Legal Opinion on the Executive Yuan's Draft Amendments to the Communication Security and Surveillance Act and Related Recommendations by the JRF

The NGO's draft version is available in the attachment.

In addition to the draft, we issue the following four statements and inquiries regarding the issues in this legislative amendment:

1. Concerns regarding the proposed amendment allowing judicial police officers to directly retrieve "communication user data"

According to the 32nd meeting of the Judiciary and Organic Laws and Statutes Committee of the Legislative Yuan during its 1st Session of the 11th Term on June 12, 2024, Legislator Huang Kuo-chang pointed out during the meeting that on June 11, the Criminal Investigation Bureau explained to his office the operational practices under Article 11-1, Paragraph 2 of the current Communication Security and Surveillance Act as follows:

Because the judicial reservation stipulated in Article 11-1, Paragraph 2 of the current Act explicitly applies only to "communication records," judicial police officers in current practice can directly retrieve "communication user data" from telecommunications operators. Conversely, when prosecutors seek to retrieve such data in certain cases, they are subject to judicial reservation restrictions and thus have to request assistance from the police to retrieve it. Only a small number of agencies, such as the Tainan District Prosecutors Office, interpret the legislative intent of the overall legal framework to mean that the police cannot retrieve data directly, but must instead obtain approval from a prosecutor.

This clearly demonstrates that the regulatory loophole and interpretive ambiguity in Article 11-1, Paragraph 2 of the current Act make it even easier for judicial police to retrieve "communication user data" than for prosecutors, creating a "one country, two systems" phenomenon. This issue was also criticized in Criminal Judgment No. 65 Rendered by the Intellectual Property Court in 2017.

In response, the Executive Yuan's draft amendments to the Communication Security and Surveillance Act plan to directly legalize current practical operations by completely abolishing the requirement for prosecutorial or judicial reservation when retrieving "communication user data." In this regard, the Foundation believes that pursuant to Article 32-1 of the Communication Security and Surveillance Act, the Ministry of Justice is originally required to report annually to the Legislative Yuan on the implementation of communication surveillance. Furthermore, since this legislative amendment has a significant impact on people's rights and interests, the Executive Yuan should provide a complete and public explanation regarding the current practice of direct retrieval by police agencies, which must at least address the following issues:

1. The methods by which judicial police apply for retrieval from judicial police officers and the internal monitoring mechanisms.
2. The number of cases and communication lines for which police agencies currently directly retrieve "communication user data."
3. The number of cases and communication lines approved and disapproved for retrieval by judicial police officers, along with the reasons for disapproval.
4. The statutory causes of offenses for the retrieval of "communication user data," categorized by the number of cases and communication lines, and statistics on the disposition of concluded cases.

If the operational model of the internal control mechanisms and the substantive benefits cannot be genuinely clarified, this Foundation finds it extremely difficult to endorse the Executive Yuan's justification—stated merely in the legislative reasoning that "...user data involves a lower degree of privacy and therefore does not fall within the scope of protection of the freedom of secret communications..."—to directly legalize a currently ambiguous operational model.

2. Special provisions should be established for the retrieval procedures of national intelligence agencies

Referring to Articles 7, 9, and 10 of our country's Communication Security and Surveillance Act, special regulations are established for communication surveillance procedures conducted by national intelligence agencies, as compared to general communication surveillance. However, the current Communication Security and Surveillance Act only briefly addresses the retrieval procedures for national intelligence agencies in Article 11-1, Paragraph 8, stating that: "Where there is a necessity to retrieve the communication records and communication user data of the targets under surveillance referred to in Article 7, the agency coordinating and administering national intelligence work shall make the retrieval from telecommunications or postal enterprises, and shall not be subject to the restrictions of the preceding seven paragraphs." With this amendment expanding the scope of retrieval to include "internet traffic records," both the legislative density and procedural regulations of this provision warrant further review, yet this issue has not been addressed in the current amendment.

This Foundation calls upon legislators to address this issue in the current or subsequent legislative amendments (for example, by conducting legislative studies on the prerequisites for initiating retrieval, the competent authority for issuing retrieval warrants, etc.) to ensure that various agencies have the most appropriate regulations for both communication surveillance and retrieval procedures.

Additionally, according to the aforementioned content of Article 11-1, Paragraph 8 of the Communication Security and Surveillance Act, the public is currently unable to learn about the operational status of national intelligence agencies retrieving data from telecommunications or postal enterprises through the Communication Security and Surveillance Act. To foster discussion on the above issue and facilitate the exchange of diverse perspectives, this Foundation calls upon national intelligence agencies to publicly disclose the following statistical information regarding cases where "the agency coordinating and administering national intelligence work makes retrievals from telecommunications or postal enterprises," provided that no classified secrets are involved, in order to promote a more complete legislative system:

1. The methods and internal monitoring mechanisms used by national intelligence agencies to make retrievals from telecommunications or postal enterprises.
2. The number of cases and communication lines for which national intelligence agencies currently retrieve "communication records" and "communication user data" from telecommunications or postal enterprises.
3. The causes of offenses or reasons for which national intelligence agencies retrieve "communication records" and "communication user data," categorized by the number of cases and communication lines, along with statistics on the disposition of concluded cases.

3. A retrospective notification system for retrieved data should be established

Under the current Communication Security and Surveillance Act, although there are provisions requiring notification to the person under surveillance after communication surveillance has concluded, there are no such provisions regarding the retrieval of user data and communication records. Taking Article 101a, Paragraph 6 of the German Code of Criminal Procedure as an example, it stipulates that, in principle, the person whose communication records have been retrieved must be notified of the retrieval, and any exception to delay notification must be decided by a judge.

Since this amendment relaxes the restrictions on retrieval and incorporates the retrieval category of "internet traffic records," we believe it is necessary to review the retrospective notification mechanism for the retrieval system in order to safeguard civil rights.

4. Where the draft amendment adds a new category of "consensual retrieval," the method of consent must be explicitly stipulated

Article 11-1, Paragraph 10 of the proposed amendment stipulates that: "Prosecutors and judicial police officers may, for the purpose of investigating crimes and collecting evidence, and with the consent of the subscriber or telecommunication user, retrieve their communication user data, communication records, or internet traffic records, and shall not be subject to the restrictions of Paragraphs 1 through 8."

Consent here must be given personally and individually by the individual, rather than being prior, general, or abstract consent; nor can it mean that simply because a subscriber or telecommunication user agrees to a provider's terms of service, the provider may directly hand over relevant information to investigative authorities based on such consent.

For the sake of clarity, this Foundation believes that if it is necessary to add this provision, executing personnel must inform the subscriber or telecommunication user—upon obtaining the aforementioned consent—that they have the right to refuse consent and are not required to give consent against their own will, and shall record the subscriber's or telecommunication user's intent of consent in writing, to be signed by the consenting person.