A Struggle for Competence: National Security, Surveillance and the Scope of EU Law at the Court of Justice of European Union

In Privacy International and Quadrature Du Net, the Grand Chamber of the Court of Justice of the European Union (‘CJEU’) ruled that the e-Privacy Directive and EU Charter on Fundamental Rights generally prevent national law from enabling bulk retention and transmission of traffic and location data. However, in Quadrature Du Net, the Court clarified that EU law does not preclude indiscriminate data retention measures when Member States can prove serious threats to national security. In such cases, bulk data can only be retained during a strictly necessary period and the decision must be subject to review by a court or independent administrative body. The judgments will have serious implications for other data retention and sharing arrangements, such as the PNR, the proposed e-Privacy Regulation and e-Evidence package, international data sharing agreements, and also the third countries seeking adequacy decisions under the GDPR, including post-Brexit UK. The rulings suggest that CJEU has become an important actor in national security landscape, which has been outside the scope of European integration, but has become a ground for political struggle between the EU institutions and Member States. Yet, while Privacy International is an unequivocal assertion of CJEU’s authority in the area of national security and a victory for data protection, Quadrature Du Net does not oppose indiscriminate data retention in principle and is an ambivalent response by the CJEU in the face of political pressure.