The Austrian Bar Association (ÖRAK) has suggested that courts should handle the processing of data from devices like phones. This is part of a discussion about new rules for how such data should be handled. The ÖRAK believes that this is the only way to ensure a legally clean solution, according to their statement on the proposed changes to the Criminal Procedure Code. Additionally, lawyers want the ability to seize data storage devices to be limited to more serious crimes.
These new rules became necessary after a ruling by the Constitutional Court (VfGH). The current laws for seizing data storage devices violate the right to privacy and data protection laws, according to the court. Therefore, the related sections will be repealed starting January 1, 2025. The court also set several guidelines: for example, a judge’s approval is needed to seize smartphones, laptops, and similar devices. This approval must specify which categories and types of data from which period can be reviewed and for what investigation purposes. Additionally, the public interest in law enforcement must be weighed against the affected individuals’ fundamental rights. After criticism of the draft law agreed upon with the ÖVP, Justice Minister Alma Zadic (Green Party) extended the review period and promised changes.
One main criticism was that after a seizure, the securing and processing of the data and the storage of the devices should only be done by special forensic units of the police. The investigating units of the police and the public prosecutor’s office are excluded from this process. This caused dissatisfaction, particularly since the prosecutor’s office is usually in charge of the investigation. Therefore, many called for the IT forensics of the prosecutor’s offices to be involved in the data processing.
However, the lawyers see it differently and generally welcome the rules: “According to the ÖRAK, the proposal that the processing (and later use) of the data should be carried out by a different entity than the investigating police and/or the investigating prosecutor’s office is understandable and follows the guidelines set by the VfGH.” They do not have concerns that the role of the prosecutor’s office as the lead of the investigation will be limited.
However, it is unclear how, in practice, the forensic units of the police should be separated from the investigating units, according to the statement. Even a strict “firewall” would likely not provide a legally clean solution because the data-processing special unit ultimately reports to the same chain of command as the investigating units. Therefore, they see the solution as having the data processed and stored by a court. “This way, the technical processing would be carried out only by staff and/or experts assigned to the court.”
In general, they want to limit the ability to seize data storage devices to certain crimes: “A restriction to intentional offenses with a minimum penalty (e.g., one year) or certain categories of offenses seems urgently needed; otherwise, there is a risk of the provision being unconstitutional again.” Another concern is to strengthen the requirement for courts to provide reasons for their decisions—recently, they have called for the abolition of “rubber-stamp decisions,” where courts adopt the prosecution’s arguments without providing their own reasoning.
