Portuguese legislation doesn’t define “electronic evidence” in general. We retrieve the definition from the practice and doctrine.
It can be defined «as any type of information, with probative value, stored on any digital storage device or transmitted (on computer systems and networks or electronic communications networks, private or publicly accessible), in binary or digital form».
Data categories are:
Subscriber and access data: elements that serve to identify a subscriber or customer, such as the user (name), date of birth, postal address, gender, type and kind of service (eg. Network provider, VPS or dedicated server, physical location of the server), administrative features (sometimes: bank account), telephone number, email address or IP address at the time of registration, registration date, etc.
Traffic and localization data: Our domestic law defines traffic data in the article 2, c) of the Law number 109/2009 as the computer data related to a communication chain, indicating the origin of the communication, the destination, the route, the time, the date, the size, the duration or the type of underlying service.
Content data: any stored data in a digital format (text, voice, videos, images and sound), different from the real time interception.
If in the course of the case, it is necessary to produce evidence, with a view to discovering the truth, obtaining specific computer data stored in a computer system, including traffic data, in relation to which there is fear that they may be lost, changed or when they are no longer available, the competent judicial authority orders whoever has availability or control of such data, namely the service provider, to preserve the data in question.
The preservation order discriminates:
a) The nature of the data;
b) Its origin and destination, if known; and
c) The period of time for which they must be preserved, up to a maximum of three months.
This order may be renewal up to a maximum of one year, once the admissibility requirements are verified.