Security, freedom and criminal procedure: data retention, european jurisprudence and the new italian regulation

• Author: Alessandro Malacarne
• Profession: PhD student in Criminal Procedure, Department of Law, University of Genoa (Italy)
• Pages: 223-245

223

Security, freedom and criminal procedure: data retention,

european jurisprudence and the new italian regulation

A M

PhD student in Criminal Procedure, Department of Law, University of Genoa (Italy)

1. INTRODUCTION

The adoption of Directive 2002/58/EC 1 was an important step to ensure

rights and freedoms of persons with regard to the processing of personal data

and, especially, their right to privacy and to respect for private and family life,

as protected by articles 7 and 8 of the Charter of Fundamental Rights of the

European Union and art. 8 of the European Convention on Human Rights

(ECHR). The aim of the European legislator, in brief, was to harmonise the

provisions of the Member States required to ensure an equivalent level of

protection of fundamental rights and freedoms with respect to the processing

of personal data in the electronic communication sector. Indeed, the European

Parliament observed that Internet is overturning traditional market structures

by providing a common, global infrastructure for the delivery of a wide range

of electronic communications services. However, at the same time, publicly

available electronic communications services over the web open new possibilities

for users, but also new risks for their personal data and privacy.

Nevertheless, twenty years on, the modus comunicandi has profoundly

changed.

The increasing use of high-tech tools in everyday life (such as smartphones

and tablets) has resulted in a new way of communicating. The development

of the Internet of Things 2 and the advent of social network has led not only

1 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning

the processing of personal data and the protection of privacy in the electronic communications sector.

2 With this expression, used for the first time in 1999 by Kevin Ashton, we intended to describe

the socio-technological phenomenon in which everyday objects (such as smartphones, cars, televisions,

household appliances, etc.) are connected to the Internet via sensors that enable continuous use (and

control) of these devices. On the topic, see, amplius, L. DENARDIS, Internet in ogni cosa. Libertà, sicurezza e

privacy nell’era degli oggetti iperconnessi, Luiss University Press, Rome, 2022.

Alessandro Malacarne

224

to a radical change in social relationship, but also to the creation of a digital

archive that is «larger than the human mind that, to some extent, “remembers”

everything» 3. In this regard, the new way to communicate, create and maintain

interpersonal relationships in the “online space” produced an important

consequence from the procedural point of view: we refer, more specifically, to

the mass-production of a large numerous typologies of metadata. In the web-

era, in fact, every human action and activity realized in the cyberspace leaves a

series of “digital traces” that can prove extremely useful for the investigation of

crimes.

2. VALUES AND THE EUROPEAN LAW

The Directive 2002/58/EC establishes that Member States shall ensure

the confidentiality of communications and the related traffic data by means of a

public communications network and publicly available electronic communications

services. Specifically, art. 5 introduces the principle of confidentiality, which

establishes the general prohibition of listening, tapping, storage of communications

and the related traffic data by persons other than users, without the consent of the

users concerned.

Nevertheless, the value of privacy, like any right in a pluralist and democracy

Nation, is not absolute and – as said the Italian Constitutional Court in a well-

know judgment – «tyrant» 4, but, on the contrary, it must be balanced with other

and competing principles. For this reason, the European legislator has provided

that Member States can adopt legislative measures to restrict the rights of

privacy, even if only when such «restriction constitutes a necessary, appropriate

and proportionate measure within a democratic society to safeguard national

security, defence, public security, and the prevention, investigation, detection and

prosecution of criminal offences» 5.

The provision de quo is built as a “rule-exception model”: the privacy of

communication can be limited only for a specific reason indicated by the Law.

On one hand, privacy is ever more important in the “digital society”. With

the awareness of the «constant relationship between changes in technologies

[...] and changes in the concept of [privacy]» 6, this right has become a matter

of relevant public interest for contemporary societies. Nowadays, privacy is

3 G. ZICCARDI, Internet, controllo e libertà. Trasparenza, sorveglianza e segreto nell’era tecnologica,

Cortina Editore, Milan, 2015, p. 149. All translations from Italian language in the following pages are by

the Author.

4 Italian Constitutional Court, 9 May 2013, n. 85.

5 Art. 15 of Directive 2002/58/EC.

6 S. RODOTÀ, La privacy tra individuo e collettività, in Pol. dir., 1974, p. 551.