Hostname: page-component-586b7cd67f-l7hp2 Total loading time: 0 Render date: 2024-11-24T15:23:50.057Z Has data issue: false hasContentIssue false
  • English
  • Français

Privacy Int'l v. Secretary of State for Foreign & Commonwealth Affairs and La Quadrature du Net v. Premier ministre (C.J.E.U.)

Published online by Cambridge University Press:  15 April 2021

Jack Maxwell  and
Joe Tomlinson
Jack Maxwell
Affiliation:
Jack Maxwell is Research Fellow in Public Law and Technology at the Public Law Project. He has a Bachelor of Civil Law from the University of Oxford, and degrees in laws and philosophy from the University of Melbourne. Joe Tomlinson is Senior Lecturer in Public Law at the University of York and Research Director at the Public Law Project.
Joe Tomlinson
Affiliation:
Jack Maxwell is Research Fellow in Public Law and Technology at the Public Law Project. He has a Bachelor of Civil Law from the University of Oxford, and degrees in laws and philosophy from the University of Melbourne. Joe Tomlinson is Senior Lecturer in Public Law at the University of York and Research Director at the Public Law Project.
Get access Rights & Permissions [Opens in a new window]

Extract

In October 2020, the Court of Justice of the European Union (CJEU), sitting as a Grand Chamber, handed down its preliminary rulings in Privacy International v. Secretary of State for Foreign and Commonwealth Affairs (Privacy International) and in the joined cases of La Quadrature du Net v. Premier ministre and Ordre des barreaux francophones et germanophone v. Conseil des ministers (La Quadrature du Net). In Privacy International, the CJEU held that member states are precluded from enacting laws enabling bulk transmission of communications data from providers to the state. In La Quadrature du Net, it laid down requirements for various types of data processing, including bulk and targeted retention and automated analysis, and held for the first time that bulk retention of communications data could be justified on national security grounds. The judgments represent a significant development of the CJEU's jurisprudence on communications data processing and state surveillance, as the European Union (EU) continues to move towards a new digital privacy law.

Type
International Legal Documents
Information
International Legal Materials , Volume 60 , Issue 3 , June 2021 , pp. 464 - 520
Copyright
Copyright © The Author(s), 2021. Published by Cambridge University Press on behalf of The American Society of International Law

Access options

Get access to the full version of this content by using one of the access options below. (Log in options will check for institutional or personal access. Content may require purchase if you do not have access.)

References

ENDNOTES

1 Case C-623/17, Privacy Int'l v. Secretary of State for Foreign & Commonwealth Affairs, ECLI:EU:C:2020:790 (Oct. 6, 2020) [hereinafter Privacy International]; Joined Cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net v. Premier ministre & Ordre des barreaux francophones et germanophone v. Conseil des ministers, ECLI:EU:C:2020:791 (Oct. 6, 2020) [hereinafter La Quadrature du Net].

2 Joined Cases C-293/12 and C-594/12, Digital Rights Ireland Ltd. v. Minister for Commc'ns, Marine & Natural Resources, ECLI:EU:C:2014:238 (Apr. 8, 2014) [hereinafter Digital Rights Ireland].

3 Id. ¶¶ 57–59, 63–64.

4 Id. ¶ 27.

5 Id. 60–62.

6 Joined Cases C-203/15 and C-698/15, Tele2 Sverige AB v. Post-och telestyrelsen, ECLI:EU:C:2016:970 (Dec. 21, 2016) [hereinafter Tele2].

7 Id. ¶¶ 65–81.

8 Id. ¶¶ 102, 115, 119.

9 Id. ¶¶ 103–108. The CJEU also held that the data had to be retained within the EU and irreversibly destroyed at the end of the retention period. See id. ¶ 122.

10 Id. ¶¶ 120–121.

11 See Opinion 1/15, EU–Canada PNR Agreement, ECLI:EU:C:2017:592 (July 26, 2017); Case-207/16, Ministerio Fiscal, ECLI:EU:C:2018:788 (Oct. 2, 2018); Case C-311/18, Facebook Ireland & Schrems, ECLI:EU:C:2020:559 (July 16, 2020).

12 Privacy International, supra note 1, ¶¶ 30–49; La Quadrature du Net, supra note 1, ¶¶ 81–104.

13 Article 4(2) of the Treaty on European Union states that national security is the sole responsibility of member states, while Article 1(3) of the ePrivacy Directive excludes activities concerning national security, defence and criminal law from its scope.

14 Joined Cases C-317/04 and C-318/04, Parliament v. Council & Comm'n, 2006 E.C.R. I-4721.

15 Privacy International, supra note 1, ¶¶ 45-47; La Quadrature du Net, supra note 1, ¶¶ 100–102.

16 La Quadrature du Net, supra note 1, ¶ 134.

17 Privacy International, supra note 1, ¶¶ 78–82.

18 Id. ¶ 80.

19 La Quadrature du Net, supra note 1, ¶¶ 140–145.

20 Privacy International, supra note 1, ¶ 75; La Quadrature du Net, supra note 1, ¶ 136.

21 La Quadrature du Net, supra note 1, ¶ 168.

22 See id. ¶¶ 130, 140.

23 Id. ¶¶ 177–182, 191.

24 Id. ¶¶ 152–156.

25 Id. ¶¶ 157–159. Several other forms of metadata processing—expedited retention (retention after the end of the retention period) and real-time collection (real-time monitoring of a person's movements)—were also considered. See id. ¶¶ 160–167, 183–191.

26 Proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications)—Mandate for negotiations with the European Parliament, ST 6087 2021 INIT (Feb. 10, 2021).