Judge bans police from scrutinising phone calls

It is unacceptable for mobile phone subscribers to be indiscriminately placed under suspicion and then eliminated from suspicion by the police - the court.

An appeals court yesterday dismissed a request by the Police Commissioner for Vodafone Malta Ltd and Mobisle Communications Ltd (the operator of Go Mobile) to provide location data on mobile phone calls and text messages in connection with the arson attacks made on property belonging to journalists Saviour Balzan and Daphne Caruana Galizia last year.

The decision overturned a ruling by the Data Protection Appeals Board which had authorised the Police Commissioner to obtain the location data from the two service providers.

Mr Justice Philip Sciberras, sitting in the Court of Appeal (inferior jurisdiction), heard that in the course of the investigation into the arson attacks, the police had sought the authorisation of the Commissioner for Data Protection to obtain the location data from the two companies.

The Data Protection Commissioner (DPC) had upheld the request subject to his prior checking the data from a data protection perspective.

The DPC told the companies they could provide the information to the police subject to two conditions. One, no information provided to the police but not required for police operations was to be retained or used by the police for any other purpose. Two, the companies had to inform the police about the completeness, accuracy and degree of reliability of the information provided.

Both Vodafone and Go Mobile appealed from this decision to the Data Protection Appeals Board. In its ruling, the board noted that the companies had not been asked to provide indiscriminate data but rather to furnish the police with location data strictly relating to specific timeframes and geographical areas.

The board added that the location data requested by the police could relate to other individuals not connected in any way with the alleged arson.

It was also possible for a person to be in one particular area with his mobile phone and to be caught by a base station located in another area.

The board added that the law empowered the police to have access to personal data in the course of executing their crime prosecution duties.

In conclusion, the board found that the police were authorised by law to demand location data from the two companies, while the DPC was bound to establish a balance between the right of privacy of the individual and the duty of the police to investigate a criminal offence.

The police's right to this data was subject to the data being limited for the specific arson investigations and that the data was not to be used for any other purpose. If data was found to be irrelevant to the investigations, then it had to be deleted immediately.

Both Vodafone and Go Mobile appealed to the Court of Appeal presided over by Mr Justice Philip Sciberras. They claimed that the board had wrongly applied and interpreted the law.

The companies also claimed that the board's decision would violate the right of the individual subscriber to privacy in his communications, which violation was unjustifiable.

On appeal, the court noted that the Data Protection Act aimed at protecting the individual from violations of his privacy through the processing of personal data. This law originated in the provisions of the European Convention of Human Rights.

A number of exemptions were provided for at law to this general principle of the privacy of the individual and a balance had to be maintained between the rights of the individual and the rights of society as a whole.

European case law also stipulated that such exemptions were not a blanket provision but their applicability had to be examined on a case by case basis.

Mr Justice Sciberras declared that any restriction on a human right had to be interpreted restrictively and had to be exercised in accordance with the law.

In this case there was no doubt that the request made by the police fell within the ambit of the exemptions to the right to privacy. The information sought by the police could be pertinent to criminal investigations. What the court had to examine, however, was whether the request made to the two companies constituted a widespread request that could infringe data protection issues.

The location data requested by the police in this case covered a wide geographical area, namely Msida, Pembroke, Birkirkara, Sliema, Marsascala, Naxxar, Bidnija, Mgarr, Burmarrad and Dwejra, over established dates and times. The collating of such data would certainly involve much work on the part of the service providers, though this technical issue was not relevant to the human rights aspect of this case.

The DPC himself had acknowledged that the information required by the police would involve the disclosure of a very high volume of personal data of persons who were completely unconnected with the police investigations into the arson attacks. The court acknowledged that this situation was of danger to the civilised community but the case in question had to be examined with sense and within reasonable limits dictated by law.

The court concluded that it was not acceptable for a large number of mobile phone subscribers, about whom there was no suspicion, to have their private telephone conversations subjected to scrutiny without their knowledge.

The exemptions to the principles of data protection ought not to serve as a Trojan horse to negate the confidentiality of communications made by unsuspected individuals who had no connection with crimes being investigated.

It was also unacceptable for mobile phone subscribers to be indiscriminately placed under suspicion and then eliminated from suspicion by the police. This would approach a police or totalitarian state, the court noted. The processing of personal data on such a large scale was not the only option available to the police to carry out their investigations into the case.

Mr Justice Sciberras upheld the appeals filed by Vodafone and Go Mobile and revoked the decision by the Appeals Board for Data Protection.