1. The law proposal and the constitutional issues raised

Directive 2019/1[1] (‘ECN+ Directive’) (more information here) entered into force on 3 February 2019 and aims to ensure that, when applying EU competition rules, national competition authorities (‘NCAs’) have the appropriate enforcement tools in order to achieve a genuine common competition enforcement area. Member States should transpose it to their national legal systems until 12 December 2024. In Portugal, the draft proposal (anteprojeto) of transposition was prepared by the Portuguese Competition Authority (Autoridade da Concorrência - ‘AdC’) and, following a public consultation period, sent to the Government (more information on the procedure here).

On 21 May 2021, the Portuguese Government submitted to the Parliament a law proposal (no. 99/XIV/2.ª), which  amends Law no. 19/2012 and implements the ECN+ Directive. Since then, several entities have submitted to the Parliament their views concerning the law proposal (see here). In this regard, questions concerning the compatibility with the Portuguese Constitution of certain provisions (Articles 18 and 31[2] of the proposal to amend Law no. 19/2012 [‘the proposal’]) granting the AdC the power of, inter alia, accessing emails and other electronic communications of the concerned undertakings or persons under investigation have been raised.

In particular, both the working document of 24 May and the opinion of the Committee on Economy, Innovation, Public Works and Housing of 25 June submitted that those provisions should be analysed in light of Article 34(4) of the Constitution, which prohibits any access of public authorities to correspondence, telecommunications and all other means of communication, save where otherwise prescribed by law and in the field of criminal procedure. The working document emphasises that, in the Portuguese legal system, competition law infringements are qualified as administrative offences (see, in this regard, Article 13 of Law no. 19/2012 and Article 42 of Decree-Law no. 433/82). Accordingly, their legal and ethical unworthy is lower than that of a crime. Moreover, the said legal system does not grant the accused persons the same level of protection of the rights of defence as that granted by criminal law. Thus, ‘since this framework was not amended by the law proposal and the above referred constitutional provision specifically refers to exceptions set forth in criminal law’, it is concluded in the working document that ‘the harmonisation of the proposal with Article 34(4) of the Constitution should be considered, without prejudice to the applicable EU law principles and the wording of Article 8(4) of the Constitution’ (emphasis added). Due to such constitutional concerns, an opinion of the Parliamentary Committee on Constitutional Affairs, Rights, Freedoms and Guarantees was also requested (not yet available on the Parliament’s website).

The National Commission for Data Protection (Comissão Nacional de Proteção de Dados - ‘CNPD’) was also consulted. It drew particular attention to the need to clarify the wording of Article 18(2) of the proposal, in order to ensure that the AdC’s access to emails and other electronic communications is subject to prior authorisation of a judicial authority (in casu, the investigating judge – juiz de instrução criminal). In this context, the CNPD recalled the wording of Article 6(3) of the Directive, as well as the case-law of the Court of Justice of the European Union (‘ECJ’) concerning Directive 2002/58[3], on privacy and electronic communications

2. Analysis

The AdC’s power to access emails and other communications, as well as the conditions for its exercise, raises extremely important and delicate questions, on the crossroads of fundamental rights protection, the specificities of competition law infringements and the principle of primacy of EU law.

From the outset, it is important to clarify that Article 18 of the law proposal aims at transposing Article 6 of the ECN+ Directive (see also recitals 30, 32 and 35). The possibility to access emails and other electronic communications (Article 18(1)(b) of the law proposal) derives from Article 6(1)(b) of the Directive, pursuant to which ‘Member States shall ensure that national competition authorities are, at a minimum, […] empowered to examine the books and other records related to the business irrespective of the medium on which they are stored, and have the right to access any information which is accessible to the entity subject to the inspection’. Moreover, in light of recital 30, NCAs shall be empowered to obtain ‘all information related to the undertaking or association of undertakings which is subject to the investigative measure in digital form, irrespective of the medium on which the information is stored, such as on laptops, mobile phones, other mobile devices or cloud storage’. According to recital 32, ‘the power to examine books or records should cover all forms of correspondence, including electronic messages, irrespective of whether they appear to be unread or have been deleted’[4]. Pursuant to recital 35, NCAs should have ‘the right to require information in any digital form, including emails and instant messaging system messages […], provided it is accessible to the undertaking or association of undertakings which is the addressee of the request for information’.

Concerning the scope of the AdC’s power, and looking at the wording of Article 18(1) of the proposal, it seems that it respects the Directive’s economy and objective. Therefore, in light of the principle of primacy of EU law, and within the scope of application of the Directive[5], there is no reason to assess the compatibility of that provision with the Portuguese Constitution. In this regard, it is worth recalling that, in 2020, the Portuguese Constitutional Court rendered a judgment where it declared its lack of jurisdiction to rule on the compatibility of EU law provisions (including national provisions implementing EU law) with the Portuguese Constitution (see more information here).

Conversely, as is also clearly set out in the Directive, the power to inspect business premises ‘is without prejudice to requirements under national law for the prior authorisation of such inspections by a national judicial authority’ (Article 6(3) and recital 31). In the same vein, pursuant to recital 35, ‘Member States should be free to provide for procedural rules on such requests for information, such as the legal form they take, provided that those rules allow for the effective use of this tool’. Moreover, where the AdC does not apply Articles 101 and 102 TFEU, the principle of primacy of EU law is not at stake.

Thus, it is not the power to access emails and other electronic communications per se, but rather the conditions for its exercise, that may be assessed in light of the Portuguese Constitution. The Directive does not establish procedural rules applicable to the inspections of premises of undertakings or associations of undertakings.

Balancing the different interests at stake

In so doing, as in any other case where potential conflicting interests are at stake, a balance must be struck, resorting to the principle of proportionality. In this case, the legitimate interest of effective and timely detection of competition law infringements shall be balanced with the right to privacy of communications of the addressees of the investigation, protected by Articles 7 and 8 of the Charter of Fundamental Rights of the EU (the ‘EU Charter’).

Thus, whereas the interest of detecting infringements and enforcing competition law rules, coupled with the challenges of the digital environment, justify granting the authority the power to access electronic and instant messages, the procedural rules framing such power must be carefully devised, in order to fully take into consideration all the interests at stake. Namely, it must be subject to prior authorisation of an independent authority resorting to the judiciary.

As advanced above, this question was raised by the CNPD. In its opinion, the use of the expression ‘competent jurisdictional authority’ (autoridade judiciária competente) in Article 18(2) of the proposal, rather than ‘competent judicial authority’ (autoridade judicial competente), may give room to interpret it as attributing the competence for such authorisation to the public prosecutor’s office. However, in the Portuguese legal system as currently in force, the access to correspondence (not necessarily electronic communications) in investigations of administrative offences shall, in principle, be preceded by the authorisation of the investigating judge (juiz de instrução criminal) (see, in this regard, Article 179 of the Criminal Procedure Code, applicable by means of Article 41 of Decree-Law no. 433/82 and Article 13 of Law no. 19/2012). Moreover, Article 17 of the Cybercrime Act (Law no. º 109/2009) currently prescribes that the access to electronic communications must be preceded by authorisation of the investigating judge.

In this context, it is important to recall that the Directive does not determine which authority of each Member State is competent to grant such authorisation, leaving it to the Member States’ discretion. In any case, the latter shall take into account the specific characteristics of competition law infringements and the challenges that competition authorities face nowadays. For instance, it is hard to conceive that sufficient evidence of an infringement could be found in books or records physically stored in the premises of an undertaking. Moreover, we must not lose sight of the fact that the addressees of competition law rules are primarily the undertakings. As a consequence, pursuant to the Directive and to the law proposal, only information accessible to the undertaking, the association of undertakings or the person subject to an investigation and which is related to the undertaking or the association of undertakings under investigation can be accessed by the NCA. In other words, the AdC’s power is naturally limited to communications exchanged within the context of a professional activity. Personal communications shall thus be excluded from its scope[6].  

In this regard, it is relevant to consider the distinction between read and unread correspondence, which has been discussed in the Portuguese legal literature and case-law, but which was expressly abandoned by the Directive and by the law proposal (Recitals 32 and 73 of the Directive and Articles 18(1)(b) and 31(2) of the law proposal). Agreeing with what is advocated by the AdC in its opinion on the law proposal (paragraphs 105 and 106), in the digital environment, due to its specificities, this distinction may not be appropriate (it is possible to mark any email as ‘unread’). In any event, the European Commission has underlined the need to achieve greater coherence between the concepts of the digital and the pre-digital worlds. In practical terms, this would mean abandoning the distinction between read and unread correspondence, both with regard to emails and to traditional correspondence. This is all the more so since, as just developed above, the scope of the AdC’s power in competition law investigations is limited to professional communications.

Likewise, it is worth mentioning that the case-law of the ECJ has drawn a distinction between natural and legal persons, when it comes to assess the level of protection of certain rights granted by the EU Charter, such as the right to silence and to protection against self-incrimination. As the ECJ explained in the Consob case (analysed here), the case-law concerning procedures that may lead to the imposition of penalties on undertakings and associations of undertakings does not apply by analogy when determining the scope of the rights of natural persons.

The special characteristics of competition law, namely the fact that it applies primarily to undertakings, shall thus be born in mind when analysing the ECJ’s case-law in the field of data protection, mentioned by the CNPD in its opinion. Indeed, the ECJ has recently ruled on the power of the public prosecutor’s office in Estonia to authorise access by a public authority to traffic and location data of an accused for the purposes of a criminal investigation. This judgment (C‑746/18) is undeniably relevant, namely by providing some guidance on the requirements for the authority who is in charge of authorising the access to personal data to be considered independent. Notwithstanding, two main features must be distinguished. Firstly, the data at stake in that case referred to a natural person, accused of a criminal offence. Secondly, within the context of a criminal investigation, the public prosecutor’s task is to direct the criminal pre-trial procedure and to bring, where appropriate, the public prosecution in subsequent proceedings. The same does not hold true in competition law proceedings, where it is the NCA that is in charge of the investigation, as well as of the final decision leading to a finding of an infringement.  

Finally, it is worth mentioning that the President of the Republic has recently requested a preventive constitutional review concerning a Parliamentary Decree (no. 167/XIV of 20.07.2021) aiming at amending Article 17 of the Cybercrime Act, pursuant to which the competence to authorise the seizure of electronic messages would switch from the investigating judge to the public prosecutor’s office (more information here). On the one hand, this shows a tendency of the Portuguese legislator to dismiss the intervention of a judge (once again, we recall that this is a national legislative option, which does not derive from EU law). On the other hand, the characteristics of the competition law investigations mentioned above may claim different solutions.

3. Conclusion

The AdC’s power to access emails and other electronic communications, now enshrined in Article 18(1)(b) of the law proposal, seems justified by the specific features of competition law infringements and the new challenges of the digital environment. Moreover, since it respects the wording of Article 6 (combined with Recitals 30, 32, 34 and 35), as well as the economy and the objectives of the Directive, it seems to be in line with EU law. The principle of primacy of EU law thus renders meaningless its assessment in light of the Portuguese constitution.

Such power must nonetheless be limited to what is strictly necessary to ensure an effective and timely detection of infringements, in order for the rights of the addresses of the investigation, enshrined in the EU Charter and in the Portuguese Constitution, to be safeguarded. The conditions pursuant to which the power to access electronic communications can be exercised, which lie within the procedural autonomy of the Member States, must naturally comply with the general principles of EU law, as well as national constitutional law.

Prior authorisation by the investigating judge may be considered an appropriate way to balance all the interests at stake, provided that it results from the overall structure of the Portuguese legal system. In particular, it is able to accommodate the conflicting interests at stake, respecting the essence of the right to privacy recognised by the EU Charter. Nonetheless, when designing the system, the legislator must not lose sight of the specific characteristics of this field of the law.