With an application for a 2024 criminal procedural law amendment law, the FPÖ has reopened the chapter on cell phone security (6/A). The proposed changes to the law were announced today Budget Committee However, it was postponed with the votes of ÖVP, SPÖ, NEOS and the Greens. According to Justice Minister Alma Zadić, the sensitive matter is being worked on with the intensive involvement of all stakeholders, and all parliamentary groups have also been spoken to. She is aware that the new regulations must come into force on January 1st. She promises that it will work out, said Zadić, who also pointed out a delicate balancing of fundamental rights between law enforcement and data protection.
Before the summer, the ÖVP and the Greens had already presented new rules for the security and data analysis of cell phones and other electronic devices and introduced them in the Justice Committee, but they were no longer discussed or decided on in the plenary session. According to Zadić, this original proposal was also submitted to parliament as a ministerial draft, with the opportunity for stakeholders to submit comments in the summer. The original draft will now be revised based on this feedback. The reason for the new regulation of the evaluation of cell phone data was or is a ruling by the Constitutional Court (VfGH) from December 2023.
The FPÖ, for its part, has now taken up the original proposal from the ÖVP and the Greens and revised it into its own proposal. The Freedom Party points to an interim ruling by the European Court of Justice (ECJ) from October 2024 on the subject. According to the FPÖ’s application, it should be regulated that access to data storage media and data – as provided for in the original application – is subject to a prior judicial check. From the moment the data carrier is tactilely removed, any access and attempted access by the investigating law enforcement authorities should be legally limited, traceable and verifiable.
FPÖ for judicial orders and data analysis by the court
Harald Stefan (FPÖ) specifically pointed out that the data categories, data content and time periods for the evaluation had to be determined. In particular, there is a need for an organizational separation between those who evaluate the data and the authorities who are actually investigating, says Stefan. From his point of view, the data should be processed by the court. As a compromise to such a regulation, he could imagine exceptions for the criminal police and public prosecutor’s office to evaluate data in the event that the person concerned does not insist on an evaluation by the court. He could not understand objections – regarding resources and procedural delays – to this proposal for evaluation by the court, especially since it only concerned where the same experts were assigned and where the data would ultimately remain.
From the FPÖ application, Stefan also emphasized that the confiscation of data storage media and data should generally be limited to offenses that are punishable by more than one year’s imprisonment. But here too he could imagine a compromise in the form of allowing acceptances in some cases even under this penalty range – for example in the case of dangerous threats or cyberbullying. Basically, the matter has to be “repaired” by the end of the year, otherwise seizures can no longer take place from January, says Stefan. The federal government has so far defaulted, which is why the FPÖ has taken action with this application. Overall, it is important to find a way to protect fundamental rights in the matter.
Elisabeth Götze (Greens), on the other hand, did not consider the suggestion that confiscations should be limited to offenses with a one-year prison sentence or more to be practical. This would make it impossible to prosecute cases such as dangerous threats or cyberbullying. She reiterated her objections to a judicial evaluation of the data, especially since the know-how would have to take years to build up and this would also result in procedural delays. Götze also pointed out that discussions were still ongoing to find a good, common solution. Stephanie Krisper (NEOS) agreed with the objections regarding resources and know-how regarding data analysis by the court. In any case, she regrets the fact that we are already approaching the end of the year without a concrete solution, especially since it has been known since the Constitutional Court ruling that new regulations are needed.
Zadić: Data processing by the court would take too long
Justice Minister Zadić emphasized that this was a sensitive matter because two essential fundamental rights had to be weighed up. On the one hand, there is the public interest in effective criminal prosecution, and on the other hand, fundamental rights such as data protection and privacy must be taken into account. But there will be a new regulation on January 1st, she assured. In addition, all justice stakeholders are informed and involved and know what to expect. Regarding the FPÖ’s application, she pointed out that if the confiscation of data carriers was limited to offenses with a one-year prison sentence or more, it would no longer be possible to take the cell phone in cases of stalking or upskirting, for example. She urgently warns about the point of data processing by the court because that would take far too long. In the interests of efficient criminal law, this task should not be delegated to the courts.
Key points from the FPÖ application on data processing and confiscation
According to the FPÖ application, the new regulations should in any case weigh up the public interest in the prosecution and investigation of crimes with the constitutionally protected interests of those affected and balance them accordingly. However, the statutory management and control powers of the public prosecutor’s office over the criminal police and the public interest in criminal prosecution should be taken into account. As far as possible, a clear distinction should be made between the personal data of the different categories of data subjects.
In addition, appropriate technical and organizational measures must be implemented to ensure and provide evidence that the processing is carried out in accordance with the EU Data Protection Directive.
The proposed data processing by the court should ensure that the public prosecutor’s office or the criminal police responsible for the investigation procedure only has access to the data that corresponds to the court’s approval in terms of data content, data categories and time period. Ultimately, access to and processing of data should only take place to the extent necessary and only if suitable investigative measures that are less invasive of fundamental rights are not available.
The FPÖ wants to regulate the matter in detail, for example the requirements for short-term court approval for confiscation. More precise requirements should also be set for the general permissibility of confiscating data storage media and data. As mentioned by Harald Stefan, these would have to be essential to clear up a concrete suspicion of an intentionally committed crime that is punishable by a prison sentence of more than one year – with a prison sentence of more than six months if the owner consents to the confiscation. According to the application, seizure should also be permissible to determine the whereabouts of a fugitive or absent defendant who is strongly suspected of an intentionally committed criminal offense that could result in a prison sentence of more than one year.
The confiscation of data storage media and data must also be ordered by the public prosecutor’s office on the basis of court approval and carried out by the criminal police. According to the application, court approval should not be necessary if data recorded by means of image and sound recordings in public or publicly accessible places are to be secured. In this case, every person is obliged to grant access to them and, upon request, to export them in a commonly used file format or to have a copy made.
The seizure may also only be ordered for the period, data categories, data content and periods that are likely to be necessary to achieve its purpose. In the proportionality test, particular consideration should be given to whether there is a concrete or urgent suspicion of a crime, whether the seizure should be carried out from the accused or another affected person, authority or public service, how serious the crime to be investigated is, and whether it is protected by professional or official secrecy Data is affected, how extensive the expected amount of data is, how large the group of people likely to be affected is, whether only data stored on a data carrier or also in other storage locations is included and whether data from a message transmission (traffic data, access data and location data), geographical locations, Messages and information sent, transmitted or received as well as special categories of personal data are included.
According to the application, “for the time being without an order or approval”, in the event of imminent danger, the criminal police should, under certain conditions, be entitled to secure data and data storage media on their own initiative or to access them in the event of imminent loss. The public prosecutor’s office would therefore have to apply for court approval immediately afterwards.
If and as soon as the conditions for confiscation do not exist or no longer exist, the public prosecutor’s office or the court must revoke the confiscation. Detailed regulations can also be found in the application, for example regarding reporting and information obligations or the return or destruction of the data material. (Continuation of the Budget Committee) mbu