A brief overview of the Italian landscape before Law Decree no. 132/2021
The amendments introduced by the Law Decree, aimed at resolving inconsistency between the rules for External Communication Records and the principles established by the March 2, 2021 decision of the Court of Justice of the European Union (“CJEU”), in which it deemed necessary:
- a proportional approach to access to ECR with reference to the seriousness of crimes; and
- prior review and authorization carried out by a court or an independent administrative body, a fair third party that is not one of the parties in the criminal proceeding.
The CJEU ruling was based on interpretation of Section 15(1) of the E-privacy Directive, in light of the fundamental privacy rights set forth in the EU Charter of Fundamental Rights.[2]
In accordance with the decision of the CJEU, in Italy the role described in point (ii) above cannot be filled by the public prosecutor’s office, as it directs investigations and brings public prosecution before the court. It followed that the Italian ECR regulation, pursuant to which access to ECR could be authorized only by a decree from the public prosecutor, regardless of the seriousness of the crime, conflicted with the CJEU decision.
Furthermore, after the CJEU decision, Italian judges in preliminary investigations and Italian courts started to issue contradictory measures and decisions concerning the validity of orders for acquisition of ECR directly provided by the public prosecutor without judicial authorization. As a result, issues arose around the question of whether the EU directive on privacy and electronic communications could be considered directly applicable in Italy.[3]
These different interpretations shaped a confusing and uncertain legislative landscape, and urgent action was required on the part of the Italian legislature. The result was adoption of the Law Decree in question and its subsequent conversion into law.
Law Decree no. 132/2021: The main amendments to ECR regulation
Section 1 of the Law Decree specifically amended section 132 of the Privacy Code for the purpose of ensuring the possibility of acquiring ECR and, at the same time, adapting national legislation to the principles established by the decision of the CJEU by (i) restricting the possibility of acquiring telephone and computer records to certain serious offenses; and (ii) introducing judicial review of a public prosecutor request for acquisition of ECR and subsequent approval in urgent cases.
Data acquired in violation of the provisions indicated in the Law Decree may not be used in criminal proceedings.
The amendments in section 1 of the Law Decree focus on the following:
- Judicial authorization
Data may be acquired only after a judicial authority (i.e., an Italian judge for preliminary investigations or an Italian court) has issued a well-founded decree, at the request of the public prosecutor, the defense counsel, the injured party, or another private party.
By including the defense counsel in that list, the Italian government seemed to be implicitly excluding the opportunity for defense counsel to appeal directly to service providers for access to ECR, something that was possible before the Law Decree took effect, pursuant to section 391-quarter of the Italian Code of Criminal Procedure.
- Conditions for access to ECR
Access to ECR may be allowed by the judicial authority only for specific kinds of offenses and if particular conditions are met. Namely, such access may be granted if the following requirements are met:
- an offense for which Italian law provides punishment of life imprisonment or imprisonment of no less than a maximum of three years, as well as offenses consisting of threats, harassment, or disturbance of persons by telephone, when said threats, harassment, or disturbance are serious;
- sufficient evidence of the commission of that specific offense;
- access to ECR must be significant in terms of assessment of the facts.
- Emergency procedure
In urgent scenarios when there is good reason to believe that delay may seriously prejudice the investigation, the public prosecutor provides for acquisition of ECR with a well-founded decree to be notified immediately, and in any case no more than 48 hours after it is issued, to the judge responsible for issuing authorization. Within the following 48 hours, the judge shall determine its validity with a well-founded decree.
- Interim provisions
ECR acquired in criminal proceedings prior to the effective date of entry into force of the Law Decree may be used against the defendant only together with other evidence and exclusively for the investigation of offenses meeting the conditions in point (ii) above.
Final remarks
Notwithstanding the functional inability of ECR to reveal the content of communication, by accessing them public authorities acquire copious information about individuals’ private lives. Therefore, these activities certainly have potential to affect the constitutional right to privacy. With this reform, the Italian legal system has achieved an important goal, meaning that, by complying with the strict standards set by EU regulations and case law, it redefined the balance between privacy rights and investigative needs.
[1] See the last Law Decree no. 131/2021, as amended by Law 178/2021.
[2] See our previous article on the March 2, 2021 CJEU decision (decision No. C‑746/18 H.K./Prokuratuur) and its impact within the Italian landscape on external communication record regulation.
[3] See our previous article on Italian court decisions on access to external communications records after the ruling of the CJEU.
