VOID: Authority to collect or record traffic data in real-time by Law Enforcement Authorities, Section 12 of R.A. 10175

R.A. 10175 or the Philippine Cybercrime Prevention Act of 2012 allowed for real-time collection or recording of traffic data.

In the various petitions filed before the Supreme Court, Petitioners sought to invalidate this provision primarily on the ground that it violated a person’s right to privacy.

This provision on real-time collection of traffic data is reflected in Section 12 of R.A. 10175, which is faithfully reproduced herein:

Sec. 12. Real-Time Collection of Traffic Data. — Law enforcement authorities, with due cause, shall be authorized to collect or record by technical or electronic means traffic data in real-time associated with specified communications transmitted by means of a computer system.

Traffic data refer only to the communication’s origin, destination, route, time, date, size, duration, or type of underlying service, but not content, nor identities.

All other data to be collected or seized or disclosed will require a court warrant.

Service providers are required to cooperate and assist law enforcement authorities in the collection or recording of the above-stated information.

The court warrant required under this section shall only be issued or granted upon written application and the examination under oath or affirmation of the applicant and the witnesses he may produce and the showing: (1) that there are reasonable grounds to believe that any of the crimes enumerated hereinabove has been committed, or is being committed, or is about to be committed; (2) that there are reasonable grounds to believe that evidence that will be obtained is essential to the conviction of any person for, or to the solution of, or to the prevention of, any such crimes; and (3) that there are no other means readily available for obtaining such evidence.

As provided above, law enforcement authorities are authorized to collect or record by technical or electronic means traffic data in real-time so long as they are associated with specific communications transmitted by means of a computer system. Note, they may do so on their own – without need of a court search warrant. The law enforcement authorities simply needed “due cause” – which term is not defined in R.A. 10175 nor the Implementing Rules and Regulations (as this provision has been voided prior to the release of the said rules).

Traffic data is limited (as the law uses “only”) to a communication’s origin, destination, route, time, date, size, duration, or type of underlying service. Otherwise stated, traffic data refers to metadata that usually accompanies a communication to identify where it came from, its size, and other basic information.

The law specifically excludes content or identities in the definition of traffic data.

To obtain other information not included in the list above, a court warrant is required to seize or collect such other data. Once a court warrant is issued and implemented by law enforcement authorities, service providers are required to cooperate in the collection or recording of the above-stated information. The extent of information to be collected or recorded will depend on the contents of 09the court warrant. If the court warrant authorizes the collection or recording of traffic data other than those listed above, the service provider has to comply or else face penalty under the law – which includes imprisonment.

Anyone applying for a search warrant has to submit a written application before a competent court. Once made, the court is required to examine under oath or affirmation the applicant and his/her witnesses to show the following:

1. That there are reasonable grounds to believe that any of the crimes enumerated hereinabove has been committed, or is being committed, or is about to be committed;

2. That there are reasonable grounds to believe that evidence that will be obtained is essential to the conviction of any person for, or to the solution of, or to the prevention of, any such crimes; and

3. That there are no other means readily available for obtaining such evidence.

The court may only issue or grant a search warrant once all of the above requirements are met.

The entire provision on Section 12 was invalidated for violating a person’s right to privacy guaranteed and protected by no less than the 1987 Philippine Constitution.

Void as Section 12 violates constitutional right to privacy

The Petitioners posited the argument that such authority to collect and record traffic-data would tend to curtail civil liberties, particularly on the person’s right to privacy. This right to privacy is a protection against Government snooping into messages or information. Further, this unfettered power would create opportunities for official abuse as the minimum requirement is simply “due cause” – which does not have a precedent in law or jurisprudence leaving authorities to determine it on their own. So long as the information is within the definition of traffic data, a court search warrant is not necessary.

At the outset, the Supreme Court observed that the primary question to ask is whether Section 12 on real-time collection of traffic data has a “proper governmental purpose”. For if there is one, the law may be justified in requiring the disclosure of such information even if they may ordinarily be considered private. Thus, it is the burden on the Government to establish that there is a “compelling State interest behind the law” and that the legal provision is “narrowly drawn”. After all, the courts are required to balance the legitimate interests of the State against constitutional guarantees such as the right to privacy.

In promulgating the Philippine Cybercrime Law, the State has a compelling interest as there is an evident need “to put order to the tremendous activities in cyberspace for public good.” To properly carry out the provisions of the law, it is but logical and reasonable that the Government should be able to monitor traffic data to be effective in its fight against cybercrimes. It is without a doubt that crime-fighting is “a state business”.

Moreover, the Budapest Convention on Cybercrime of which the Philippines is a signatory required signatories to adopt local legislation to empower State authorities to collect or record real-time traffic data. For this reason, Section 12 was included.

However, the Supreme Court still struck down Section 12 as void for the following reasons.

First, the aggregate information collected from seemingly random bits of traffic data when pooled and analyzed could reveal patterns of activities sufficient to create a profile of a person subject of the surveillance. Consequently, data analysts may be able to construct or determine a person’s close associations, religious views, political affiliations, even sexual preferences. It is, at this point, that an individual’s right to privacy is threatened as the public is not expected to disclose these matters to the Government.

Second, Section 12 procedures are not narrowly drawn. The legal provision simply requires that the law enforcement authorities act “with due cause” in its action to collect or record traffic-data in real time. On this point, the Philippine Cybercrime Law “fails to hint at the meaning it intends” to interpret “due cause.” Worse, Section 12 does not even correlate the collection of data to any probable commission of a particular crime. This would allow law enforcement authorities “a general gathering of data.” As a result, it is “akin to the use of a general search warrant that the Constitution prohibits.”

Further, the phrase due cause is not descriptive as it fails to state the purpose for the data collection. The Supreme Court posits these questions: “Will the law enforcement agencies use the traffic data to identify the perpetrator of a cyber-attack? Or will it be used to build up a case against an identified suspect? Can the data be used to prevent cybercrimes from happening?”

Section 12 is, thus, “too sweeping and lacks restraint”. Even if it provides that traffic data collection should not disclose identities or content, it is but “an illusion”. During surveillance, there is virtually nothing that can prevent law enforcement authorities from looking further into the identity of the sender/receiver and the content of the data. “This will unnecessarily expose the citizenry to leaked information or, worse, to extortion from certain bad elements in these agencies.”

Moreover, the limitation that the collection of traffic data be “associated with specified communications” is not a limitation at all. Note, it is the law enforcement authorities themselves who will make the determination of what will constitute the specific communications. The power is “virtually limitless” and thus allowing law enforcement authorities to engage in “fishing expeditions” as they chose what specified information they want. This is clear threat to a person’s right to privacy.

In an attempt to save this provision, the Solicitor General posits the impossibility of obtaining a court warrant since collection of traffic data in real time is similar to a “moving vehicle” allowing for warrantless search. However, the Supreme Court is quick to point out that warrantless search have these preconditions: that there is probable cause, that there is no opportunity to get a warrant, and that the thing to be searched stands to be removed unless the search is immediately carried out. Section 12 is bereft of any of these preconditions.

On a final note on this matter, the Supreme Court takes cognizance of the advancement of technology that have operated to narrow a person’s privacy. This right to privacy is ever threatened with the rapid growth and development of technology. “The Court must ensure that laws seeking to take advantage of these technologies be written with specificity and definiteness as to ensure respect for the rights that the Constitution guarantees.”

Commentary

After a reading of Section 12, there are two things that come into mind: George Orwell’s novel entitled 1984 and the concept of Panopticon. The common theme of the two is that a persons are not who they are when they are being observed. When individuals know that there is someone watching, they behave their best and avoid socially unacceptable conduct. When they know that someone is listening, they carefully choose their words and limit their exercise of free speech.

Section 12 of R.A. 10175 creates such environment when someone (law enforcement authorities) is empowered or authorized to monitor, collect, or record real-time traffic data sent. When individuals know that their communications are being monitored and observed, they are unlikely to express what they want to say for fear of any repercussion. This sends quite the chilling effect.

As correctly observed by the Supreme Court, the constitutional right to privacy which is often referred to as the right to be left alone is “regarded as the beginning of all freedoms.” Since it is a constitutional guarantee, zones of privacy are created wherein the Government is precluded from intruding.

Who guards the guards? The Supreme Court properly addressed the contentious part of Section 12 involving the phrase “with due cause”. Aside from lack of precedent in law and jurisprudence, there is no definition in R.A. 10175 as to what would constitute “due cause”. In effect, the determination of due cause will depend on what is convenient to the law enforcement authorities who can easily draw such justification out of thin air. The Solicitor General itself was “honest enough to admit that Section 12 provides minimal protection to internet users and that the procedure envisioned by the law could be better served by providing for more robust safeguards.”

However, even if robust safeguards are placed, any similar provision with the same tenor will likely be voided once it clashes with the right to privacy. For democracy to flourish, the constitutional right to privacy must be continually protected and upheld to allow for individuals to freely think, speak, and act as part of their growth and development in a society.