The Constitutional Court of the Republic of Slovenia abrogated the data retention provisions of the Act on Electronic Communications (ZEKom-1) in its judgment U-I-65/13-19 of 3 July 2014 following the constitutional request lodged by the Information Commissioner in March 2013 and ECJ judgment of 8 April 2014 in Joined Cases C-293/12 and C-594/12.
The Court abrogated ZEKom-1 articles 162, 163, 164, 165, 166, 167, 168 in 169 and instructed operators of electronic communications to delete retained data immediately after the judgment is published in the Official Gazette. The Court holds data retention as disproportionate for the following reasons:
• unselective retention of data in its major part constitutes a breach into the rights of a large proportion of population that did not provide any reason for such breaches ; blanket data retention does not provide for anonymous use of communication which is particularly important in cases where untraceable use is necessary to reach certain purposes (e.g. calling for help in mental distress);
• arguments for selected retention periods (8 months for internet related and 14 months for telephony related data) were not provided nor elaborated in the legislative materials;
• the use of retained data was not limited to serious crime.
The Information Commissioner welcomes the judgment of the court and sees it as an important step in protection of the right to privacy and data protection. The Court recognized the importance of personal data protection in relation to the use of modern information and communication technologies, particularly when later are used by law enforcement as repressive bodies of the state.
The Commissioner is regularly warning about the problems of intense breaches of privacy by law enforcement posed by introduction of surveillance technologies. In order to provide evidence of minor or serious offences these tend to be used indiscriminately on large proportions of population thus encroaching on their right to privacy and data protection. The availability of new technologies such as drones, IMSI catchers and similar has in several cases led to tendencies to legislate their use. In order to allow for transparency of the process and public discourse and to assure that new law enforcement powers respect the principles of necessity and proportionality, the Commissioner has issued guidelines on privacy impact assessments (PIA) for the introduction of new police measures, representing a methodological framework for a prudent, reasonable and legitimate introduction of new measures.
Nataša Pirc Musar, the Information Commissioner emphasized that this is one of the most important achievements of the Information Commissioner during her 10-year mandate which is now ending. The decision of the Court represents an important part in the debate about the necessity and proportionality of the use of surveillance measures and technologies in the context of law enforcement and intelligence agencies.
Request to the Constitutional Court (in Slovenian only)
Decision of the Constitutional Court (in Slovenian only)
Information Commissioner of the Republic of Slovenia
Privacy Impact Assessment (PIA) Guidelines for the Introduction of new Police Powers (English translation)