No CrossRef data available.
Published online by Cambridge University Press: 15 March 2023
On June 21, 2022, the Court of Justice of the European Union (CJEU), sitting as a Grand Chamber, rendered its decision in the preliminary ruling procedure C-817/19, Ligue des Droits Humains v. Council of Ministers. In its ruling, the CJEU held that the surveillance regime established by the Passenger Name Record Directive 2016/681 (PNR Directive) was compatible with the Charter of Fundamental Rights of the European Union (CFREU/EU Charter). Nevertheless, the CJEU strictly circumscribed the Directive's transposition within EU member states' domestic laws. While restricting permissible interpretations of the PNR Directive's provisions and imposing strict limitations on its scope to ensure its conformity with the EU Charter, for the first time the Court upheld an instrument of indiscriminate surveillance as compatible with EU primary law. This represents a significant development in the CJEU's case law on privacy rights, which is likely to affect the negotiation and development of future PNR agreements with third countries, as well as the development of the ePrivacy Regulation, discussions surrounding the regulation of AI, and negotiations for international instruments aiming to address serious crimes. Further, the ruling confirms the CJEU's increasing convergence with the European Court of Human Rights' (ECtHR) case law on the matter, thus inscribing national security as a legitimate exception to the general prohibition of indiscriminate bulk data collection and retention in Europe.
1 Case C-817/19, Ligue des Droits Humains v. Council of Ministers, ECLI:EU:C:2022:491 [hereinafter Judgment].
2 Directive (EU) 2016/681 of the European Parliament and of the Council of Apr. 27, 2016, on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.
3 Charter of Fundamental Rights of the European Union, 2012 O.J. (C 326) 391.
4 Joined Cases C-293/12 and C-594/12, Digital Rights Ireland Ltd. v. Minister for Communications, Marine and Natural Resources and Kärntner Landesregierung and Others ECLI:EU:C:2014:238 (Apr. 8, 2014).
5 Directive 2006/24/EC of the European Parliament and of the Council of Mar. 15, 2006, on the retention of data generated or processed in connection with the provision of publicly available electronic communications services of public communications networks and amending Directive 2002/58/EC, 2006 O.J. (L 105) 54 (Data Retention Directive).
6 Joined Cases C-203/15 and C-689/15, Tele2 Sverige AB v. Postoch telestyrelsen and Secretary of State for the Home Dept. v. Watson, ECLI:EU:C:2016:970 (Dec. 21, 2016).
7 Case C-362/14, Schrems v. Data Protection Commissioner, ECLI:EU:C:2015:650 (Oct. 6, 2015) and Case C-311/18, Data Protection Commissioner v. Facebook Ir. Ltd. & Schrems, ECLI:EU:C:2020:559 (July 16, 2020).
8 Opinion 1/15, ECLI:EU:C:2016:656 (Sept. 8, 2016).
9 Joined Cases C-511/18, C-512/18, and C-520/18, La Quadrature du Net v. Premier Ministre, ECLI:EU:C:2020:791 (Oct. 6, 2020). See also 60 I.L.M. 464 (2021).
10 Joined Cases C-793/19 (SpaceNet AG) and C-794/19 (Telekom Deutschland), ECLI:EU:C:2022:702 (Sept. 20, 2022).
11 Judgment ¶ 111.
12 Id. ¶¶ 112–128.
13 Id. ¶ 121.
14 Id. ¶ 111.
15 Opinion 1/15, ECLI:EU:C:2016:656 (Sept. 8, 2016).
16 Judgment ¶¶ 131–139.
17 Id. ¶ 152.
18 Id. ¶¶ 173–174.
19 Id. ¶¶ 236–237.
20 Id. ¶ 247.
21 Id. ¶ 262.
22 Id. ¶¶ 187–188.
23 Id. ¶¶ 193–201.
24 Id. ¶¶ 202–213.
25 See, in particular, Big Brother Watch v. U.K. [GC], App. Nos. 58170/13, 62322/14, and 24960/15 (May 25, 2021); Centrum för Rättvisa v. Swed. [GC], App. No. 35252/08 (May 25, 2021).
26 Commission proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications), COM (2017) 010 final (Oct. 1, 2017).
27 Directive 2002/58/EC of the European Parliament and of the Council of July 12, 2002, concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications).
28 Commission proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications)—Mandate for negotiations with the European Parliament, ST 6087 2021 INIT (Feb. 10, 2021).