Article 7 - Respect for private and family life
Article 8 - Protection of personal data
Article 11 - Freedom of expression and information
Key facts of the case:
The defendant was accused and convicted of theft, computer-related fraud and violence against persons involved in the administration of justice. The computer-related fraud consisted of withdrawing money from an ATM with another person’s bank card without their knowledge on three occasions. In order to find H. K. guilty of the latter act, the County Court relied on reports which were drawn up on the basis of telecommunications data that the investigating authority had obtained from a provider of telecommunications services in accordance with § 901 of the Code of Criminal Procedure (Kriminaalmenetluse seadustik). This provision gives an investigative body the right to make enquiries during pre-trial procedure with the permission of the Prosecutor’s Office to telecommunications operators about the data listed in § 1111 (2) and (3) of the Electronic Communications Act (Elektroonilise side seadus). The defendant’s lawyer appealed the conviction, arguing that data logs received from a telecommunications operator are not admissible evidence, the legal norms that allow these data to be used cannot be applied due to a conflict with EU law – it follows from the CJEU judgment in Joined Cases C-203/15 and C-698/15 that general and indiscriminate retention of all traffic and location data is in violation with Article 15 (1) of Directive 2002/58/EC read in the light of Articles 7, 8 and 11 and Article 52(1) of the Charter. The County Court and the Circuit Court dismissed this claim, arguing that there was sufficient evidence to convict the defendant even without the data received from the telecommunications operator.
Key legal question raised by the Court:
The main issue in the case was whether traffic and location data, which are stored on the basis of § 1111 (2) of the Electronic Communications Act and obtained from a telecommunications operator with the permission of the Prosecutor's Office on the basis of § 901 (2) of the Code of Criminal Procedure, are admissible as evidence.
Outcome of the case:
The Supreme Court found that § 1111 (2) of the Electronic Communications Act and § 901 (2) of the Code of Criminal Procedure are in conflict with EU law. The Court explained that when it turns out that Estonian law is in conflict with EU law and this conflict cannot be eliminated by interpretation, the provisions in question must be disapplied without initiating constitutional review proceedings, and EU law must be applied directly, if possible. Consequently, due to the conflict with EU law, these provisions cannot be applied in the current criminal proceedings. The Supreme Court found that the conflict of the provisions with EU law does not in itself lead to automatic inadmissibility of the evidence from telecommunications operators. The assessment of the admissibility of such evidence must be based on Estonian law, including well-established case law. According to the practice of Estonian criminal procedure law, evidence can generally be considered inadmissible only if the procedure for collecting the evidence has been significantly violated. The Supreme Court analysed the severity of the breach and decided that, in this case, it results in the inadmissibility of the evidence. However, the Supreme Court found that the telecommunications data protocol was indirect evidence in proving computer-related fraud, which was not decisive for the conviction. For this reason, the claims of the defendant seeking acquittal and compensation for the damage caused by detention were rejected. Nevertheless, the Court found that the unlawful interference with the privacy of the accused cannot be considered insignificant, and therefore, the Court decided to leave the fee for state legal aid during the county court proceedings to be covered by the state.
43. Both § 1111 of the Electronic Communications Act (ECA) and § 901 of the Code of Criminal Procedure (CCP) fall within the scope of EU law, which means that their legality and applicability must be assessed on the basis of, inter alia, EU law (see also ruling No 1-16-6179/85, cited above, § 19). Based on the CJEU practice, it can be stated that the retention of telecommunications data and access to these data constitute separate infringements of the rights protected by the Charter, and general and indiscriminate retention of telecommunications data is not allowed even if strict substantive and procedural requirements for access to data are established by law. Both the retention of and access to telecommunications data must be proportionate. As state-imposed obligation, the retention of telecommunications data is generally justified only by the need to prosecute serious crimes and high threat to public security.
44. In accordance with what was stated in the previous paragraph, in answering Questions 1 and 2 of the request for a preliminary ruling, the CJEU considered that only non-serious interference with fundamental rights could be justified by the general objective of preventing, investigating, detecting and prosecuting criminal offences (paragraph 33). Access to the set of traffic and location data retained under § 1111 ECA allows very precise conclusions to be drawn about the private life of the persons whose data are retained: e.g. their daily habits, permanent or temporary residence, daily or other movements, activities, social relations and social groups with whom they communicate (p. 36). If the right to respect for private and family life and the right to the protection of personal data (Articles 7 and 8 of the Charter) are infringed due to public authorities' access to traffic or location data, these infringements are serious in any case, regardless of the period for which access is requested and the amount and type of data available for that period if – as in the case of H. Kuusmaa – this set of data makes it possible to draw precise conclusions about the private life of the persons concerned (paragraph 39).
(...)
55. In the present case, the inquiries concerning communications data stored pursuant to § 1111 (2) of the ECA were made on the basis of permission provided for in § 901 (2) of the CCP, violating Article 15 (1) of Directive 2002/58/EC and Articles 7, 8 and 11 of the Charter regarding respect for private and family life, the right to the protection of personal data and freedom of expression and information. When assessing whether taking the evidence into consideration complies with the applicable law, the Chamber must disapply § 1111 (2) of the ECA and § 901 (2) of the CCP. Therefore, when deciding on the lawfulness of the evidence, it cannot be relied on that formally the evidence was collected in accordance with those provisions. This means that there was no legal basis for the invasion of private life protected by § 26 of the Constitution, resulting from the retention of telecommunications data and the granting of permission to use such data.
62. In assessing the intentionality of the infringement, it must be taken into account what was the legal situation at the time when the permission for obtaining the telecommunication data was granted, queries were made based on the permission, and the telecommunications data protocols were drawn up on the basis of the information obtained. It is true that, like the Court, a provision contrary to EU law – in this case Article 15 (1) of Directive 2002/58/EC in conjunction with the Charter – must also be disapplied by public authorities (see CJEU judgment of 22 June 1989 in Case C-103/88, paragraphs 30 and 31, judgment of 14 May 2020 in Joined Cases C-924/19 and C-925/19, paragraph 183). However, it is debatable as to when the prosecution had to realise that the rules governing the retention of telecommunications data and the prosecution's competence to authorise the use of such data were contrary to EU law and could therefore not be relied on. The rules governing retention were adopted in order to transpose Directive 2006/24. When the CJEU repealed the Directive on 8 April 2014 (referred to as the Digital Rights Decision), the prevailing view seemed to be that the provisions of Estonian law established to transpose the Directive ceased to be tied to EU law. The unconstitutionality of these provisions was also not seen (see the cited decision in case No. 3-1-1-51-14 and the position of the Chancellor of Justice of 20 July 2015 No. 6-1/140621/1503191). Although the CJEU Tele2 decision of 21 December 2016 revealed that the disputed provisions fall within the scope of EU law, the Chamber estimates that until 6 October 2020 (i.e. the La Quadrature du Net decision) there was still considerable ignorance about the permitted retention and use of telecommunications data in question. However, definite conviction that the right granted to the prosecutor's office by the Code of Criminal Procedure to allow the use of telecommunications data is contrary to EU law could not be held before 2 March 2021, when the CJEU announced the decision on the preliminary ruling in this case. In the present case, the disputed requests for telecommunications data were granted (and queries were made on the basis of them) in 2015 and 2016, for data stored in the same years (for more details, see paragraph 71 below).
43. Nii ESS § 1111 kui ka KrMS § 901 kuuluvad EL-i õiguse kohaldamisalasse, mis tähendab, et nende õiguspärasust ja kohaldatavust tuleb hinnata mh EL-i õiguse alusel (vt ka viidatud määrus nr 1-16-6179/85, p 19). EK praktika põhjal saab tõdeda, et sideandmete säilitamine ja nendele andmetele juurdepääs kujutavad endast hartaga kaitstavate õiguste eraldiseisvaid riiveid ning lubatav ei ole sideandmete üldine ja vahet tegemata säilitamine ka tingimusel, et õigusnormidega on kehtestatud andmetele juurdepääsuks ranged materiaal- ja menetlusõiguslikud nõuded. Proportsionaalne peab olema nii sideandmete säilitamine kui ka juurdepääs nendele andmetele. Riigi pandud kohustusena õigustab sideandmete säilitamist üldjuhul vaid raskete kuritegude menetlemisvajadus ja avalikku julgeolekut ähvardav suur oht.
44. Kooskõlas eelmises punktis märgituga leidis EK eelotsusetaotluse küsimustele 1 ja 2 vastates, et üldise kuritegude ennetamise, uurimise, avastamise ning kohtus menetlemise eesmärgiga saab õigustada ainult neid põhiõiguste riiveid, mis ei ole rasked (p 33). Juurdepääs selliste liiklus- ja asukohaandmete kogumile, mida ESS § 1111 alusel saäilitatakse, võimaldab teha väga täpseid järeldusi nende isikute eraelu kohta, kelle andmeid säilitatakse: nt nende igapaäevaelu harjumuste, alalise või ajutise viibimiskoha, igapäevaste või muude liikumiste, tegevuste, sotsiaalsete suhete ja ühiskonnagruppide kohta, kellega nad läbi käivad (p 36). Kui riivatakse era- ja perekonnaelu puutumatust ning õigust isikuandmete kaitsele (harta art-d 7 ja 8) ning riive kaasneb ametiasutuse juurdepääsuga liiklus- või asukohaandmete kogumile, on ta igal juhul raske, sõltumata sellest, millise ajavahemiku kohta on andmetele juurdepääsu taotletud, ning sõltumata selle ajavahemiku kohta kättesaadavate andmete hulgast ja liigist, kui – nagu H. Kuusmaa kohtuasjas – see andmete kogum võimaldab teha asjaomaste isikute eraelu kohta täpseid järeldusi (p 39).
55. Praegusel juhul tehti ESS § 1111 lg 2 kohaselt säilitatud sideandmeid puudutavad päringud KrMS § 901 lg-s 2 ette nähtud loa alusel, millega rikuti direktiivi 2002/58/EÜ artikli 15 lg-t 1 ja harta artiklitega 7, 8 ning 11 tagatud era- ja perekonnaelu puutumatust, õigust isikuandmete kaitsele ning sõna- ja teabevabadust. Hinnates, kas tõendite kogumine vastab kehtivale õigusele, tuleb kolleegiumil ESS § 1111 lg 2 ja KrMS § 901 lg 2 jätta kohaldamata. Seega ei saa tõendite kogumise õiguspärasuse üle otsustades tugineda sellele, et formaalselt koguti tõendeid nendes normides sätestatu järgi. Öeldu tähendab, et PS §-ga 26 kaitstava eraelu puutumatuse riiveks, mis kaasnes sideandmete säilitamisega ja loa andmisega nende andmete kasutamiseks, ei olnud õiguslikku alust.
62. Rikkumise tahtlikkust hinnates tuleb silmas pidada õiguslikku olustikku ajal, mil anti load sideandmete päringuteks, tehti lubade alusel päringud ja vormistati saadud andmete põhjal tõendina kasutatavad sideandmete protokollid. On tõsi, et sarnaselt kohtuga peavad EL-i õigusega – praegusel juhul direktiivi 2002/58/EÜ art 15 lg-ga 1 koostoimes hartaga – vastuolus oleva sätte jätma kohaldamata ka ametiasutused (nt EK 22. juuni 1989. a otsus asjas nr C-103/88, p-d 30 ja 31; 14. mai 2020. a otsus liidetud asjades nr C-924/19 ja C-925/19, p 183). Siiski on vaieldav, missugusest ajahetkest pidi prokuratuur mõistma, et normid, mis reguleerivad sideandmete säilitamist ja prokuratuuri pädevust anda nende andmete kasutamiseks lube, on EL-i õigusega vastuolus ning et seetõttu ei saa nendele tugineda. Säilitamist reguleerivad normid kehtestati direktiivi 2006/24 ülevõtmiseks. Kui EK direktiivi 8. aprillil 2014 kehtetuks tunnistas (viidatud Digital Rights ́i otsus), näis valitsevat seisukoht, et direktiivi ülevõtmiseks kehtestatud Eesti õiguse sätted lakkasid olemast EL-i õigusega seotud. Ka ei nähtud nende sätete vastuolu põhiseadusega (vt viidatud otsus asjas nr 3-1-1-51-14 ja õiguskantsleri 20. juuli 2015. a seisukoht nr 6-1/140621/1503191). Kuigi EK 21. detsembri 2016. a Tele2 otsusega saabus selgus selles, et vaidlusalused sätted on EL-i õiguse kohaldamisalas, valitses kolleegiumi hinnangul kuni 6. oktoobrini 2020 (s.t La Quadrature du Net ́i otsuseni) jätkuvalt märkimisväärne teadmatus sideandmete lubatud säilitamis- ja kasutamisviiside küsimuses. Ühest veendumust, et kriminaalmenetluse seadustikuga prokuratuurile antud õigus lubada sideandmete kasutamist on vastuolus EL-i õigusega, ei saanud prokuratuuril aga olla enne 2. märtsi 2021, mil EK tegi teatavaks otsuse käesolevas asjas esitatud eelotsuse küsimuste kohta. Praeguses kohtuasjas anti vaidlusalused sideandmete päringu load (ja tehti nende alusel päringud) 2015. ning 2016. aastal ja seda samadel aastatel säilitatud andmete kohta (vt täpsemalt allpool p 71).
