Last week, on February 5th, Law no. 18/2024 was published, which aims to regulate the access to metadata regarding electronic communications, for criminal investigation purposes. This law came into force on the day after its publication, February 6th, 2024, and the most important measures are herein highlighted:
- In order to safeguard the exclusive purpose of investigation, detection, and prosecution of serious offences by the competent authorities, the providers of electronic communications services must keep the following data for a period of one year from the date of communication:
- Data concerning the civil identification of subscribers or users of publicly available communications services or of a public communication network;
- The IP protocol addresses assigned to the source of a connection;
- The remaining data;
- With specific reference to traffic and location data, they may only be stored with judicial autorisation based on its necessity for the exclusive purpose of investigating, detecting, and prosecuting serious crimes, and the request for judicial autorisation to store this category of data must be processed urgently and decided within a maximum of 72 hours.
- In order to safeguard the usefulness of the request for judicial autorisation to store traffic and location data, the public prosecutor’s office shall immediately notify the providers of electronic communications services of the submission of the request, and the data may not be deleted until a final decision has been taken on its storage.
- This request for authorization can only be made by the Public Prosecutor’s Office (Ministério Público).
- The ruling on the request for judicial authorization falls upon a formation of the criminal chambers of the Supreme Court of Justice, made up of the presidents of the chambers and a judge appointed by the Supreme Judicial Council from among the most senior members of these chambers.
- The definition and extension of the conservation period for traffic and location data referred to above must be limited to what is strictly necessary for the pursuit of the exclusive purpose of investigating, detecting and prosecuting serious crimes, and must cease as soon as the need for its retention is confirmed, and providers of electronic communications services may only access said data in the cases provided for by law or defined contractually with the customer for the purposes arising from their respective commercial legal relations.
- The order authorising the transmission of data relating to the categories provided for in Article 4(1)[1] shall be notified to the data subject within 10 days of its being issued. Unless the notification endangers the investigation, the discovery of the truth or creates a danger to the life, physical or mental integrity or liberty of the participants in the proceedings or the victims of the crime, the investigating judge may be asked to postpone the notification, which shall be carried out as soon as the reason for the postponement ceases to exist or, at the latest, within 10 days of the date on which the order closing this procedural phase is issued.
This law represents a crucial balance between the protection of individual rights and the need for public safety, marking a significant advance in the regulation of electronic communications in an increasingly connected world.
GDPR Department
Marta Valadas Coriel | Sofia Batista Linguiça
[1] According to Law 32/2008 of 17 July, for example, data needed to find and identify the source of a communication or to find and identify the date, time, and destination of a communication.
