How the Data Retention Legislation Led to a National Constitutional Crisis in Portugal

Some weeks ago, the Portuguese Constitutional Court (PCC) triggered a heated political debate on the need to amend the Constitution to grant criminal investigative authorities access to metadata on personal communications. Whilst disagreements between the political branches and the constitutional jurisdiction are common, this conflict is located at a wider critical juncture that intersects EU and national constitutional law, the CJEU, the domestic constitutional court, and ordinary courts.

Following the Court of Justice of the European Union (CJEU)’s seminal Digital Rights Ireland case that invalidated the Data Retention Directive, the PCC struck down the provisions of national legislation providing for the indiscriminate retention of traffic and location data for a period of one year. The ruling was delivered more than five years after the CJEU affirmed that the standard established in Digital Rights Ireland precludes national legislation allowing the general and indiscriminate retention of data (Tele2 Sverige AB). A public outcry followed the Court’s ruling as the judges did not order a limitation of effects and there was uncertainty if criminal convictions based on this unlawful legislation could be affected. Moreover, public prosecutors and law enforcement officials claimed that untargeted retention and collection of data is an essential tool for investigating and combatting crime efficiently. The Prime Minister initially reacted by favoring a constitutional amendment to render the legal framework constitutionally valid.

The Background to the Case

Untargeted data retention became a problem in the EU after the CJEU declared the Data Retention Directive incompatible with the rights to privacy and protection of personal data (Digital Rights Ireland) in 2014, and clarified that national legislation, despite not being automatically affected by the invalidity, should meet the requirements of EU law (Tele2 Sverige AB), in 2016. The CJEU concluded that EU law prohibits the “general and indiscriminate retention of all traffic and location data” and described the conditions that access to “targeted retention” must meet.

In Portugal, the government believed that domestic legislation complied with EU law since it established a demanding procedure governing access to data. The Public Prosecutor’s Cybercrime Office also considered that national legislation was not affected by Digital Rights Ireland, despite recognizing that it did not comply with the CJEU’s case law as it allowed the indiscriminate retention of data. This apparent paradox was justified by the Cybercrime Office, since data retention is only useful for criminal investigation purposes if it is blanket or indiscriminate, thus qualifying Digital Rights Ireland, in that regard, as “inconsistent” and “inconsequent”. Between 2014 and the recent ruling of the PCC, and despite warnings from the oversight independent authority and the legal scholarship (here and here), the transposing legislation was not reviewed to conform with the CJEU’s high standard of protection, and national authorities believed that national legislation complied with the case law of Luxembourg. Indiscriminate data retention was maintained in the legislation and practiced since service providers did not challenge their obligation to retain and grant access to such data by the law enforcement authorities.

Given the domestic consensus on the validity of the national framework, notwithstanding the Public Prosecutor’s Office clear recognition that it breached EU law, evidence was used in criminal court proceedings. Eventually, one concrete review case reached the PCC in 2017, concerning the retention of IP addresses, but in a chambers’ decision, the judges unjustifiably decided that the provision did not breach constitutional standards without making a preliminary reference to the CJEU.

At the end of 2017, D3, a privacy advocacy group, asked the Ombudsperson to challenge the constitutionality of the transposing law. The Ombudsperson first recommended the Government to initiate a process to amend the legislation, but the request was rejected. Subsequently, she initiated an abstract review near the PCC. The decision was finally delivered on 19 April 2022 and the Court struck down the legal provisions that ordered the indiscriminate retention of traffic and location data for the period of one year.

Constitutional Revision

The substantive arguments of the ruling replicate the reasoning of the CJEU. However, the methodological path adopted by the PCC contributed to the perception that the judgment represented an autonomous assessment of the conflicts at stake, considering national fundamental rights protection fully independent of EU law. For this reason, early political reactions were quick to suggest that a constitutional amendment should follow to create a “constitutionally friendly environment” for blanket data retention. The initial suggestion was put forward by the Prime Minister, with the subsequent support of the President of the Republic, who added that “most countries do not have this limitation that derives from the Constitutional Court when it comes to the Constitution.” The role of EU law in the reasoning of the PCC went also unnoticed by a part of the legal community and the judicial professions.

The General Public Prosecutor, despite not being party to the abstract review proceedings and despite the absence of a procedural mechanism allowing such a participation, requested the Court to order the restriction of effects of the decision, and claimed that the ruling was inconsistent. This request was rejected on the grounds of inadmissibility by a plenary decision of the PCC, whose aggressive tone did not go unnoticed. The Court further stated, as obiter dictum, that restricting the effects of the decision would be incompatible with EU law and quoted the CJEU, which had stated that a national court cannot limit in time the effects of an invalidity it is obliged to declare under national law in relation to domestic legislation ordering indiscriminate data retention.

The Interaction Between National and EU Law

Despite its foregone conclusion, the ruling was eagerly anticipated by the Portuguese constitutional and EU law community. The PCC gained recognition as a veto player during the Eurozone crisis by striking down significant austerity measures that implemented an international and EU bailout conditionality. During this period, the PCC did not expressly engage with EU law and the case law displaced any role the CJEU might have had. It was only in 2020, 34 years after Portugal had joined the European Communities, that the PCC engaged expressly with EU law for the first time. In what has been called a “Solange moment”, the Court addressed the issue of whether and to what extent Union law can be reviewed against domestic constitutional yardsticks and assumed for the first time the constitutional mandate of friendliness towards EU integration. However, the reasoning of the Court was long, intricate, and concerned a minor export refund dispute. It was difficult to interpret the sudden jurisprudential turn on the basis of this singular, rather insignificant case. Therefore, the Data Retention became a high-stakes case, especially considering that data protection is the policy area with the most examples of Charter use.

Portugal is one of the few European countries whose Constitution explicitly addresses and accepts the primacy of EU law vis-à-vis the national legal order, including domestic constitutional law [Article 8(4)]. However, the CJEU’s unconditional and absolute primacy is neither entrenched in the Constitution nor accepted by the PCC, which, in its 2020 decision, reserved the right to have the last word on the constitutional limits of the applicability of Union law on the Portuguese legal order. In light of its Eurozone crisis legacy, it would need a revolution for the PCC to articulate an excessively generous engagement with EU law that might jeopardize its capacity to resist future encroachments on the national standard of protection of fundamental rights.

Simmenthal’s Distinguo

In carrying out its assessment, the PCC outlined a new theory to reconcile the principle of primacy of EU law and its exclusive jurisdiction to rule on the invalidity of domestic legislation. While determining that transpositions are manifestly within the scope of EU law, and therefore within the scope of the Charter of Fundamental Rights of the EU (CFREU), the Court also affirmed being exclusively competent to review the validity of national legislation – even in such cases. Subsequently, the Court outlined its fundamental roles in abstract and concrete review of constitutionality. It is this distinguo, borrowed from the CJEU case law, that will prove to be a crucial toolbox for the theory.

Particularly after Simmenthal, the literature has extensively emphasized the fact that EU law has disempowered domestic constitutional courts in relation to ordinary courts, since the latter acquired the power to disapply national law that conflicts with EU law without having to wait for a declaration of unconstitutionality of the former. This essentially relates to concrete review of constitutionality, where issues of validity are raised during concrete disputes. Most systems of constitutional review in Europe are centralized: ordinary courts lack the power to disapply legal provisions on the grounds of their unconstitutionality, but they can refuse to apply national legislation that breaches EU law.

However, the Portuguese system of concrete review is decentralized, and ordinary courts can disapply unconstitutional provisions, the PCC being the last instance of appeal. Rulings delivered by the PCC in concrete review produce effects inter partes. Only in abstract review, the PCC is exclusively competent to adjudicate conflicts and to declare the invalidity of provisions with erga omnes effects. Despite the importance of the 2020 jurisprudential turn on the engagement with EU law, this is why the real intentions of the PCC in relation to EU law can only be assessed on the basis of a case decided in the context of an abstract review.

Reconciling Simmenthal With the PCC’s Exclusive Jurisdiction in Abstract Reviews

Although the 2020 ruling had already been characterized as setting off a “European coming of age”, the PCC took the opportunity to distinguish clearly between constitutional review of national law and review of compatibility with EU law. The former relates to the issue of validity of national law, whereas the latter is exclusively concerned with the topic of applicability. From this legal position, borrowed from Simmenthal, the PCC sets a fundamental distinction that the Spanish Constitutional Court had already outlined in its Declaration 1/2014 on the failed Constitutional Treaty: EU law enjoys primacy of application but not supremacy over national law, since it does not cause invalidity that affects the national legal order.

In concrete review cases, ordinary courts and the PCC are bound by the Simmenthal mandate and must set aside national law that infringes EU law, including constitutional law – these are issues of inapplicability. In cases of abstract review or direct action, constitutional courts are called to rule on the validity of national law; these are constitutional review cases between provisions of the national legal order, which raise the problem of invalidity, not inapplicability. The role of EU law in these proceedings is different and the Simmenthal mandate is not addressing these constellations.

According to the PCC, this framework exclusively allows the harmonization of competences between the national constitutional jurisdiction and the CJEU, while safeguarding the autonomy of EU law and the principle of primacy. The PCC is bound by the principle of primacy in conflicts that trigger the application of EU law in the realm of concrete disputes. In direct action cases, there must be a clear separation between the problem of constitutionality and the issue of incompatibility with EU law.

The Principle of Consistent Interpretation Opening Up National Constitutional Law to the EU Standard of Fundamental Rights Protection

The Court creatively applied the principle of consistent interpretation to render the interpretation of national fundamental rights standards consistent with the level of protection demanded by the EU. Although this approach was criticized as inconsistent in both a concurrent opinion and by legal scholarship, it has been used by other domestic constitutional courts in the past. For the concurring vote judges, consistent interpretation serves to rescue problematic infra-constitutional domestic law from incompatibility with EU law. However, the ruling’s resort to the principle of consistent interpretation concerns the norms of the Constitution.

In this concrete conflict structure, the principle of consistent interpretation linked the national standard of protection with the European parameter, leading to a fully congruent standard of fundamental rights protection through the application of the national constitutional provisions.

In such a framework, however, consistent interpretation conveys not only openness towards EU law, but could also potentially draw limits to EU law friendliness, like the Polish Constitutional Court has asserted in the past. Whereas Simmenthal contributed to the disempowerment of domestic constitutional courts, the PCC’s theory re-empowers their jurisdiction in cases concerning the constitutional validity of national law within the scope of EU law. Through consistent interpretation, the PCC can calibrate the extent to which EU law can enter the national constitutional order: it can expand the domestic standard, but it can also resist “constitutional dumping”, should national law within the scope of EU law breach domestic fundamental rights.

The Government’s Relenting Legislative Proposal

The PCC seems to have found a way out of the restrictions that the principle of primacy implies for its position. It remains to be seen how this specific toolbox will play out in the future, particularly in different conflict structures. The framework for the interaction between national constitutional law and EU law may produce unexpected outcomes. If a preliminary reference is drafted in the context of direct action, the CJEU would be well advised to engage with the Portuguese constitutional judges carefully and diplomatically.

More recently, the Prime-Minister ruled out the proposed constitutional revision as the Government presented a legislative proposal granting access to criminal authorities to billing data, following the practice implemented in other Member States. In these updated statements, António Costa recognized that the impact of the case law of the CJEU must be discussed at the level of the European Union, and not at the internal level. Better late than never.