Cyprus / Supreme Court of Cyprus, Primary Jurisdiction / Civil application No. 33/2018

Key facts of the case:

The applicants applied for a certiorari order cancelling a discovery order that had been issued by the District Court on 19 January 2018 which gave the police access to their telecommunication data for the purpose of investigating a criminal case against them. The applicants challenged the Court order that authorised access to their data on, inter alia, the following grounds:

• Article 17 of the Constitution provides for access to telecommunication data only for offences which carry a penalty of five or more years’ imprisonment. The order was issued on the basis of evidence that did not create a reasonable suspicion for the commission of an offence that was punishable with such a penalty, whilst three of the offences under investigation were punishable with maximum penalties ranging from 12 months to three years.
• The order was issued under the national data retention law^[1] which does not comply with the EU acquis, including the Charter, and with the Constitution. 

Outcome of the case:

Rather than examine the compliance of the national data retention law with the Charter, the Court fully endorsed a previous national Court decision from 2014 which had ruled that the national data retention law^[1]  remained in force in spite of the invalidation of the Data Retention Directive.^[2] In light of the said 2014 decision,^[3] the Court ruled that the order for discovery of the applicants’ telecommunication data was lawfully issued. The Court further cited the 2014 decision^[4] to conclude that an IP address constitutes neutral data since it only leads to the provider and not to the person, and only if the provider supplies the details of the person then the IP address becomes personal data.

In response to the applicant’s argument about three of the offences being punishable with prison sentences under five years, the Court concluded that this could not affect the validity of the order since the remaining four charges concerned offences which were punishable with prison sentences in excess of five years. The Court did not address the argument of the applicants for the absence of reasonable suspicion that the more serious offences were carried out.

The Court pointed out that it had not been convinced about the non-compliance of the national data retention law^[5] either with the EU acquis or the Constitution. It concluded that the Tele 2 Sveridge ruling was not relevant to the case at hand, because it dealt with a data retention order and the policy of regulation of data retention by the authorities. The Court added that the order in the case at hand does not infringe the principle of proportionality since access to the data is granted following a justified judicial decision and the aim is to combat crime. The Court found that the district court judge which had issued the order was acting within her powers since the data retention law was never formally declared as unconstitutional.