The Romanian Constitutional Court (CCR) ruled on 16 September 2014 that a law that required the mandatory registration of all prepaid SIM cards and free WiFi users, is unconstitutional, as a whole.

The Court reviewed the law as a result of the Romanian Ombudsman’s objection concerning its possible unconstitutionality. Several human rights NGOs asked the Ombudsman in July 2014 to notify the CCR regarding the law which had been recently adopted, and to ask the Court to rule on the law’s constitutionality before its promulgation by the President.

Also, on 15 September 2014, a Romanian association for the defence of human rights APADOR-CH and EDRi-member ApTI submitted an amicus curiae requesting the CCR to rule the law unconstitutional, as it breaches the right to privacy.

The Court ruled that

“the law’s provisions are not precise and predictable, and the manner in which the necessary data regarding the registration of prepaid SIM cards and WiFi hotspot users is retained and stored does not provide sufficient means to guarantee the necessary efficient protections for these personal data against abuse or any other kind of unlawful access to and use of these data.”

The full argumentation on this case will be published in approximately one month in the Official Journal.

This is the second important ruling of the CCR on privacy issues, after its decision from 8 July 2014 that declared the second data retention law unconstitutional.

The decisions triggered quick and aggressive reactions in the media from the Romanian Intelligence Service (SRI), Romanian Ministry of Internal Affairs, and politicians from the Committees supervising the SRI activity, all claiming that the CCR decisions have made a “legal vacuum” and now the terrorists will flood Romania to buy prepaid SIM cards.

In an unprecedented move, the CCR issued a press release counterattacking those arguments and reiterating the legal arguments used in their decisions. The SRI came back the following day with a press release with more allegations that in these circumstances the institution may not defend the national security and that now anonymity is allowed in communications.

But one should not be fooled by the smoke, as all this “security-forces-alleged-drama” has some real interests behind it.

First, as the full argumentation behind the unconstitutionality of the prepaid law was not published yet, it is meant to pressure the CCR to water down the decision, so that another law could be initiated.

Secondly, the security institutions in Romania want to push a new data retention law and another attempt (it would be the fifth one now) for mandatory prepaid SIM cards as quick as possible.

Thirdly, all this talk hides the interests on another draft law – on cybersecurity – that was quietly adopted by the Chamber of Deputies and received just two days prior to the debate in the Senate (which is the decisive chamber for this law). As reported earlier in EDRi-gram, that law will give the right for SRI and other nine public institutions to have access to the computer data held by those companies, at a simple “motivated request” from these institutions in their own attributions.

Romania: The law mandating the registration of prepaid SIM cards has been ruled unconstitutional (19.09.2014)

http://thesponge.eu/index.php?idT=4&idC=5&idRec=1115&recType=story

SRI Press release on the legal vaccum created by the CCR decisions (only in Romanian, 20.09.2014)

http://www.sri.ro/comunicat-de-presa-20-09-2014-17-06.html

CCR press release on the decision on law on the pre-pay cards (only in Romanian, 16.09.2014)

http://www.ccr.ro/noutati/COMUNICAT-DE-PRES-103

CCR press release answering the SRI allegations (only in Romanian, 18.09.2014)

http://www.ccr.ro/noutati/COMUNICAT-DE-PRES-106

EDRi-gram: Romania: No communication without registration (02.07.2014)

https://edri.org/romania-no-communication-without-registration/

ApTI: Amicus Curiae to the CCR (only in Romanian, 15.09.2014)

http://apti.ro/interventie-la-curtea-constitutionala-impotriva-inregistrarii-cartelelor-prepay

(Contribution by Bogdan Manolea, EDRi-member ApTI, Romania)