challenging such requests.
127 Nevertheless, the ECPA is still in force and allows the
Government to routinely access personal data processed by electronic means, such
as data held by search engines, social networks and providers of electronic communication services.
In addition to ECPA, the Communications Assistance for Law Enforcement Act
of 1994 (hereinafter CALEA), as well as the SCA contribute to a legal framework
that facilitates the access of government to personal data processed by electronic
means. The CALEA, for example, requires electronic communication network providers to redesign their network architectures to make it easier for the government to
wiretap digital telephone calls. Data retention is also facilitated and even stimulated
under the United States’ federal legislation.
The European Union’s legal framework embodies a totally different approach.
The protection of personal data is a fundamental right, enshrined in a comprehensive
general regulation. Consequently, all restrictions to this right must be applied to the
minimum possible extent.
In the context of criminal proceedings and forensics,
128 the most important
instrument providing common rules for the processing of the personal data of
individuals involved in criminal proceedings is Directive (EU) 2016/680.
129 This
European act grants a high level of protection to the personal data of natural persons
while facilitating the cooperation between competent authorities of Members States.
Furthermore, article 15(1) of the Directive on privacy and electronic communications, which establishes, among other important provisions, the confidentiality of
electronic communications, provides, under the heading “Application of certain
provisions of Directive 95/46/EC”:
Member States may adopt legislative measures to restrict the scope of the rights and
obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article
9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defense, public security, and the prevention, investigation, detection and prosecution of
criminal offences or of unauthorized use of the electronic communication system, as referred
to in Article 13(1) of Directive 95/46/EC. To this end, Member States may, inter alia, adopt
legislative measures providing for the retention of data for a limited period justified on the
grounds laid down in this paragraph. All the measures referred to in this paragraph shall be in
accordance with the general principles of Community law, including those referred to in
Article 6(1) and (2) of the Treaty on European Union.
127 See the United States of America’s National Report, Sect. 4.1.
128 See the European Union Special Report, Sect. 3.4.
129 See Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data by competent
authorities for the purposes of the prevention, investigation, detection or prosecution of criminal
offences or the execution of criminal penalties, and on the free movement of such data, and
repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89.
26
D. Moura Vicente and S. de Vasconcelos Casimiro
127 Nevertheless, the ECPA is still in force and allows the
Government to routinely access personal data processed by electronic means, such
as data held by search engines, social networks and providers of electronic communication services.
In addition to ECPA, the Communications Assistance for Law Enforcement Act
of 1994 (hereinafter CALEA), as well as the SCA contribute to a legal framework
that facilitates the access of government to personal data processed by electronic
means. The CALEA, for example, requires electronic communication network providers to redesign their network architectures to make it easier for the government to
wiretap digital telephone calls. Data retention is also facilitated and even stimulated
under the United States’ federal legislation.
The European Union’s legal framework embodies a totally different approach.
The protection of personal data is a fundamental right, enshrined in a comprehensive
general regulation. Consequently, all restrictions to this right must be applied to the
minimum possible extent.
In the context of criminal proceedings and forensics,
128 the most important
instrument providing common rules for the processing of the personal data of
individuals involved in criminal proceedings is Directive (EU) 2016/680.
129 This
European act grants a high level of protection to the personal data of natural persons
while facilitating the cooperation between competent authorities of Members States.
Furthermore, article 15(1) of the Directive on privacy and electronic communications, which establishes, among other important provisions, the confidentiality of
electronic communications, provides, under the heading “Application of certain
provisions of Directive 95/46/EC”:
Member States may adopt legislative measures to restrict the scope of the rights and
obligations provided for in Article 5, Article 6, Article 8(1), (2), (3) and (4), and Article
9 of this Directive when such restriction constitutes a necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defense, public security, and the prevention, investigation, detection and prosecution of
criminal offences or of unauthorized use of the electronic communication system, as referred
to in Article 13(1) of Directive 95/46/EC. To this end, Member States may, inter alia, adopt
legislative measures providing for the retention of data for a limited period justified on the
grounds laid down in this paragraph. All the measures referred to in this paragraph shall be in
accordance with the general principles of Community law, including those referred to in
Article 6(1) and (2) of the Treaty on European Union.
127 See the United States of America’s National Report, Sect. 4.1.
128 See the European Union Special Report, Sect. 3.4.
129 See Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal data by competent
authorities for the purposes of the prevention, investigation, detection or prosecution of criminal
offences or the execution of criminal penalties, and on the free movement of such data, and
repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016, p. 89.
26
D. Moura Vicente and S. de Vasconcelos Casimiro