CLFR - Romania

Monday, January 8, 2018 - 12:31

PROVISION OF REAL-TIME LAWFUL INTERCEPTION ASSISTANCE

LAW NO. 506/2004

According to Article 4 of Law no. 506/2004 on personal data processing and privacy protection in the electronic communications sector, the interception or surveillance of communications and related traffic data may be made only by the relevant public authorities as per the applicable statutory provisions, unless parties to the communication consent in writing.

Interceptions may be made upon the request of intelligence and security agencies made under Article 123 of Law 51/1991 on regarding Romania’s national security, i.e. where there are threats to the national security.

DECISION NO. 987/2012

Pursuant to Article 3.8 of Decision no. 987/2012 of the National Authority for Management and Regulation in Communications (“ANCOM”) on the general authorisation regime for the provision of electronic communications networks and services, service providers must set up at their own cost the necessary technical means and take all other necessary technical measures required to immediately enforce the lawful authorisations or warrants issued for the interception of communications.

CRIMINAL PROCEDURE CODE

The following rules under Article 139(1) of the Criminal Procedure Code (Law no. 135/2010), apply in relation to prosecuting certain categories of crime: (a) the measure taken is proportionate to the restriction of the rights and freedoms that it entails; and (b) the relevant evidence could not be obtained otherwise or there is a danger for the safety of persons or valuables.

Furthermore, interceptions may be made based on warrants issued by the relevant court of law for a period of 30 days, which can be subject to further 30-day extensions granted by the court up to a total overall period of 6 months.

In exceptional cases, the prosecutor’s office may directly authorise the interception by order for no more than 48 hours (Article 141(1) and (2) of the Criminal Procedure Code). The relevant prosecutor’s office is to apply for the court’s confirmation of the interception within no more than 24 hours of the expiry of an interception order (Article 141(3) and (4) of the Criminal Procedure Code).

Pursuant to the Article 142 (2) of the Criminal Procedure Code (Law 135/2010), the service provider is to cooperate with the Prosecutor’s office and the relevant authorities in order to enforce the technical surveillance (interception) warrants issued by the court.

ANCOM DECISION

As per Article 3.8. of ANCOM Decision no. 987/2012 (the “ANCOM Decision”) on the general authorisation regime for the provision of electronic communications networks and services, the service provider is inter alia obliged to:

  • technically allow the relevant authorities to perform interceptions;
  • duly cooperate with the relevant authorities involved in interceptions;
  • cooperate with the relevant authorities to implement security and audit criteria of national communications interception system developed by them;
  • take all necessary technical measures to enable interceptions in general and immediately enable the enforcement interception warrants in particular;
  • place at the disposal of the relevant authorities the interception management servers and the administration and operation consoles it holds, as required to ensure interceptions; and
  • bear the costs of the interception interface.

As per Article 8(2)(k) of the Government Emergency Ordinance 111/2011 on electronic communications, the conditions under which service providers are to bear the costs related to the interception interface are established by the general authorisation issued by ANCOM to the service provider.

DISCLOSURE OF COMMUNICATIONS DATA

LAW 82/2012

Under Article 16 of Law 82/2012 on the retention of data generated and processed by providers of electronic communications, network service providers are to disclose any metadata retained in accordance with Law 82/2012 (i.e. the data necessary to (i) trace and identify the source of a communication, (ii) identify the destination of a communication, (iii) identify the date, time and duration of communication, (iv) identify the type of communication, (v) identify users’ communication equipment or what purports to be their equipment; and (vi) identify the location of mobile communication equipment) within 48 hours of the request of the prosecutor’s office, the courts of law or the national security authorities.

According to Article 12(1) of Law 82/2012 on Romania’s national security, national security authorities may request retained data from telecommunication networks and service providers in case of threats to national security. 

CRIMINAL PROCEDURE CODE

As per Article 152(1) of the Criminal Procedure Code (Law 135/2010), the disclosure of metadata upon the Prosecutor’s office request (i.e. where there are suspicions regarding the perpetration of certain crimes set out by Law 82/2012) needs to be authorised by a court decision following a request of the relevant prosecutor’s office.

Under Article 138 of the Criminal Procedure Code (Law no. 135/2010), criminal prosecution bodies may access any computer systems in order to identify evidence, where:

  • there is a reasonable suspicion about a serious offence/ crime;
  • the measure is proportional with the restriction of the rights and freedoms that it entails; and
  • the relevant evidence could not be obtained otherwise or there is a danger for the safety of persons or valuables.

Pursuant to Article 139(1) of the Criminal Procedure Code (Law 135/2010), access to computer systems requires a warrant to have been issued by the court.

In exceptional cases, the prosecutor’s office may directly authorise the access by order for no more than 48 hours (Article 141(1) and (2) of the Criminal Procedure Code). 

CIVIL PROCEDURE CODE

According to Article 297(1) of the Civil Procedure Code, in civil and commercial trials the court may issue orders for third parties holding relevant information to present them in court if they are necessary for the settlement of the case.

Under Article 19 of Council of Europe Convention on Cybercrime (E.T.S. No. 185, 23 November 2001) ratified by Romania under Law 64/2004, each party to the Convention is to adopt such legislative and other measures as may be necessary to empower its relevant authorities to search or access a computer system or a part of it and computer data stored therein, and any computer storage support that stores computer data on its territory. 

NATIONAL SECURITY AND EMERGENCY POWERS

There are no express provisions regulating instruments used in the case of disclosure upon request of national security authorities. From Article 12(1) read in conjunction with Article 12(2) of Law no. 51/1991 in relation to Romania’s national security, it may be inferred that, unlike in the case of interceptions which require a warrant granted by the court, disclosure of geo-location data can be made upon simple request of national security authorities.

Except as set out above, the government does not have the legal authority to invoke special powers in relation to access to a mobile network operator’s customer data and/or network on the grounds of national security.

Under Article 1 and 3(c) of Law 132/1997 on requisitions, under exceptional circumstances (e.g. war, national emergency, disasters, etc.) public authorities and national defence forces can take temporary possession of any goods in order to gain access and use of the telecommunication systems.

As per Law 132/1997 on requisitions, the following instruments are required in view of a requisition of telecommunication networks assets:

  • a requisition plan drawn up by the local authorities before the relevant events occur (Article 5(1)); and
  • a military order for hand-over to be issued at the date of the actual requisition (Article 14).

According to Article 18 of Government Emergency Ordinance 34/2008 on National System for Emergency Calls, the providers of electronic communications are obliged to make available to the director of the National System for Emergency Calls an updated database with all telephone numbers, names and address of customers that have placed emergency calls.

According to Article 20 of Government Emergency Ordinance no. 1/1999 during a state of siege or emergency, exceptional measures established by military authorities are enforced via military orders that are mandatory throughout the country.

OVERSIGHT OF THE USE OF THESE POWERS

Other than what is set out above, there are the following rules relating to remedies that may be sought following the use of these powers:

  • cost conditions related to an interception interface are to be borne by the service provider and may be challenged in court via administrative litigation; and
  • requisition measures may be challenged in court (only) with respect to the quantum of the compensation.

CENSORSHIP RELATED POWERS

SHUT-DOWN OF NETWORK AND SERVICES

GOVERNMENT EMERGENCY ORDINANCE NO. 111/2011

The Government Emergency Ordinance no. 111/2011 gives the telecom regulatory authority, ANCOM, the power to shut-down Vodafone’s network or services (temporarily or permanently) in certain circumstances.

Under Article 9(2), ANCOM may withdraw general authorisation from a service provider where necessary in light of an international agreement entered into by Romania or required to protect the public interest. Under Article 135(1) withdrawal of the general authorisation may be made only after subject to public debate; this consists of one or more public sessions where members of the industry, civil organisations and other relevant authorities are invited to submit their observations on the proposed measures and observations expressed during the public debate must then be observed by ANCOM.

Under Articles 147 and 148 ANCOM may revoke a service provider’s right to supply networks or certain communication services for between 6 months and 3 years and/or remove the service provider’s right to use numbering resources, radio frequencies and other technical resources where that service provider has failed to comply with any of the terms of its general authorization; frequency or numbering licenses; or if it fails to comply with certain obligations regarding monitoring spectrum usage; numbering resources or providing financial documents.

Under Article 141(1) ANCOM must notify the service provider before revoking or suspending its right to supply networks or communication services; or revoking or suspending its right to use numbering resources, radio frequencies or other technical resources.

BLOCKING OF URLS & IP ADDRESSES

LAW 196/2003

Article 12(2) of Law 196/2003 provides that ANCOM may require an internet service provider, such as Vodafone, to block the URL or IP address of websites containing illicit content. Illicit content is pornographic content which lacks an appropriate age restriction warning or which contains child sex abuse, bestiality or necrophilia.

LAW 77/2009

Article 733(c) of Government Decision 870/2009 on Law 77/2009 provides that the Gambling Authorisation Commission, upon being notified by the Gambling Monitoring Authority, may decide to block the URL or IP addresses of unauthorised gambling websites.

POWER TO TAKE CONTROL OF VODAFONE’S NETWORK

LAW 132/1997

Under Articles 1 and 3(c) of Law 132/1997 in exceptional circumstances public authorities and national defence forces can take temporary possession of any network assets in order to gain access to and use of a telecommunications network. Exceptional circumstances would be a national emergency such as a natural disaster or war. Pursuant to Article 5(1) c), on making a requisition a local authority must present its requisition plan (drawn up before the relevant events occur) and, where the requisition is made by national defence forces, the relevant force must present a military order for the possession of network assets issued at the date of the actual requisition.

LAW 255/2010

Law no. 255/2010 enables public authorities to take possession of any type of land or building if this is required for public utility reasons. In order to expropriate the land or building a decision of the government or local administration, setting out the details of the seizure and the amount of compensation to be awarded, must be presented.

OVERSIGHT OF THE USE OF POWERS

All decisions made by ANCOM or the Gambling Authorisation Commission can be challenged in court by administrative litigation proceedings.

Where a public authority or military force takes control of Vodafone’s network pursuant to Law 132/1997 or Law 255/2010 the party subject to the expropriation may challenge in court the amount of compensation which they receive for their losses arising from such expropriation, but not the decision to expropriate itself. 

This information was originally published in the Legal Annexe to the Vodafone Group Law Enforcement Disclosure Report in June of 2014, which was updated in February of 2015.