Law no. 18/2024 : New Metadata Law – New Regulation on Access to Electronic Communications

On 05 February, Law no. 18/2024 was published, which aims to regulate access to metadata relating to electronic communications for criminal investigation purposes, amending Law no. 23/2008 of 17 July, bringing it into line with Constitutional Court Rulings no. 268/2022 and 800/2023, and the Law on the Organisation of the Judicial System. This law came into force on the day after its publication, 6th February 2024, and the most important measures are highlighted:

1. To safeguard the exclusive purpose of investigation, detection, and prosecution of serious crimes by the competent authorities, electronic communications service providers must keep the following data for 1 year from the date of communication:
   1. • Data relating to the civil identification of subscribers or users of publicly available communications services or a public communications network;
      • Other basic data;
      • IP protocol addresses assigned to the source of a connection;
2. Regarding traffic and location data, it can only be stored with judicial authorization based on its necessity for the exclusive purpose of investigating, detecting, and prosecuting serious crimes. The request for judicial authorization to store this data category must be processed urgently and decided within a maximum of 72 hours.
3. To safeguard the usefulness of the request for judicial authorization to store traffic and location data, the public prosecutor’s office immediately notifies the providers of electronic communications services that the request has been submitted, and the data cannot be deleted until a final decision has been taken on its storage.
4. This authorization request can only be made by the Public Prosecutor’s Office.
5. The decision on the request for judicial authorization falls to a formation of the criminal chambers of the Supreme Court of Justice, made up of the presidents of the chambers and a judge appointed by the Superior Council of the Judiciary from among the most senior members of these chambers.
6. The establishment and extension of the retention period for traffic and location data referred to above must be limited to what is strictly necessary for the pursuit of the exclusive purpose of investigating, detecting, and prosecuting serious crimes, and must cease as soon as the need for its retention is confirmed, and providers of electronic communications services may only access said data in the cases provided for by law or defined contractually with the customer for purposes arising from their respective commercial legal relations.

The order authorizing the transmission of data relating to the categories provided for in Article 4(1) must be notified to the data subject within 10 days of its being issued. Unless notification jeopardizes the investigation, the discovery of the truth, or creates a danger to the life, physical or mental integrity, or freedom of the participants in the proceedings or the victims of the crime, the investigating judge may be asked to delay notification, which shall be carried out as soon as the reason for the delay no longer exists or, at the latest, within 10 days of the date on which the order closing this procedural phase is issued.

This law represents a crucial balance between the protection of individual rights and the need for public safety, marking a significant advance in the regulation of electronic communications in an increasingly connected world.

Créditos: <a href="https://br.freepik.com/fotos-gratis/mulher-feliz-com-um-telefone_4191294.htm#fromView=search&page=1&position=3&uuid=68aface3-400d-4455-b9bd-3d8c6033382b">Imagem de rawpixel.com</a> no Freepik