The title of this article is a literal translation of the name given to the Chapter VIII of the Title VIII of the Book II of the Spanish Penal Procedural Law (in Spanish Ley de Enjuiciamiento Criminal, henceforth LECrim). To what are we referring when we talk about devices of massive storage of information? These devices are of common use, may be found over every desk in an office, in almost every table in a home, and is impossible not to see a library filled with such devices. They are substituting our old pencils, pens, notebooks, books, are changing our way of work, and they have been doing it for the las three decades or even more. For example, I as a blogger I don’t use any, If you give me a pencil I would not know how to use it, or probably after five minutes using it my hands will ache. But if you give me a computer, I can write during hours and I will not feel any pains. The latter is an example of a Device of Massive Store of Information, they are our computers, our tablets, our smartphones, and also all the objects which serve as a digital store, like the memory sticks, the DVDs and CDs, or the external hard disks. And we have to include one more, the cloud, I mean the servers located all around the world where their user store digital information, because when we use Dropbox or the ICloud Drive in a Mac computer, this information is storing is some place, maybe very far from where we are using it.
These devices has revolutionized our way of work, but also they have revolutionize the Spanish Law, since there are not a right which can protect all the data contained in such devices in our actual Spanish Constitution (CE). Let’s see it with more detail. I have not mention it before, but the Title of the LECrim where is included the Chapter VIII which we are seeing now, refers to all the measures of investigation which affect to the article 18 of the CE, this article is compounded by four sections, each regulating an important aspect of the privacy with which all the Spanish citizens are entitled. The first section, talks about the right to the intimacy, we can define such intimacy as the sphere of privacy where each citizen decides what he want to share with others, this is a right very developed by the Spanish jurisprudence and apply to a great variety of situations, as the search of a car or in the agenda where a person under arrest has all his telephone numbers, indeed we can say that the other three sections are only a specific derivation of the original right to the intimacy of the first section. The second section, protects a domicile from a not consented intromission by its inhabitant, if the Spanish police wants to search a Spanish house it needs a warrant, the consent of its inhabitant, or be the witness of a flagrant crime. The third section, recognized the right to the secret of the communications, so a message transmitted using a device will be always protected by this right, and not only the message, the integrity of the device used is protected too (although the oral communications don’t fit properly into this right, the Spanish tribunals consider them under the protection of the right to the secret of the communications), this right, as the right to the inviolability of a domicile of the second section, obliges to the Spanish police to acquire a warrant if it wants to interfere into the communications of two or more suspects, although the consent of one of the parties involved into the communication is validates the police intervention too. And the fourth section has a right which every day is more important, and consequently more popular, there is not a company which is not concern with it, the right to the data protection, this right protect all the data that may serve to identify a person and make a profile about its habits. Why does not fit in any of these rights? because a Device of Massive Storage of Information has a lot of kinds of data, has photographs, telephone numbers, letters, emails, documents…all protected by the right to the intimacy, has emails not open yet or the registry of the phone calls made using such device, which are protected by the right to the secret of the communications, and has data concerned with the location of its user or cookies, which are protected by the right to the data protection, and as we have seen though they are protected in the same article, they don’t have the same level of protection, not all oblige the Spanish police to obtain a warrant when it needs to interfere with them.
Them, what has been done by the Spanish tribunals? they have created a new right, is a right of new generation. This right is the right to your own virtual environment, notwithstanding this has been a long process, because until they had this idea, they tried to sever the data stored in these devices according to the right which was affected by them. And as we have said this only caused troubles of interpretation, above all because the the right to the intimacy, is not protected by the CE by a warrant, and under certain conditions the Spanish police may interfere with this right without one, therefore if we see the rights which protect a device of massive storage of information as split, the Spanish police may access to the agenda of a smartphone without a warrant, but not to the phone calls made with such device. We can see clearly that this cannot work well, how can it guarantee that once the police has access to the smartphone it will not access to all its information? Before continue, let’s clarify that as a general rule the right to the intimacy demands a warrant, but when the police acts to comply a legitimate constitutional goal (as the prevention and the discovery of crimes), under a legal habilitation (as the conferred by the art. 282 LECrim), in accordance with the principle of proportionality (it is compound by the principle of suitability: the measure has to suit to its end, the principle of necessity: there cannot be another measure less harmful to achieved the goal, and the principle of proportionality in strict sense: from the measure are derived more benefits to the general interest, than drawbacks to the particular interests of the person affected), and with urgency, it doesn’t need one.
These troubles of interpretation are solved thanks to the right to your own virtual environment. First this right appear in the Spanish jurisprudence, we find a good example in the Spanish Supreme Tribunal´s (TS) sentence 342/2013, of April 17, 2013 (RJ 2013, 3296). Here the TS argued how is more convenient to treat all the data stored in these devices of massive storage of information, as a single sort of data, because all this information may have a greater impact into the intimacy of its user than when this information is used separately. The law came after, as usually happens. On the basis of these jurisprudence, the LECrim was reform by the Organic Law (LO) 13/2015 (in Spain a Organic Law is a law which develops fundamental rights, which are those included from the art. 14 to the art. 29 of the CE). But the Chapter VIII, which we are seeing now, has its particularities, because the LO 13/2015 has as its origin, or at least its principal motive, the Constitution Tribunal´s sentence 145/2014 of September 22, 2014, whose argumentation about why, a microphone located into a cell spying what is said by two persons under arrest was illegal, putted upside down all what have been said by the Spanish tribunals before. It stated that this measure of investigation was not in the law, that is was attempting against the principle of reserve of law, since according to the CE, all State interference in the ambit of the fundamental rights and public liberties which influences directly over its development (art. 81.1.CE) or limit its exercise (art. 53.1 CE), needs, besides, a legal habilitation. In other words, those who might be subject to the measure couldn’t be aware of it utilization because it wasn´t in the law, therefore it was illegal. Up to this sentence the Spanish Tribunal used the old art. 579.2 LECrim which regulated the interception of a telephonic communication, to make legal this kind of measures of investigation, but evidently it wasn´t in the law, and the TC did good forbidding it until the LECrim through the LO 13/2015 regulated it. But the search of devices of massive storage of information had a different problem, the LECrim already contemplated the seize of the evidences related to a crime in its article 326, but what was not regulated was the search of this kind of technological devices, which of course were protected by the right to the intimacy, the problem arose when they realize that it wasn´t the only right involved. Hence, the articules 588 sexies of the LECrim came to end with this deficiency.
The articles 588 sexies are three, they are differentiated by a letter, so they are numbered from the letter a, to the letter c. The article 588 sexies a), contemplates the more habitual case where these devices of massive storage of information are found, it is the search of a domicile, and the important is how this new article has distinguish between the two motivations which by be included in a unique warrant of in two different, in other words, the warrant which authorizes the search of a domicile with the motivation required by the law to authorize this entrance, has also to motivate according to the articles 588 bis of the LECrim the search of the devices of massive storage of information that would be found in the domicile searched. Or there is other option, through the warrant authorizing the search of the domicile, the police may seize the devices and later obtain another warrant authorizing the search of such devices.
The second article, is the article 588 sexies b). This article is aimed to regulate the find of these devices of massive storage of information in places that are not a domicile, the easier example is when are found in the pocket of a person after he has been arrested, probably a smartphone. It comes to say more or less the same than the article 588 sexies a), that the police needs a warrant to search the devices found. We can find a case in which the arrested person has been previously required by a judge through a warrant having as object his detention, here as we have said above, would be needed another warrant where the judge had complied with the articles 588 bis of the LECrim to search the devices found into the possession of the arrested person.
And the third article logically is the article 588 sexies c). This article has the content that the warrant emitted by the judge must have. We can mention the necessity of expressly include an authorization to copy the information found in the devices, or the exigency of return the devices to its owner when they are not considered the object or the instrument of the crime. Though, the more important are, the exceptions contained is this article to the general rule of a prior warrant authorizing the search of this kind of devices. These exceptions are two, one is aimed to the search of what we have called at the beginning the cloud, and the other to the search of physical devices, but in essence are the same, what both exceptions say is that in some cases, motivated by the necessity of a rapid actuation of the police, it can search the devices of massive storage of information without a warrant, for example to avoid that the information existing in the cloud may be deleted. What we see here is another example of how important is the mark left by the Spanish jurisprudence in the LECrim, do you recall what I have told you about the right to the intimacy (art. 18.1 CE)? that in the cases of urgency (combined with a legitimate constitutional interest, a legal habilitation, and the fulfillment of the principle of proportionality) the police may interfere with the right to the intimacy without a warrant? this is what has been inherited by the law.
This article also mention a duty of collaboration of those who may have the skill needed by the police to obtain the information stored in these devices. Is a duty which apparently doesn’t have a limitation more than the stated in the art. 416.2, so we can understand that the police may require the collaboration of anyone who may help.
Up to this point we have talk always about a warrant, and in this sort of measure of investigation is more true than in others. Because the consent of the suspect giving the passwords to the police, doesn’t exempt the latter of its obligation to obtain the warrant which always will be what authorizes the search of the device found. A thing that doesn’t happen when the suspect consent the search of his domicile, or the interventions of the communications where he is a party, because in these cases the consent of the suspect will make legal the intervention of the police without a warrant.
To end, we can mention the conclusions more important:
- The right to your own virtual environment, is a right developed by the Spanish jurisprudence, and is compounded by the rights to the intimacy, the right to the secret of the communications, and the right to data protection.
- The warrant which authorizes the entrance into a domicile, has also to motive the search of the devices of massive storage of information found in the domicile. The same will happen with the warrant which authorizes the detention of a suspect.
- The police may search the devices of massive storage of information without a warrant, under conditions of urgency, as an inheritance of the jurisprudence which has developed the right to the intimacy.
- The consent of the suspect giving the password of a device to the police will not allow to the latter its search until the obtention of a warrant.