lahko pridobijo, sorazmeren le za odkrivanje, pregon in dokazovanje hudih kaznivih dejanj.
88. SEU je v že omenjeni sodbi v združenih zadevah La Quadrature du Net in drugi podobno odločilo, da pomeni zbiranje (prometnih in) lokacijskih podatkov poseg v temeljni pravici do zasebnosti in do varstva osebnih podatkov iz 7. in 8. člena Listine, ne glede na občutljivost podatkov in ne glede na to, ali je oseba zaradi tega posega utrpela kakršnekoli neprijetnosti. (Sodba SEU v združenih zadevah La Quadrature du Net in drugi, 115. točka obrazložitve. Glej tudi mnenje SEU 1/15 (EU-Kanada PNR dogovor) z dne 26. 7. 2017, 124. in 126. točka obrazložitve; in sodbo ESČP v zadevi Breyer proti Nemčiji z dne 30. 1. 2020, 81. točka obrazložitve.) Prav tako spada po stališču SEU zbiranje (prometnih in) lokacijskih podatkov ter dostop državnih organov do njih za namene kazenskega postopka ali nacionalne varnosti v okvir Direktive o zasebnosti in elektronskih komunikacijah. (Sodba SEU v združenih zadevah La Quadrature du Net in drugi, 68., 104., 117.–120. točka obrazložitve.)
101. Glede opredelitve kataloga kaznivih dejanj, v zvezi s katerimi se lahko izvrši ukrep iz prvega in tretjega odstavka 149.c člena ZKP, se Ustavno sodišče prav tako sklicuje na svoja stališča o katalogu kaznivih dejanj v zvezi z ukrepom po prvem odstavku 149.b člena ZKP (glej 55.–56. točko obrazložitve te odločbe). Pri tem še dodatno poudarja, da je SEU v sodbi v združenih zadevah La Quadrature du Net in drugi posebej obravnavalo pridobivanje prometnih podatkov v realnem času in pri tem močno poudarilo omejenost kataloga kaznivih dejanj. Dostop do avtomatske analize in do zbiranja prometnih in lokacijskih podatkov v realnem času ter do takega zbiranja tehničnih podatkov glede lokacije uporabe terminalske opreme je dopustilo, med drugim, če 1) je avtomatska analiza omejena na situacije, v katerih se država članica sooča z grožnjo nacionalni varnosti, ki je resna in obstoječa, in 2) je pridobivanje prometnih in lokacijskih podatkov v realnem času omejeno na osebe, v zvezi s katerimi obstajajo veljavni razlogi za sum, da so na neki način vpletene v teroristično dejavnost. (Sodba SEU v združenih zadevah La Quadrature du Net in drugi, 188. točka obrazložitve. Glej tudi P. Križnar v: M. Šepec (ur.), nav. delo.)
176. Iz ustaljene prakse ESČP in SEU izhaja, da sodišči kot merilo za presojo sorazmernosti posega v pravici iz 7. in 8. člena Listine oziroma 8. člena EKČP oziroma za presojo dostopa do prometnih podatkov določata tudi, da dostop do hranjenih podatkov načeloma, razen v nujnih primerih, ki so ustrezno utemeljeni, odobri sodišče ali neodvisen upravni organ na obrazložen predlog, odredba tožilstva s sodno kontrolo zadošča, če pa gre za utemeljeno pričakovanje zasebnosti, je potrebna sodna odredba. ESČP je v omenjeni zadevi Benedik proti Sloveniji med drugim presojalo zatrjevano kršitev pravice pritožnika iz 8. člena EKČP zaradi pridobitve podatkov o naročniku, povezanih z njegovim dinamičnim IP-naslovom, in posledično njegove identitete brez odredbe sodišča. Predvsem na podlagi dejstva, da je njegova spletna dejavnost vključevala visoko stopnjo anonimnosti, je ESČP ocenilo, da je pritožnik upravičeno pričakoval zasebnost in da se ji s svojim ravnanjem ni odpovedal, zato bi bila za pridobitev naročniških podatkov v zvezi z IP-naslovom potrebna sodna odredba. Po stališču ESČP podatki o naročniku v zvezi z določenimi dinamičnimi IP-naslovi, dodeljenimi ob določenih urah, niso bili javno dostopni in jih zato ni mogoče primerjati s podatki v klasičnem telefonskem imeniku ali javno dostopni podatkovni zbirki o registraciji vozil. Ponudnik internetnih storitev naj bi moral namreč za identifikacijo naročnika, ki mu je bil določen dinamični IP-naslov, dodeljen ob določenem času, dostopati do shranjenih podatkov v zvezi z določenimi telekomunikacijskimi dogodki. (Sodba ESČP v zadevi Benedik proti Sloveniji, 108. točka obrazložitve) ESČP je še odločilo, da dejstvo, da pritožnik ni skril svojega dinamičnega IP-naslova ob domnevi, da je to sploh mogoče storiti, ne more biti odločujoče pri presoji, ali je bilo njegovo pričakovanje zasebnosti upravičeno z objektivnega stališča. Nasprotno; po stališču ESČP naj bi bilo ključno, ali je pritožnik lahko upravičeno pričakoval zasebnost v zvezi s svojo identiteto. Na to vprašanje je ESČP odgovorilo pritrdilno; anonimnostno pojmovanje zasebnosti naj bi bil pomemben dejavnik, ki ga je treba upoštevati pri presoji, kot tudi dejstvo, da ni bilo zatrjevano, da je pritožnik razkril svojo identiteto v zvezi z obravnavano spletno dejavnostjo, ali da bi ga identificiral določeni ponudnik spletnih storitev prek računa ali kontaktnih podatkov. Pritožnikova spletna dejavnost naj bi vključevala visoko stopnjo anonimnosti, kar naj bi potrjevalo dejstvo, da dodeljenemu dinamičnemu IP-naslovu, čeprav je viden drugim uporabnikom omrežja, ne bi bilo mogoče slediti do določenega računalnika, ne da bi ponudnik internetnih storitev te podatke preveril na zahtevo policije. Zato naj bi pritožnik s svojega subjektivnega vidika pričakoval, da bo njegova dejavnost ostala zasebna in da njegova identiteta ne bo razkrita. (Odločba Ustavnega sodišča št. Up-153/17, 17. točka obrazložitve)
