The decree-law promulgated on 29 January 2024 by the President of the Republic, Marcelo Rebelo de Sousa, introduces a new approach to regulating access to metadata in electronic communications for criminal investigation purposes in Portugal. This legislation brings about a significant change by requiring judicial authorisation for the retention of traffic and location data, differing from the previous practice of widespread retention without judicial supervision.
Metadata, which encompasses information such as the time, date, duration of phone calls and the location of mobile phone towers, is essential in various applications, including security and criminal investigation. However, they also raise significant privacy concerns, as they can reveal patterns of behaviour, relationships and personal habits.
The new legislation reflects the Portuguese government’s endeavour to balance the need for security with the protection of individuals’ privacy, requiring stricter judicial oversight for access to and conservation of metadata. This measure is part of a growing trend in European and global legislation to strengthen the protection of personal data and citizens’ privacy, in response to concerns about the use and abuse of personal information in the digital age.
In addition, this legislation modifies Law 32/2008, in accordance with Directive 2006/24/EC of the European Parliament and of the Council, and is aligned with the decisions of Constitutional Court Judgments 268/2022 and 800/2023, as well as with the Law on the Organisation of the Judicial System.
GDPR Department
Marta Valadas Coriel | Sofia Batista Linguiça
