A Struggle for Competence: National Security, Surveillance and the Scope of EU Law at the Court of Justice of European Union
| Published date | 01 January 2022 |
| Author | Monika Zalnieriute |
| Date | 01 January 2022 |
| DOI | http://doi.org/10.1111/1468-2230.12652 |
bs_bs_banner
Modern Law Review
DOI:10.1111/1468-2230.12652
CASES
AStruggleforCompetence: NationalSecurity,
Surveillance and the Scope of EU Law at the Court of
Justice of European Union
Monika Zalnieriute∗
In Privacy International and Quadrature Du Net, the Grand Chamber of the CJEU ruled that the
e-Privacy Directive generally prevents bulk retention and transmission of trac and location
data, unless MemberStatescanprove seriousthreats tonational security.Insuch cases, bulkdata
can be retained during a strictly necessary period, subject to review by a court or independent
administrative body. The judgments will impact other data retention and sharing arrangements,
such asthePNR,proposede-Privacy Regulationande-Evidence package, andadequacy deci-
sions under GDPR, including for post-Brexit UK.The rulings suggest the CJEU’s signicance
in national security,which has been outside of European integration, but has become a ground
for political struggle between EU institutions and Member States. While Privacy International
unequivocally asserts CJEU’s authority in national security and is a victory for data protec-
tion, Quadrature Du Net does not oppose indiscriminate data retention in principle and is an
ambivalent response to political pressure.
INTRODUCTION
Balancing the protection of fundamental rights and national security has been
one of the greatest challenges for contemporary liberal democracies. That chal-
lenge has never been more important than today:the outbreak of the global
COVID-19 pandemic required governments and citizens to reconsider what
‘national secur ity’ is, and hastr iggered an increasingdemandforprivatecom-
panies to share data with governments for protecting public health during the
times of global health crisis and public emergency.
In this context, on 6 October 2020,the Grand Chamber of the CJEU
delivered two long-awaited judgments on surveillance,national security and
fundamental rights in Privacy International,1and joined cases La Quadrature
∗Senior Lecturer at Faculty of Law and Justice,UNSW Sydney; Senior Fellow at Law Institute of
Lithuanian Centre for Social Sciences. This research has been supported by Australian Research
Council Discovery Early Career Research Award DECRA (project number DE210101183) and
Allens Hub for Technology,Law & Innovation, UNSW Sydney.I would like to thank anonymous
reviewers for the constructivefeedback, which has signicantly improved the article.I would also like
to thank Emily Hunyor for her research assistance.All URLs were last accessed 18 May 2021.
1Case C–623/17 Privacy International ECLI:EU:C:2020:790.
© 2021 The Author.The ModernLaw Review © 2021 The Modern Law Review Limited.(2022)85(1)MLR 198–218
Monika Zalnieriute
Du Net and Others,French Data Network and Others,andOrdre des Barreaux
Francophones et Germanophone and Others (onejudgment, Quadrature Du Net).2
In both judgments, the Court ruled that the EU Privacy and Electronic Com-
Fundamental Rights (EUCFR) generally prevent national law from enabling
indiscriminate retention or transmission oftrac andlocationdata, even if
it isfor safeguardingnational security. However, in Quadrature Du Net,the
Court explained that EU law does not preclude indiscriminate data retention
measures if Member States can prove legitimate and ‘serious threats to national
security’.4In such cases,bulk data can be retained during a strictly necessary
period and the decision must be subject to review by a court or independent
administrative body.5
Privacy International and Quadrature du Net have signicant implications for
the future of data retention and sharing regimes, like Passenger Name Records
(PNR), the proposede-PrivacyRegulation, e-Evidencepackage, international
data sharing agreements, and also the third countries seeking adequacy decisions
under General Data Protection Regulation (GDPR),6including post-Brexit
UK. These rulings suggest that the CJEU has become an important actor in
the national security landscape, which has traditionally been outside the scope
of the European integration but has increasingly become a ground for political
strugglebetween theEUinstitutionsandMember States. Yet,whilePrivacy In-
ternational is an unequivocal assertion of CJEU authority in the area of national
security, Quadrature Du Net does not oppose indiscriminate data retention in
principle and is an ambivalent response by the CJEU in the face of political
pressure.
The rst part of this note provides the background to the legal challenges
brought in the Privacy International and Quadrature Du Net cases. The second
part outlines the three Opinions of the Advocate General,while the third part
focuses on the CJEU’s two rulings and their reasoning. The fourth part fo-
cuses on the relationship between national security, surveillance regimes and
the scope of EU law.The fth part looks at the future of data retention and
sharing regimes in EU and beyond.
FACTUAL AND LEGAL BACKGROUND
Data retention regimes date back to the post-9/11 era,when many countries
adopted new legislative measures granting novel powers to law enforcement
work andOthers, andC-520/18 Ordre des barreaux francophones et germanophone and Others
ECLI:EU:C:2020:791.
3Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 con-
cerning the processing of personal data and the protection of privacy in the electronic commu-
nications sector (Directive on privacy and electronic communications) 2002 (OJ L 201/37).
4Quadrature Du Net n 2above at [136]-[139], [168].
5ibid at [168].
6Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free
Movement of Such Data,and Repealing Directive 95/46/EC 2016 1.
© 2021 The Author.The ModernLaw Review © 2021 The Modern Law Review Limited.
(2022) 85(1) MLR 198–218199
Get this document and AI-powered insights with a free trial of vLex and Vincent AI
Get Started for FreeStart Your 3-day Free Trial of vLex and Vincent AI, Your Precision-Engineered Legal Assistant
-
Access comprehensive legal content with no limitations across vLex's unparalleled global legal database
-
Build stronger arguments with verified citations and CERT citator that tracks case history and precedential strength
-
Transform your legal research from hours to minutes with Vincent AI's intelligent search and analysis capabilities
-
Elevate your practice by focusing your expertise where it matters most while Vincent handles the heavy lifting
Start Your 3-day Free Trial of vLex and Vincent AI, Your Precision-Engineered Legal Assistant
-
Access comprehensive legal content with no limitations across vLex's unparalleled global legal database
-
Build stronger arguments with verified citations and CERT citator that tracks case history and precedential strength
-
Transform your legal research from hours to minutes with Vincent AI's intelligent search and analysis capabilities
-
Elevate your practice by focusing your expertise where it matters most while Vincent handles the heavy lifting
Start Your 3-day Free Trial of vLex and Vincent AI, Your Precision-Engineered Legal Assistant
-
Access comprehensive legal content with no limitations across vLex's unparalleled global legal database
-
Build stronger arguments with verified citations and CERT citator that tracks case history and precedential strength
-
Transform your legal research from hours to minutes with Vincent AI's intelligent search and analysis capabilities
-
Elevate your practice by focusing your expertise where it matters most while Vincent handles the heavy lifting
Start Your 3-day Free Trial of vLex and Vincent AI, Your Precision-Engineered Legal Assistant
-
Access comprehensive legal content with no limitations across vLex's unparalleled global legal database
-
Build stronger arguments with verified citations and CERT citator that tracks case history and precedential strength
-
Transform your legal research from hours to minutes with Vincent AI's intelligent search and analysis capabilities
-
Elevate your practice by focusing your expertise where it matters most while Vincent handles the heavy lifting
Start Your 3-day Free Trial of vLex and Vincent AI, Your Precision-Engineered Legal Assistant
-
Access comprehensive legal content with no limitations across vLex's unparalleled global legal database
-
Build stronger arguments with verified citations and CERT citator that tracks case history and precedential strength
-
Transform your legal research from hours to minutes with Vincent AI's intelligent search and analysis capabilities
-
Elevate your practice by focusing your expertise where it matters most while Vincent handles the heavy lifting