2.3 Data Protection and Digital Forensics
In the rules of criminal procedure (Art. 588 onwards of CPA, modified by OL
13/2015 of 5 October), we can find some special rules with regard to the interception
of telephonic and online communications; the capture and recording of oral communications with the use of electronic devices; the use of technical devices for image
monitoring, localization and capture; and the register of devices for massive information storage and remote register of computing equipment. Until said reform, the
legislative shortcomings revealed by the investigative needs required to fight technological crimes had been overcome thanks to the commendable efforts carried out
by the Supreme Court and the CC.
22
2.3.1 Preservation and Access to Computer Data Hosted on a Computer
System
Art. 588e a) to 588e c) of the CPA regulate the handling of and access to the contents
of computers, telephonic or online communication devices or devices for massive
storage of digital information or access to online data repositories. This regulation is
applicable to the access to any kind of electronic device with the ability to store
information, even if they do it temporarily and secondarily to the functions that
represent their primary purpose (e.g. mobile telephones, tablets, etc.).
This legislation provides for the seizure of and access to devices when a house
search is performed [Art. 588e a.1)] and the seizure of devices outside the context of
a search of the individual being investigated
23 [Art. 588e b)] and requires, as a
condition to authorize the access to the data contained in said devices, a judicial
authorization that motivates the access.
24 This authorization must establish the terms
and the extent of the data register; it may authorize the making of copies of digital
data; and it must establish the necessary conditions to guarantee the integrity and
preservation of data that make it possible, if necessary, to procure expert advice (Art.
588e c.1). The provisions included in this text must be complemented with the
provisions of Art. 588b c), in which the examining judge must take the decision to
authorize or refuse the requested measures, after hearing the Public Prosecutor’s
Office, within a period of no more than 24 h since the request is submitted. This
period may be interrupted if the judge requires extension or clarification of the terms
22 CC judgement 145/2014 of 22 September is particularly significant here.
23 This includes files stored outside the device in the cloud, or through any other system that
provides services to the user, such as a bank, a medical centre, etc., and which must be accessed
from the seized device that was used by the subject under investigation.
24 The Supreme Court judgement of 10 March 2016, for example, highlights this aspect very clearly
(RJ 2016\1114).
While assessing the proportionality of the measure of confiscation and exam of the computing
devices, the special nature of technological crimes must be taken under consideration. [Supreme
Court judgement of 9 December 2015 (RJ 2015\5420)].
386
F. M. Corvo López
In the rules of criminal procedure (Art. 588 onwards of CPA, modified by OL
13/2015 of 5 October), we can find some special rules with regard to the interception
of telephonic and online communications; the capture and recording of oral communications with the use of electronic devices; the use of technical devices for image
monitoring, localization and capture; and the register of devices for massive information storage and remote register of computing equipment. Until said reform, the
legislative shortcomings revealed by the investigative needs required to fight technological crimes had been overcome thanks to the commendable efforts carried out
by the Supreme Court and the CC.
22
2.3.1 Preservation and Access to Computer Data Hosted on a Computer
System
Art. 588e a) to 588e c) of the CPA regulate the handling of and access to the contents
of computers, telephonic or online communication devices or devices for massive
storage of digital information or access to online data repositories. This regulation is
applicable to the access to any kind of electronic device with the ability to store
information, even if they do it temporarily and secondarily to the functions that
represent their primary purpose (e.g. mobile telephones, tablets, etc.).
This legislation provides for the seizure of and access to devices when a house
search is performed [Art. 588e a.1)] and the seizure of devices outside the context of
a search of the individual being investigated
23 [Art. 588e b)] and requires, as a
condition to authorize the access to the data contained in said devices, a judicial
authorization that motivates the access.
24 This authorization must establish the terms
and the extent of the data register; it may authorize the making of copies of digital
data; and it must establish the necessary conditions to guarantee the integrity and
preservation of data that make it possible, if necessary, to procure expert advice (Art.
588e c.1). The provisions included in this text must be complemented with the
provisions of Art. 588b c), in which the examining judge must take the decision to
authorize or refuse the requested measures, after hearing the Public Prosecutor’s
Office, within a period of no more than 24 h since the request is submitted. This
period may be interrupted if the judge requires extension or clarification of the terms
22 CC judgement 145/2014 of 22 September is particularly significant here.
23 This includes files stored outside the device in the cloud, or through any other system that
provides services to the user, such as a bank, a medical centre, etc., and which must be accessed
from the seized device that was used by the subject under investigation.
24 The Supreme Court judgement of 10 March 2016, for example, highlights this aspect very clearly
(RJ 2016\1114).
While assessing the proportionality of the measure of confiscation and exam of the computing
devices, the special nature of technological crimes must be taken under consideration. [Supreme
Court judgement of 9 December 2015 (RJ 2015\5420)].
386
F. M. Corvo López