I. In the Silence of Constitutions: The Normative Vacuum about Surveillance

Despite the “historical pedigree” ^{Footnote 5} of the rights to data protection and privacy in Europe, which emerged as a counteraction to the atrocities committed by the authoritarian regimes of Western and Eastern European countries before and after WWII, an absolute prohibition of mass surveillance is not explicitly enshrined in any national constitution. This can be mentioned as one factor that has allowed mass surveillance practices to survive recent scandals and court cases. Data protection legislation and the constitutional right to data protection emerged in the EU as a normative response to the risks associated with increased automation, collection, and exchange of personal data in the public and private sectors. ^{Footnote 6} Yet, despite the daunting potential of these technologies in the 1960s and the multiple contemporary lessons learned from authoritarian regimes in European history, surveillance is not explicitly addressed at the constitutional level.

The term “surveillance” is explicitly included in only two European national constitutions: the Swedish Constitution and the German Basic Law. The Instrument of Government, one of the four fundamental laws composing the Swedish Constitution, in Chapter 2, Article 6 reads:

Paragraph 2 of this provision was added a decade ago after a recommendation from an ad hoc Commission on the Protection of Personal Privacy. Interestingly, the Swedish legislator added a provision that is almost redundant after protecting against the examination of all types of confidential communications, but that explicitly targets surveillance systems. Indeed, the norm of paragraph 2 explicitly refers to forms of “systematic monitoring” performed by “public institutions” without the individual’s consent that produce “significant invasions” of personal privacy. Yet paragraph 2 does not seem to ban mass surveillance. By reading Article 20, one understands that the explicit protection afforded by the Instrument of Government is the application of the principle of legality to potential restrictions on the rights enshrined in Article 6. In other words, the principle of secrecy of correspondence and the right to privacy are explicitly considered relative rights in Swedish constitutional law, thereby tolerating potential compressions that must be clearly defined by law, and not extemporaneously implemented by law enforcement authorities.

The German Basic Law adopts a similar approach. Surveillance is explicitly mentioned in the German constitution and is presented as a permissible practice subject to a series of guarantees. The term “surveillance” is used in Article 13, which enshrines the inviolability of the dwelling and refers to acoustic monitoring systems. Paragraphs 3 and 4 read:

According to the Basic Law, surveillance is justified to investigate only serious crimes or dangers to public safety. A legal basis and judicial authorization are necessary to carry out surveillance practices. Surveillance is presented as a last resort practice, which can be used where no less invasive methods are available. Moreover, surveillance practices shall be limited in time. In sum, the German Constitution, in relation to acoustic surveillance of a dwelling, does not seem to avail a model of mass surveillance but that of targeted monitoring limited in time.

Interestingly, one can notice that the normative architecture of the German Basic Law follows a classical approach, dealing with the inviolability of the dwelling and the privacy of correspondence in two separate provisions. Article 10 indeed focuses on “correspondence, posts and telecommunications” and, interestingly, enshrines a different, lighter standard of protection in relation to surveillance practices affecting this portion of our private life. Paragraph 2 of this norm reads:

The principle of legality is still the main guarantee the German Constitution introduces to protect the privacy of communications. However, in this case, the Basic Law does not refer to judicial authorization or time limits. Contrariwise, the scope of the justifications of a potential restriction is very broad: the protection of the “free democratic basic order” and the “existence or security of the Federation or of a Land” instead of specific serious crimes. Second, judicial oversight is expressly replaced by law enforcement or an intelligence agency review. Third, covert surveillance is explicitly authorized since the law may require that the persons affected by the ongoing monitoring are not to be notified. In sum, apart from the requirement to find a legal basis, Article 10 does not circumscribe the possibility of introducing mass surveillance practices.

This brief analysis of constitutional provisions reveals that, while protection of private life is generally enshrined in contemporary constitutions, no explicit provisions significantly limit the possibility of resorting to mass surveillance practices, even in constitutional texts that explicitly regulate surveillance. On the contrary, national constitutions generally include provisions that potentially restrict the principle of secrecy of correspondence, the right to privacy, and the right to data protection. None of these rights are presented as absolute. They all tolerate restrictions in the name of public and national security, thus de facto opening the door to the adoption of mass surveillance systems. In light of this consideration, we contend that constitutional provisions currently in force reflect the technological state of the art of a time when mass surveillance was still utopic and, therefore, do not afford adequate protection against the potential risks of these practices. However, in this Article, we posit that a progressive process of constitutionalization is currently underway in relation to state surveillance. A series of impulses are pushing towards developing constitutional principles, limiting the possibility of resorting to mass surveillance practices, and defining acceptable levels of compression of fundamental rights. In the following sections, we will analyze civil society and judicial impulses, investigating to what extent civil society groups and courts in the EU are normatively shaping constitutional guarantees against surveillance.

II. Multilevel Constitutionalization and the Driving Role of Civil Society

The constitutionalization process that is currently shaping surveillance systems is in reality a broader phenomenon. It encompasses all major changes and threats prompted by the digital revolution. It is plural, yet unitary in its ultimate objectives. ^{Footnote 10} Recent scholarship analyzed the emergence of “digital constitutionalism” as an ideology informing and leading a multistakeholder movement. ^{Footnote 11} One cannot identify a single constitutional framer, but several actors contributed at multiple levels to the debate on how to articulate constitutional norms that should preserve our fundamental rights in the digital ecosystem. Not only traditional, institutional actors, such as courts and legislators, but also new voices, often neglected from a legal point of view, such as civil society.Footnote ¹² It is not a chaotic conversation but a process where each party stimulates and complements each other as the tesserae of a single mosaic. It is a multilevel process of constitutionalization that finds its unity in its aim to instill the core principles of contemporary constitutionalism in the context of the digital society.

Absent explicit, detailed regulation of surveillance at the level of national and supranational constitutions, civil society actors have played a driving role in the constitutionalization of mass surveillance. First, it is worth highlighting the important function that civil society played as a trigger of judicial cases. Indeed, the major decisions from national and European courts related to state mass surveillance practices, which we will analyze in more detail in the next section, were initiated by privacy activists, associations, and NGOs. Austrian privacy activist Max Schrems, Irish-based association Digital Rights Ireland, the NGOs Privacy International, la Quadrature du Net, and Big Brother Watch, who started these cases, acted not only as public watchdogs denouncing situations that conflicted with respect for the right to privacy and data protection, they also initiated strategic litigations that prompted major reforms at both EU and national levels. From a constitutional point of view, one can argue that civil society actors contribute to balancing powers, triggering a judicial reaction to legislators and governmental agencies’ abuses or inaction.

Second, academics, activists, and NGOs have been among the most active actors in developing and advocating new constitutional principles that specifically target surveillance practices. Empirical studies have counted more than 200 declarations issued by civil society actors that aim to articulate and define principles and values for the digital society. ^{Footnote 13} These texts are generally known as Internet bills of rights and represent an interesting source to provide an analysis from a legal and, more specifically, a constitutional point of view. Indeed, Internet bills of rights are non-legally binding declarations made by a plurality of actors outside the institutionalized constitutional processes. If such an informal character makes them less interesting for black-letter law scholars, this feature undocks them from the limitations of political agenda and institutional remits, giving them an unprecedented possibility to propose innovative normative solutions to the challenges posed by mass surveillance practices. ^{Footnote 14} From a sociolegal perspective, these non-legally binding declarations represent an invaluable source for understanding civil society’s claims in the context of digital society and the extent to which these demands are accepted and integrated into the legal order.

III. Internet Bills of Rights: From the Right to Privacy to the Prohibition of Mass Surveillance

Internet bills of rights’ task of articulating and defining principles and values for the digital society are not confined to a superficial conceptual make-up. These declarations do not merely specify the applicability of existing constitutional guarantees in the digital society. If one talks of a right to freedom of expression online, one instinctively grasps that communication through digital technology should be guaranteed. The same can be said for freedom and secrecy of correspondence, freedom of association, and peaceful assembly. The development of digital technologies provides new instruments to exercise these rights. The communicative power of these constitutional provisions is generally preserved because one instinctively considers new technologies as the heir to an old means of communication. In these cases, Internet bills of rights tend to simply restate the applicability of analog constitutional provisions in contemporary society by referring to digital communication tools.

However, a similar intervention of superficial stuccoing does not always suffice. A series of fundamental rights designed for an analog world struggles to permeate and inform virtual reality. Their current formulation does not immediately speak to the actors of the digital society. Individuals and public and private institutions do not instinctively grasp the implications of these fundamental values. In these cases, Internet bills of rights intervene to extract their meaning and significance for a contemporary digital society. These declarations distill the quintessence of these constitutional values. They unfasten the pure essence of these rights from the accidentals of the society in which they emerged. At this point, the ultimate telos of the constitutional norm is plunged into the context of the digital society, from which it resurfaces with a more specifically tailored layout. Teubner, dealing with the emergence of constitutional patterns beyond the state, similarly discusses a double process of “generalization” and “re-specification.” ^{Footnote 15} The constitutional norm cannot be merely transplanted in a different societal context. One needs to understand its ultimate aim, generalize its principles, purify it from its original contextual contaminants, and then re-specify it in light of the characteristics of the new social reality.

The respect for individual privacy is an example of a fundamental value that Internet bills of rights do not merely restate with reference to digital technology but is generalized and further re-specified in light of the challenges of the digital society. ^{Footnote 16} Most of these declarations of rights generally affirm that any form of surveillance affects the individual’s privacy. ^{Footnote 17} However, some of them introduce new principles limiting mass surveillance practices. For example, in the words of the African Declaration on Internet Rights and Freedoms:

The constitutional message advocated by these civil society groups is clear. Internet bills of rights affirm that mass and indiscriminate surveillance represents an inadmissible limitation on the right to privacy, which cannot be considered proportionate as a matter of principle. ^{Footnote 19} Only targeted forms of surveillance, subject to specific guarantees, can be tolerated as reasonable restrictions of that right. ^{Footnote 20} Interestingly, guarantees such as the requirement of serious crimes, judicial authorization, and notification to individuals align with those progressively established by the CJUE case law, as we will see in the following section.

I. Indiscriminate Data Retention in the EU: Legislative Genesis and First Judicial Ban

As anticipated, the “great temptation” to exploit the vast potential of technological tools and sophisticated surveillance instruments significantly expanded in the EU in the aftermath of 9/11. Considering the importance of effectively facing terroristic threats, the generalized retention of communications data by telecommunication operators immediately appeared an invaluable measure, allowing intelligence agencies and law enforcement authorities to “go back in time” ^{Footnote 21} and find useful investigative leads about people previously unknown to public authorities. ^{Footnote 22} For these reasons, the so-called e-Privacy Directive 2002/58 ^{Footnote 23} was adopted just a few months after the attack on the Twin Towers, followed by the Data Retention Directive (DRD), ^{Footnote 24} which was rapidly implemented after the 2005 terrorist attacks in the EU. The case law, developed at the national and supranational level in the EU, concerning the implementation of data retention instruments and disciplines, represents a relevant, complex, and clear exemplification of the judicial inputs to the vast debate on surveillance tools and their constitutional limits. Analyzing the main arguments employed and the guarantees and safeguards affirmed by national and EU judges helps us better understand the consequent reactions and the normative solutions developed or still being discussed today by legislators.

Starting from the first adopted provision concerning data retention, Article 15 of the e-Privacy Directive establishes a broad derogation to the general obligation to erase or anonymize metadata. In particular, Member States can implement legislative measures allowing communications data to be exceptionally retained for a specific and limited time period when it is considered a “necessary, appropriate and proportionate measure within a democratic society to safeguard national security (i.e. State security), defense, public security and the prevention, investigation, detection, and prosecution of criminal offenses or unauthorized use of the electronic communications system.”

When the exacerbated terrorist threat pushed the EU legislators to increase and intensify harmonized answers in the context of a war on terror, the DRD, complementing the vague discipline provided by Article 15 of the e-Privacy Directive, ^{Footnote 25} obliged Member States to implement national legislation requiring all service providers to retain a vast list of communications data for a period between six months and two years, attributing to the discretionary evaluation of each national legislator the adoption of specific access conditions and procedures as well as the definition of which “serious crimes” would legitimize the processing of metadata by law enforcement authorities. ^{Footnote 26}

Setting aside the challenges concerning the DRD’s legal basis (decided by the CJEU in Ireland v Parliament and Council), ^{Footnote 27} the mass surveillance measures and obligations established by the Directive have been controversial from the outset. The complex legislative debate at the EU level and the doubts expressed by the Article 29 Working PartyFootnote ²⁸ and numerous NGOs ^{Footnote 29} had a significant impact. In several Member States, the domestic laws implementing the DRD were challenged before the national courts, which were asked to assess the compatibility of a bulk retention regime with national fundamental rights and principles. ^{Footnote 30} In most cases, the relevant judicial decisions on mass surveillance and blanket data retention measures were declared to be a disproportionate intrusion into the private sphere. Notwithstanding the different approaches, ^{Footnote 31} this case law revealed an important opportunity for national judges to deal with the profound issues of a generalized surveillance system, particularly the need for precise guarantees and limits to restrict intrusive measures.

Even though none of these national decisions considered the validity of the Directive itself, this piece of EU legislation was challenged before the CJEU soon after. What is now defined as the “data retention saga,” which is continuing nowadays, represents, together with the important judicial impulses coming from national courts, the most significant stimulus to the constitutional debate over data retention systems in the EU, promoting a complex process of constitutionalization of mass surveillance regimes in general. In fact, in the landmark Digital Rights Ireland decision, ^{Footnote 32} the CJEU affirmed some crucial and unprecedented principles on mass surveillance systems. First, generalized and indiscriminate metadata retention, independently from potential subsequent access to the retained data by state authorities, was considered an invasion of users’ private life per se. The Court recognized that communications data, regardless of the content of the communication itself, may allow precise conclusions on users’ habits, everyday life, place of residence, daily movements, activities, relationships, and social environments, which can generate “in the minds of the persons concerned the feeling that their private lives are the subject of constant surveillance” (paragraph 37). By demonstrating a profound awareness of the possible risks and consequences related to the existence of massive retention systems, even if motivated by security purposes, the Court noted that mandatory bulk and generalized retention, covering all electronic communications services as well as the entirety of users and communications data produced, could not represent a measure limited to what is strictly necessary. The Court underlined that a form of legitimate and proportionate retention could only be identified in a targeted regime, which means a retention limitedly affecting people for whom there is evidence capable of “suggesting that their conduct might have a link, even an indirect or remote one, with serious crime” (paragraph 58), or specifically limited to a geographic area and/or a time period and at the unique purpose of preventing or fighting against serious crimes. The lack of these limitations, regarded as essential to ensure a legitimate and proportionate compression of individuals’ fundamental rights, determined the invalidation of the DRD.

By defining a clearer standard for the future development of mass surveillance techniques in the EU, the CJEU determined that security purposes, even when motivated by terrorist threats, cannot be placed outside the constitutional human rights guarantee framework established by national constitutional charters and supranational fundamental rights declarations. ^{Footnote 33} In their decision, the EU judges affirmed some limits and conditions on surveillance mechanisms by prompting the adoption of targeted measures in clear contrast with the generalized dimension of massive surveillance systems.

With the invalidation of the DRD, Article 15 of the e-Privacy Directive once again became the only piece of EU law that regulated the possibility of retaining communications data for security purposes, with Member States soon adopting different approaches to data retention discipline. National courts were once again asked to evaluate the compliance of internal data retention regimes with national and EU fundamental rights, as interpreted by the CJEU. ^{Footnote 34} Doubts and criticalities emerged again concerning competence matters and the proportionality of national bulk data retention systems. The attention and activism on this topic reflected the difficulty, also for national judges, in determining a correct balance between security needs, supposedly better guaranteed by bulk surveillance instruments, and protecting rights and freedoms.

In light of the different and fragmented reactions of national courts and legislators, several preliminary rulings were promoted by Swedish, British, and Spanish courts, all asking for clarifications as to the interpretation of Article 15 of the e-Privacy Directive. In the important Tele2 ^{Footnote 35} and Ministerio Fiscal ^{Footnote 36} cases, the CJEU reaffirmed the principles already established in Digital Rights Ireland, stressing that national provisions on data retention and access to retained communications data for security purposes fall entirely within the scope of application of EU law. In all these cases, in which the EU Court was first confronted with surveillance tools, the judges acted as constitutional “lawmakers,” giving very precise indications to national legislators, ^{Footnote 37} prompting the incorporation of core constitutional values such as the rule of law, due process guarantees, and the presumption of innocence into the discipline regulating data retention. By explicitly declaring that Article 15 of the e-Privacy Directive, read in light of the CFREU, must be interpreted as precluding national legislation from providing general and indiscriminate retention of all traffic and location data of all users, including all means of electronic communication, the Court reiterated the importance of clear and precise rules for establishing a form of targeted data retention regime, together with strict rules and prior control regulating access to data by law enforcement or intelligence authorities. ^{Footnote 38}

II. Constitutional Fine-Tuning: Security and the Ban of ‘Systematic’ Mass Surveillance

Notwithstanding the important constitutionalization path of the data retention surveillance instrument promoted by the abovementioned CJEU case law, Member States demonstrated a reticent approach; they were reluctant to abandon bulk regimes perceived as invaluable and irreplaceable tools in the fight against national and transnational security threats. ^{Footnote 39} The solution of targeted data retention, highly criticized for its limited efficacy and potential discriminatory impact, ^{Footnote 40} was not implemented at the national level. ^{Footnote 41} The vast majority of governments, legislators, and, in some cases, courts ^{Footnote 42} adopted a “defensive” approach, trying to promote an interpretation of the CJEU case law that would not definitively ban generalized and indiscriminate retention systems but provide these regimes with stronger and more precise rules governing the access phase by state authorities. This erosion of the stringent principles declared in the data retention saga raised strong criticisms in civil society and NGOs. They considered national legislation that allowed mass surveillance instruments to be per se incompatible with the fundamental rights guaranteed by the CFREU as interpreted by the CJEU judgments on the topic.

In an impressive number of cases, ^{Footnote 43} the divergent views expressed in front of national courts led to a request for the intervention of the CJEU, underlining how the limits and safeguards described in the previous case law produced controversial effects and required clearer explanations. In particular, governments, law enforcement authorities, and, in some cases, national courts asked the CJEU to “clarify, refine or even reconsider various aspects of its case law,” ^{Footnote 44} arguing that strict safeguards and limits on access to data would be sufficient to balance the interference produced by generalized and indiscriminate retention. In all these decisions, EU judges pronounced unprecedented and crucial principles destined to influence the employment of mass surveillance techniques.

Having reiterated that mass surveillance techniques cannot be exempted from the control of EU law and the CJEU,Footnote ⁴⁵ the judges strongly reaffirmed that bulk data retention for public security purposes – namely, the fight against serious crimes – cannot be considered proportionate and legitimate. By identifying targeted data retention as the only form of surveillance allowed, the Court refused to accept alternative retention regimes such as the restricted one ^{Footnote 46} and decided not to succumb to the strong and profound criticism governments and law enforcement authorities expressed on the effectiveness and non-discriminatory nature of the targeted solution. If these positions represented a clear reaffirmation of the principles established in the previous case law, the most innovative part of these recent decisions – in particular those of October 2020 – was the one recognizing a sort of mitigation of the previous approach, highlighting the ongoing and still evolving nature of the process of constitutionalization performed by the Court. Protecting national security from serious threats such as terrorism or other activities capable of destabilizing a country’s fundamental constitutional, political, economic, or social structures provides Member States with wider maneuvering room. The seriousness of this objective may justify even more severe interferences with fundamental rights, including bulk data retention techniques. ^{Footnote 47}

Although this affirmation can appear as a major victory for governments and public authorities vocally invoking the possibility of adopting forms of massive surveillance and retention, the Court carefully and precisely specified all the limits and conditions to harness the use of such a highly invasive instrument. We can identify a further constitutionalizing effort by the CJEU, which introduced constitutional safeguards and boundaries by requiring national legislators to determine: (i) a precise legislative framework disciplining the possibility of adopting bulk data retention regimes; (ii) a specific time limit to the use of this instrument; (iii) rigorous data security safeguards able to protect from the risks of abuses; and (iv) control by courts or independent administrative bodies. Moreover, the Court specified that a bulk data retention regime could never be admitted in the context of the fight against serious crime, while it can be justified to face national security threats; However, even in this case, it cannot be systematic in nature, and its adoption has to be subordinate to the existence of serious, real, present, or at least foreseeable, threats to national security. ^{Footnote 48} Although the guarantee of national security is considered vital, reaching this critical objective cannot be untied from respect for the rule of law, which notably is

The Court tried to establish a correct balance between the need to safeguard national and public security effectively and to ensure the respect of the democratic bases of our societies. This balancing exercise passed through a progressive constitutionalization of data retention regimes, through which the Court pushed national legislators and EU institutions towards adopting constitutional principles able to determine the limits of acceptability and the justifiability of fundamental rights’ compression for both public and national security purposes. ^{Footnote 50}

To conclude this overview of the CJEU’s contribution to the constitutionalization of mass surveillance practices in the EU, it is worth mentioning that the data retention saga did not represent the only case in which the CJEU was asked to deal with mass surveillance. The CJEU jurisprudence concerning the transfer of personal data collected in European territory and directed outside EU borders confirmed the profound impact on fundamental rights produced by massive collection, retention, and access to personal data operated by public authorities, even when motivated by security purposes concerning third countries. ^{Footnote 51} In the Schrems I and Schrems II cases, the CJEU indirectly analyzed the intrusiveness of American mass surveillance systems such as Prism and Upstream by twice invalidating the adequacy decisions regarding data transfers to the US. Considering these provisions, the Court stated that “legislation permitting the public authorities to have access on a generalized basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life, as guaranteed by Article 7 of the Charter,” ^{Footnote 52} while a law not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, does not respect the essence of the fundamental right to effective judicial protection (Article 47 CFREU).

In the Schrems saga, the Court tried to transpose the constitutional principles and guarantees already affirmed inside EU territory in cases wherein the surveillance is perpetrated by foreign authorities, with a complex and – from some aspects – questionable approach. ^{Footnote 53} Similarly, in its Opinion 1/15, the CJEU invalidated the draft PNR agreement with Canada concerning transferring and processing EU passengers’ PNR data to Canadian law enforcement and security authorities. Here, the Court clearly reaffirmed the necessity of a connection or at least an indirect link between a possible threat and the retention, accessing, and processing of personal data, as well as the need for specific and precise safeguards guaranteeing the adequate protection of data outside EU borders. ^{Footnote 54} The attention and relevance attributed to retention, concerning not only communications data but also other information such as PNR, clearly emerged from the numerous proposed preliminary rulings regarding the validity of the PNR Directive, ^{Footnote 55} challenging its legitimacy based on the “constitutional” principles emerging from the data retention and Schrems saga. ^{Footnote 56}