Covert Investigative Measures and Information Privacy
In Decision No. U-I-246/14, dated 24 March 2017 (Official Gazette RS, No. 16/17), upon the requests of the National Council and a group of deputies of the National Assembly, the Constitutional Court reviewed the constitutionality of certain provisions of the Criminal Procedure Act (the CrPA) that referred to the handling of data, messages, recordings, or evidentiary materials obtained by means of so-called covert investigative measures (e.g. secret surveillance, surveillance of electronic communications, interception of communications). The requests were mainly limited to the storage and destruction of the findings of covert investigative measures as well as the transmission of these findings, access to them, and the possibilities for the authorities to use them.
The Constitutional Court first reviewed the statutory regulation from the perspective of the principle of clarity and precision (Article 2 of the Constitution), as the applicants alleged that the challenged provisions of the CrPA lacked clarity, precision, and comprehensibility in a number of aspects. The requirement of the clarity and precision of regulations does not entail that rules should be such that they require no interpretation. The application of regulations namely always entails the interpretation thereof. The requirement that a legal rule be precise is stricter concerning a legal rule that defines a criminal act, and, within this framework, it is the strictest when defining a criminal offence. In criminal law, the principle of legal certainty is expressed particularly through the principle of the legality of substantive criminal law (the first paragraph of Article 28 of the Constitution). Although Articles 153 and 154 of the CrPA are not substantive but procedural criminal law provisions, they undoubtedly constitute a part of the broader field of penal law, in which the principle of certainty is of special importance because it prevents the arbitrary use of state coercion in situations that are not precisely determined in advance. The constitutional requirement of the clarity and precision of laws entails that interferences with human rights must be regulated in a precise and unequivocal manner. Unless a rule is clearly defined, there exists the possibility of different applications of the law and arbitrary conduct by state authorities and other bodies vested with public authority that decide on the rights of individuals. As the powers of repressive authorities may entail a significant interference with individuals’ human rights, they must be based on a particularly precise regulation, consisting of clear and detailed rules. The statutory regulation must exclude the possibility of arbitrary state conduct. Unless the border between the inadmissible and admissible conduct of state authorities is determined, all safeguards against the arbitrary application of the law can be ineffective.
After conducting a meticulous and extensive analysis, the Constitutional Court decided that the challenged provisions of the CrPA fulfil the constitutional requirement of clarity and precision, as their content may be construed through established methods of interpretation and thus the conduct of the authorities who have to implement them is determinable and predictable. Consequently, they are not inconsistent with Article 2 of the Constitution.
The Constitutional Court proceeded by further assessing the challenged provisions from the perspective of the right to the protection of personal data. The Constitution protects personal data and prohibits their use contrary to the purpose of their collection (the first paragraph of Article 38). The right to information privacy is not unlimited; it is not absolute. Therefore, individuals must accept limitations of information privacy, i.e. they must allow interferences therewith that are in the prevailing public interest and provided the constitutionally determined conditions are fulfilled. An interference is admissible if a law precisely determines which data may be collected and processed and for what purpose they may be used, and if supervision over the collection, processing, and use of personal data, as well as protection of the confidentiality of the collected personal data, are envisaged. The purpose of the collection of personal data must be constitutionally admissible. Only data that are appropriate and absolutely necessary for the implementation of the statutorily defined purpose may be collected.
The transmission of personal data obtained through covert investigative measures from the police to the state prosecution and the investigating judge, and the ensuing storage of the personal data at a court for as long as the relevant criminal case file is kept, as well as access to these data or their transmission to other authorities for further use entail an interference with the human right to the protection of personal data determined by the first paragraph of Article 38 of the Constitution. Firstly, the Constitutional Court had to verify whether the law under review fulfils the special criteria that follow from the second paragraph of Article 38 of the Constitution, which determines that the collection, processing, designated use, supervision, and protection of the confidentiality of personal data shall be provided by law.
With regard to the first paragraph of Article 154 of the CrPA, which, inter alia, determined that the findings of covert investigative measures are stored at a court for as long as the relevant criminal case file is kept, the question arose whether thus the purpose for which the stored personal data may be used is clearly determined by law. The purpose of the processing of personal data must be constitutionally admissible and defined in a clear, concrete, and precise manner. The Constitutional Court found that the CrPA contains no explicit statutory provisions on the purpose of the storage of the findings of covert investigative measures. Furthermore, the purpose of such storage is not substantiated in the legislative materials. Therefore, the Constitutional Court decided that the purpose of the processing of personal data is neither explicitly determined by the first paragraph of Article 154 of the CrPA (or by another provision of that law), nor can it be deemed to be “statutorily determined” in the sense of the second paragraph of Article 38 of the Constitution on the basis of legal interpretation. Therefore, it held that the regulation contained in Article 154 of the CrPA, according to which data, messages, recordings, or evidentiary materials obtained through the use of covert investigative measures are to be stored by a court for as long as the relevant criminal case file is kept, is inconsistent with the human right to the protection of personal data.