The Question of Jurisdiction:

The Impact of Ultra Vires Decisions on the ECJ’s Normative Power and Potential Effects for the Field of Data Protection

Carsten M. Wulff

PhD Student, Tallinn University, Estonia.

The Question of Jurisdiction

The ultra vires judgment of the German Constitutional Court on the debt security purchasing of the ECB system sent shockwaves throughout Europe. Some scholars see the legal framework, specifically the principle of the supremacy of the European Union in danger. This article argues that the judgment is a challenge for Luxembourg; however, there have been warning signs from the Czech Republic and Denmark that constitutional courts will not shy away from criticizing, when the ECJ oversteps its jurisdiction. The author argues that the judgment may weaken the overall normative power of the court and will assess whether a similar judgment could occur in the field of data protection and national security exceptions. The only way back to normality will be for the court to ensure it does not overstep its jurisdiction and the European Institutions unconditionally backing the ECJ in the expected upcoming conflict with the constitutional courts of Member States.

Introduction

1

Following the 9/11 terrorist attacks, online privacy laws were weakened on both sides of the Atlantic in order to effectively fight the war on terrorism. With the PRISM scandal and the revelations of whistle-blower Snowden, the EU ended its silence on privacy violations and launched efforts to amend the 1995 Directive in order to provide a higher standard of protection for its citizens. As a result, the General Data Protection Regulation (hereinafter GDPR) was implemented, which entered into force in May 2018. Although there has been significant discussion of the balancing of the right to privacy and freedom of expression, little attention has been paid to those cases where the GDPR does not apply – when matters of national and public security are concerned.
Through consistent case law, the court is able to promote higher standards of data protection and determine where the national security clause does and does not apply. At the same time, the Court must be careful not to overstep its jurisdiction provided in the Treaties. Although the European Court of Justice (hereinafter ECJ) is de facto the court of last instance, recently it has been under attack. Following preliminary rulings, there have already been two cases in Denmark[1] and the Czech Republic,[2] where the national constitutional courts chose not to follow the ruling of the ECJ. In May 2020, the German Constitutional Court went a step further and in its judgment on the European Central Bank’s (hereinafter ECB) debt security purchasing system,[3] declared a judgment of the ECJ[4] as ultra vires and openly criticized the ECJ’s reasoning in its judgment. This judgment gained considerable attention and raises questions about whether other Member States may follow suit, with some fearing the entire European legal order could be at stake.[5] This article will assess paths in which the ECJ can exert normative power in cases which involve a balancing task. In order to do so, criteria from normative power Europe (NPEU) will be viewed considering the de facto capabilities of the ECJ. The principles of NPEU applicable to the ECJ will be linked to the theory of legal interpretivism, which sees the courts as potential norm-shapers. The recent ultra vires decisions will be reviewed to find common trends in the judgments of the constitutional courts. Following this, recent case law on data protection will be reviewed with the aim of predicting whether this field may also cause conflicts in the future, or if Member States are likely to fully comply with the path the court is taking. In the conclusion, the findings will be summarized to answer the question whether the normative power of the court has suffered damage from recent case law and highlight ways the damage can be reduced.

The ECJ as a Normative Power

2

Through its unique nature and often cited as one of the most powerful international courts,[6] with its judgments, the ECJ contributes to the harmonization of the European legal order. In many cases, the court does not just have to weigh arguments for and against a violation of a specific right; often, including in the field of data protection, the court also needs to balance competing rights. In this sense, the court does not just actively develop competing norms, it can also to an extent become a regional normative power.
The concept of NPEU was most famously developed by Manners in 2002 to define the role of the EU in the world. He defines six characteristics of a normative power – contagion, informational diffusion, procedural diffusion, transference diffusion, overt diffusion and cultural filters. Assuming internal coherence, a normative power must be able to define, ‘what is normal’ – it dictates the norm. In order to accomplish this, the values of the State must be diffused and adapted to different target audiences.[7] Through the use of soft means, the EU is able to disseminate values to third countries, which will voluntarily implement them if they are perceived as morally justifiable. For the effective diffusion of values, internal coherence is of importance, as only then can the State truthfully be viewed as standing for the values it is trying to diffuse. Building on Manner’s research, Forsberg adds that an actor can never be an absolute normative power, but only approach it. His five-part definition requires a normative power to have ‘a normative identity’, ‘behave according to norms’, ‘use normative means of power’, ‘pursue normative interests’ and ‘achieve normative ends’.[8]
Although Manners and Forsberg are dealing with the normative capacity of a state, some of these criteria can very well also apply to the highest courts when balancing competing laws in a controversial case. Through its judgments in cases involving conflicting norms, the ECJ helps to develop Europe’s normative identity, which Member States will then be required to adhere to and ideally also promote in external relations with third countries. The ECJ is specifically in a position to do this through the unique nature of the European project, where clashes between union and domestic law can occur.
The legal world knows the concept of legal interpretivism. In ‘Law’s Empire’, Dworkin argues that courts can play a significant role in shaping the policies of the state. In controversial cases, judges will use their understanding of justice and fairness to provide the best possible outcome reflecting the circumstances and scope of the case. Each adjudicated case adds to the chain of law with which courts are constantly developing the law.[9] Specifically in the field of data protection, the ECJ has already reversed[10] or dramatically shaped[11] the policies of the EU in the past. Although the ECJ does not apply the concept of binding precedent, only in exceptional cases has the ECJ completely disregarded the principles of previous judgments. On the contrary, the court constantly cites previous case law to further embed previous cases as persuasive precedent.
As Larsson et al. argue, the ECJ is well aware that it can talk power to politicians through its judgments.[12] In controversial cases, it is more likely to embed the case in previous judgments to strengthen its arguments.[13] In doing so, the court is also indirectly shaping the understanding of what the norm is, according to which the Member States should adjudicate similar cases in the future. Although the jurisdiction of the court is limited to the Member States of the EU, in the field of online privacy and data protection, where the boundaries of jurisdiction are often not clear, the judgments of the ECJ also receive attention from abroad.[14] Here the court can actively promote and disseminate the European approach towards data protection. The EU itself can assist in this field through making the adherence to European standards compulsory before concluding agreements with third countries. This, for example, is already the case in trade agreements such as CETA[15] and agreements regarding the transfer of data to third countries, such as with the EU-US Privacy Shield.[16]
In order to do this, it is important that the judgments of the court are respected and the reasoning of the court in its judgments is accepted by the Member States. This contributes to creating internal norm coherence. As the guardians of the treaties and being vested in the principle of supremacy, it is rare for Member States to not accept the ruling from Luxembourg. Nonetheless, the recent ultra vires judgments of Member States show an alarming trend – the authority of the ECJ as the court of last resort is crumbling. As will be shown, this is due to a lack of internal European coherence on controversial matters, gaps in European legislation, and recently, national courts of last resort questioning the legal analysis itself, conducted by the ECJ.

Recent Conflicts with Constitutional Courts

3

Case C-399/09 dealt with Regulation No. 1408/71, which regulates social security measures for the elderly across Member States.[17] The Czech Republic and Slovakia, prior to ratifying the Regulation, had an agreement in place that stipulated that the place of residence of the employer would be the most important criteria in determining which pension an individual would receive. This led to a series of disputes in the 1990s and early 2000s, as the size of the pension varied between two states and it was possible that an individual who did not work any of his or her career in one Member State ended up with the pension from the other because the employer’s place of residence was located in that part of Czechoslovakia at the time it ceased to exist.[18] The practice of the Czech Republic was to award a higher pension to Czech nationals for the periods they worked in Slovakia, before the dissolution of Czechoslovakia. The authority in practice only awarded the premium to Czech nationals. In this case, the Supreme Administrative Court questioned whether this procedure was in accordance with Regulation 1408/71 and the principle of non-discrimination. The regulation allowed for previous agreements listed in Part B of Annex III to stay in place as long as they apply to all people to whom the regulation applies.[19] Articles 12, 20 and 33 of the agreement were included in the annex of the regulation and were hence supposed to stay in place.[20]
The ECJ found that the special increment was discriminatory – it either needs to be completely abolished or be applied to all citizens eligible for it, regardless of nationality.[21] The Supreme Administrative Court did not see itself in a position to decide which approach to take and left it to the Constitutional Court to clarify which approach it should take. Instead of choosing one of these approaches, the Czech Constitutional Court decided to declare the judgment ‘ultra vires’. The court reasoned its exemptions on the ground that the annex was of a declarative nature and allowed for discrimination in certain cases. Furthermore, European law does not apply as this agreement was not between states but handled the practicalities of the dissolution of a state.[22]
However, discriminatory exemptions were only allowed for those agreements listed in Part B of Annex III of the regulation – the one concluded between the Czech Republic and Slovakia was listed in Part A of Annex III.[23] Furthermore, the case law on the non-discrimination of EU citizens is well established and is a cornerstone of the EU legal order, which all Member States are bound to after joining the European Union. Consequently, the agreement had to be brought in line with EU law.
Since the judgment in ‘Sugar Quotas 3’,[24] the Constitutional Court has followed an approach similar to that of the German Constitutional Court. It accepts the rulings from Luxembourg as long as the standard of fundamental rights protection is at least of the same quality as that of the constitution of the Czech Republic. This, however, does not explain the ‘ultra vires’ judgment of 2012. The court did not find that the judgment went against the Czech Constitution, but rather against established case law.[25] It has been argued that the Constitutional Court was offended that a personal letter from the chief justice to the ECJ during the Landtova case was rejected and sent back.[26]
In August, the Supreme Court sought clarification from Luxembourg on how to deal with the judgment from the Constitutional Court. Despite the ‘ultra vires’ decision, the authorities stopped awarding higher pensions for those in a similar position as Landtova. In a case with nearly identical facts, it referred the following questions to the ECJ:

Does EU law (including Arts. 18 TFEU and 4(2) TEU) preclude the favourable treatment of Czech citizens under the specific circumstances invoked by the Constitutional Court? If yes:
Has the Supreme Administrative Court a duty to follow the legal view of the Constitutional Court, if that view seems to be incompatible with the Court of Justice interpretation of EU law?[27]

The ECJ ultimately never had to answer these questions – in 2013, the authority decided to pay the pension, effectively resolving the conflict. The ECJ did not comment on the judgment of the Constitutional Court and the Commission did not open any infringement proceedings against the Czech Republic over the ultra vires judgment of the Constitutional Court.
In case C-441/14, the ECJ dealt with the Danish transposition of Directive 2000/78 on non-discrimination in the workplace. The Danish law on legal relations between employer and employee set up a structure which mandated employers to pay a severance package to employees if they were employed by the employer for at least 12 years.[28] The severance package does not need to be paid if the employee is eligible for an old age pension. The plaintiff switched his employer and was eligible for the severance package, however, due to his age, also for the old age pension. The employer did not pay him the severance package on the grounds that Danish case law was consistent on this matter and the employer under the principle of legal certainty and the protection of legitimate expectations should not be expected to pay the severance in this case.[29]
The Supreme Court referred the case to Luxembourg, asking whether the provisions of Danish law not enabling the severance package to be paid out if the employee is eligible for the old age pension are in conflict with the principle of non-discrimination and whether it is consistent with union law to weigh the principle of non-discrimination against the principles of legal certainty and legitimate expectations.[30] The ECJ found the provision to go against the objectives of the directive, the national court may not apply it and must interpret the case in the light of the objectives of the directive. The principles of legal certainty and legitimate expectations are outweighed by the wrong transposition of the directive into domestic law.[31]
In 2016, the Supreme Court delivered its judgment and found that it could neither apply the directive nor the Danish law.[32] The Danish Accession Act to the EU does not grant it authority to set aside domestic law for an unwritten principle – the principle of non-discrimination. In a previous case, which was also referred to the ECJ,[33] the court ruled in favour of the employee in a case which dealt with claims against a public authority. However, as this case deals with a horizontal relationship between two private parties, the court cannot set aside national law.[34] Furthermore, the dispute itself occurred before the ratification of the Lisbon Treaty; therefore, the employee could not rely on the provisions of the Charter of Fundamental Rights. This view has been contested by scholars and one dissenting justice, stating that the principles have already been recognized as primary law prior to the signing of Lisbon.
Similar to the judgment in Landtova, the Supreme Court does not see itself in a position to set aside national law, this time in a case which deals with horizontal relationships, prior to the enactment of the Charter of Fundamental Rights. In contrast to Landtova, the Danish judgment also commented on the nature of the Accession Act and the powers it transferred (and did not transfer) to the Luxembourg Court. The most recent, and most significant, dissent from the ECJ was delivered by the German Constitutional Court in May 2020.
In 2018, the ECJ delivered its judgment in C-493/17, which dealt with the public sector asset purchase programme (hereinafter PSPP).[35] Following Decision 2015/774, the ECB granted itself and national central banks (in proportion to their respective shares in the ECB’s capital key) the opportunity to purchase marketable debt securities on the secondary markets.[36] The initial volume of these was limited to 60 billion euros per month, which later was expanded to 80 billion[37] before being reduced to a maximum of 60[38] again. Following the judgment, the debt securities purchasing ran out in January 2019; however, they were relaunched in November of the same year.[39] Under its mandate, the ECB has complete autonomy on monetary policy; however, it may not make any political decisions. In case C-493/17, the German Federal Constitutional Court sought clarification from Luxembourg whether the PSPP was still within the mandate of the ECB and not a policy decision.[40]
After deeming the application admissible, the court grouped the questions into two groups – did the ECB properly communicate the reasons for its decisions as required under Article 296 TFEU[41] and are the decisions still within the exclusive monetary policy of the ECB.[42]
Regarding the first question, the ECJ deemed that the explanations to all of the decisions relating to the PSPP and the press conferences of the president of the ECB amounted to sufficient explanations of the ECB’s decision as required under Article 296.[43] In answering the second group of questions, the court acknowledged that the decision also has impacts on economic policy; however, in order to achieve the goal of raising inflation rates, these are necessary, and therefore within the mandate of the ECB.[44] The measures were also proportionate as the ECB has tried a broad range of different measures before resorting to the PSPP.[45]
In May 2020, the German Constitutional Court delivered its controversial judgment – it rejected the assessment from the ECJ, found that the ECB did not sufficiently explain how it balanced the PSPP with the principle of proportionality and ordered the ECB to pass a decision in which it also outlines how it conducted the balancing within three months, otherwise the German Federal Bank has to exit the European Assets Purchasing Programme (EAPP).[46] The German Basic Law does not authorize the German State to transfer sovereign powers to the European Union, “in such a way that the European Union were authorised, in the independent exercise of its powers, to create new competences for itself”.[47]
The court harshly criticized the assessment of the ECJ. It highlighted that in principle, judgments of the ECJ are binding on the Member States. However in the case at hand, as the original decisions of the ECB did not sufficiently take into account the principle of proportionality under Article 5 TEU,[48] the judgment of the ECJ must be considered ultra vires.[49] In its balancing, the ECJ wrongly found that the economic impacts of the PSPP were of an indirect nature – it finds that this can only be said if additional steps are required between the measure and its indirect consequence. In the case of the PSPP, the economic effects are of a direct nature.[50] Furthermore, the court did not adequately assess measures of equivalent affect, nor did it take into account the principles of effectiveness or equivalence.[51] If the ECB were to conduct economic policy, Article 48 TEU would need to be amended, which would require the involvement of the German legislature.[52] Some of the real economic results of the PSPP include the risk of creating real estate and stock market bubbles[53] and Member States relying on the ECB to always buy their debt securities, hence taking away an incentive for sound fiscal policy.
The judgment led to heavy discussions in Germany and abroad, with most feedback being negative.[54] The judgment was met with enthusiasm in Poland and Hungary, both countries with a Eurosceptic government.[55] In an extraordinary step, the ECJ itself issued a press release stating that it alone has jurisdiction to rule that an act of an EU institution is contrary to EU law. Preliminary rulings are binding on the national court in the main proceedings.[56] The European Commission might launch infringement proceedings against Germany if it fails to comply with the judgment of the ECJ, in the near future.[57] The judges themselves defended their judgment, while playing down the perceived negative impacts on the European legal order. If the ECB provides proof that is has conducted a proportionality test, the judgment will have no further impacts.[58]
These three cases reflect an unsettling trend in domestic courts of ‘testing the limits’. Where the reasoning of the Czech Constitutional Court was widely considered to be sloppy,[59] there nonetheless was not any reaction from the European Commission. The Danish case hinted at more serious clashes between established domestic case law and the ruling from Luxembourg. The German judgment was the first to directly call the reasoning of the ECJ flawed. Although in substance, it has provided evidence that the argumentation from Luxembourg was not flawless and this is in line with the reasoning of the German Constitutional Court in Solange,[60] the judgment jeopardizes the authority of the Luxembourg Court as the final instance and may be abused by Eurosceptic governments.

Overview of Recent Data Protection Case Law

4

This section will now address recent cases dealing with data protection and national security exemptions under the GDPR and 1995 Directive. Elements of the judgments will be highlighted which hint at conflicts between national and European laws. In the following section, these clashes will be addressed to provide arguments for and against such divergencies of national courts occurring in the field of data protection in the future.
The judgment in Digital Rights Ireland Ltd.[61] voided Directive 2006/24 (the Data Retention Directive). Article 3 of the directive placed an obligation on public communications networks to store all traffic and location data for a period from six months to two years. The data could only be accessed with the permission of the domestic court based on the procedures of the country. Furthermore, in accordance with the principle of conferral, it provided a clause for Member States to enact stricter laws when issues of national security were at stake.[62]
Digital Rights Ireland and private citizens from Austria brought actions in the national courts that the implementation of the Data Retention Directive violated fundamental rights. The highest courts sent the case to the Luxembourg Court for a preliminary reference, where the court decided to combine the two proceedings. Although the directive did not allow for the storage of content data, the court ruled that it seriously infringed Articles 7 and 8 of the Charter of Fundamental Rights, which respectively provide for the respect of private and family life and protection of personal data.[63] The court highlighted three reasons for its judgment:

The directive did not differentiate between the traffic data which was stored, nor provide for any limitations or exceptions. It applied to all persons, regardless of whether there was any evidence linking them with a serious crime.[64]
Furthermore, the directive did not contain any substantive or procedural conditions outlining how data can be processed and be subsequently used by the national authorities. As the directive did not outline what constitutes “serious crime”, it failed to lay down objective criteria of what crimes justify such a serious infringement of the rights listed in the Charter of Fundamental Rights.[65]
The requirement to store data for at least six months makes the interference of fundamental rights go beyond what was strictly necessary. The directive also failed to provide effective protection against the risk of abuse and unlawful access to the data retained.[66]

It should be noted that prior to the judgment of the ECJ, the German Constitutional Court already ruled that the German transposition of the directive violated the German Basic Law, specifically the right to informational self-determination.[67] National transpositions were also brought to court and successfully revoked in the Czech Republic and Romania.[68] One could question why none of those cases were referred to Luxembourg for preliminary reference.
In Tele2 Sverige,[69] the court followed in the footsteps of the Digital Rights case. Following the annulation of the Data Retention Directive, applicants from the UK and Sweden contested the domestic data retention schemes as being in violation of the 2002 ePrivacy Directive,[70] which was then in force again. With the judgment in Digital Rights, according to the applicants, the retention of telecommunication has become illegal. According to the plaintiffs, the retention of data is in violation of Articles 7 and 8 of the Charter of Fundamental Rights.[71] The court found that:

the data which providers of electronic communications services must therefore retain makes it possible to trace and identify the source of a communication and its destination, to identify the date, time, duration and type of a communication, to identify users’ communication equipment, and to establish the location of mobile communication equipment. […] Further, that data makes it possible to know how often the subscriber or registered user communicated with certain persons in a given period.[72]

The court found that the infringement in privacy rights and the right to data protection was serious; the restrictions on the rights were not limited to what was strictly necessary. The retention of data must continue to meet objective criteria that establish a connection between the data to be retained and the objective pursued. Such criteria must be shown to define the extent of that measure and the extent that the public is affected.[73]
In Schrems v. Data Protection Commissioner,[74] the plaintiff, Schrems, filed a complaint to the Irish Data Protection Officer, stating that the storage of his personal data by Facebook Ireland Ltd. on servers in the United States violated his fundamental rights. Under the 1995 Directive, trans-border flows of data to third countries comply if the third country provides an adequate standard of protection.
In order to ensure an adequate standard of protection of personal data in the United States, the Safe Harbour principles were developed. In these, the United States agreed to comply with seven principles listed in the 1995 Directive. Individuals must be informed that their data are being collected and of how it will be used. There must be an option to opt out of the collection and transfer of data to third parties. In general, transfers may only occur to third parties that follow adequate data protection principles. Data controllers must make reasonable efforts to prevent the loss of collected information. Collected data must be relevant and reliable for the purpose it was collected. Individuals have the right to access information about them and the right to amend or delete it if inaccurate. Finally, the United States will ensure there are effective ways to enforce the rules.[75]
The Commission Decision 2000/520/EC (‘Safe Harbour’ Decision) confirmed that the Safe Harbour principles provide for an adequate level of protection of personal data as required under Article 25 (2) of the 1995 Directive in regard to trans-border flows of data to third countries.[76]
Schrems filed an application to the Irish data protection supervisory authority to investigate whether the transfer of data from Facebook Ireland Ltd. to servers located in the United States was in compliance with the 1995 Directive. The data protection authority declined to investigate the case. The case went to the Irish national courts, where it was referred for preliminary reference to the Luxembourg Court. The court was asked to answer the questions:

Whether the supervisory authority is absolutely bound by Decision 2000/50 concerning whether the United States provided an adequate level of protection?
Or, alternatively, may and/or must the office holder conduct his or her own investigation of the matter in the light of factual developments in the meantime since that Commission decision was first published?[77]

The court found that Article 3 (1) of the Commission Decision overstepped the competences granted to national data protection authorities in the 1995 Directive. This specific provision gave the authorities the power to suspend data flows where the relevant government body in the United States has found to be an organization that did not comply with the Safe Harbour principles, or where there is a substantial likelihood that the principles are being violated.[78] As the decision furthermore did not specifically state that the United States in fact ‘ensures’ an adequate level of protection, the court reached the conclusion that the Safe Harbour Decision was invalid.[79]
The United States accepted the judgment and quickly negotiated a new agreement with the EU.[80] The EU-US Privacy Shield agreement was also invalidated by the Luxembourg Court in the so-called Schrems II judgment of July 2020, on many of the same grounds as the Safe Harbour agreement.[81]
Google v. CNIL dealt with the extraterritorial scope of the GDPR. The French data protection authority (CNIL) imposed a fine of 100,000 euros on Google for failing to delist search results on non-European domains. The CNIL argued that in order to assure adequate protection of data subjects’ rights under the 1995 Data Protection Directive (the court reviewed the case considering the GDPR), Google must delist search results under all of its domains once a delisting request is approved. It asked the ECJ to rule on whether Google must delist search results, [1] across all of its domains, [2] only under the EU Member States’ domains and [3] whether Google must enforce ‘geo-blocking’ based on the location of the search request.[82]
Although the court affirms that the aim of the GDPR is to, “guarantee a high level of protection of personal data throughout the European Union”[83] and asserts, “that a de-referencing carried out on all the versions of a search engine would meet that objective in full”,[84] the court also highlights, “that numerous third States do not recognise the right to dereferencing or have a different approach to that right”.[85]
Following considerations regarding the scope of the GDPR and the intentions of the legislators,[86] the court concludes that Google is under no obligation to delete its search results under non-European domains.[87] Regarding the effectiveness of Google’s ‘geo-blocking’ measures, this is up to the French court to decide. The judgment follows the opinion of the Advocate General. Advocate General Szolar in his opinion especially highlighted the importance of balancing privacy rights with freedom of information.[88]
As the judgments reflect, with the rise of the internet and competing rights online, the court is left with a delicate balancing task. In Digital Rights Ireland, in a highly discussed judgment,[89] the court found that by nature, the Data Retention Directive was in violation of fundamental principles of the Charter of Fundamental Rights. In Tele 2 Sverige, the court also voided retention measures which had already been implemented in the domestic transpositions of the Directive if these are not limited to what is strictly necessary and allow for an independent review on the necessity of storage.
In Schrems, the court voided an international agreement – the Safe Harbour Agreement. It speaks for the normative power of the EU that the US accepted the judgment and quickly negotiated a new agreement with the EU, albeit the EU-US Privacy Shield has also been criticized and has also been voided. In Google v. CNIL, the court established the limits of the reach of European data protection legislation. In its ruling, the court clarified that a Right to Be Forgotten can only apply for European domains, with geo-blocking proposed as the best solution. These judgments, which build on existing case law and have not been contested by the Member States, display that in the field of data protection, despite the importance of balancing competing rights in all of these cases, the authority and assessment of the ECJ has not been contested so far.

Exemptions in the GDPR and Dual Protection of the ECHR

5

The legislator was well aware that the right to personal data protection is not an absolute right. In the definitions of the GDPR, it is highlighted that the right must be balanced in accordance with the principle of proportionality.[90] It is highlighted that the GDPR does not apply in cases where national security is concerned.[91] For matters of public security and law enforcement, Directive 2016/680 is to apply.[92]
Directive 2016/680 (The Police Directive) provides additional safeguards in the field of public security, giving the police more leeway in the field of data protection than the GDPR would provide for. It allows for video surveillance, covert investigations and:

activities can be done for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, as long as they are laid down by law and constitute a necessary and proportionate measure in a democratic society with due regard for the legitimate interests of the natural person concerned.[93]

It also lists Article 6 of the ECHR (right to a fair trial), as an important element in the proportionality assessment. Furthermore, the Directive reiterates that:

the processing of personal data under this Directive should be necessary for the performance of a task carried out in the public interest by a competent authority based on Union or Member State law for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.[94]

To date, there have not been any judgments from the ECJ which cite the Police Directive, which serves as an indicator that the Directive does not have a significant impact on the scope of data protection of perpetrators. The possibility of a clash of the Police Directive with domestic laws appears slim, specifically since the implementation of the GDPR. It also should be noted that the ePrivacy Regulation will further harmonize the European data protection framework. In the current proposal,[95] the regulation is set to include a detailed test for when a national security exemption is considered proportionate.[96] According to the latest progress report, substantial changes are likely to be made to the proposal.[97]
As a last resort, and also in the field of national security, where the EU does not have any competence, it is also possible to bring the case to the ECtHR, which can deal with violations of the ECHR. The safeguards are not as widely developed as in the GDPR;[98] nonetheless, under Article 8 of the Convention, Parties to the Convention must respect private and family life, home and the correspondence of individuals.[99] The ECHR also provides for derogations in the field of national security and public safety, “in accordance with the law and necessary in a democratic society”.[100]
In the field of data protection, protocol 223 to Convention 108 is open for signature, which will further harmonize the legislation of the CoE with the EU framework. Parties to the Convention need to set up one or more independent supervisory authorities, which will have the power to investigate and issue administrative sanctions if the Convention is violated. To date, 55 countries have signed the protocol, well above the threshold of 38 for it to enter into force. It is expected to enter into force in October 2023.[101]
In Big Brother Watch v. UK, the ECtHR dealt with a case which affected the mass surveillance of European citizens.[102] The case addressed the nature of the interception of electronic communications by the United Kingdom. The Government Communications Headquarters (GCHQ) was accused of running operation TEMPORA, which allowed it to tap into and draw data from bearers. Based on simple selectors (i.e. an email address), the data of targets were collected and stored. Other data were automatically discarded.[103] Following a ‘triage’ process, the GCHQ determined which data to actually open. The legal basis for the collection of data was the Intelligence Services Act and Security Services Act.
The Regulation of Investigatory Powers Act (RIPA) provides that an intercept warrant must first be issued before intercepting the communications of UK citizens[104] or, in the case of serious crime; the storage is authorized directly by the secretary of state. Serious crime is defined as a crime which satisfies one of the following criteria.

that the offence or one of the offences that is or would be constituted by the conduct is an offence for which a person who has attained the age of twenty-one and has no previous convictions could reasonably be expected to be sentenced to imprisonment for a term of three years or more;
that the conduct involves the use of violence, results in substantial financial gain or is conduct by a large number of persons in pursuit of a common purpose.[105]

The court found the provisions of the RIPA did not provide clear enough definitions as to what constitutes ‘serious crime’. On these grounds, it found that the current structure was in violation of Articles 8 and 10 of the Convention.
This case reflects that the Strasbourg Court will find a national law to be in violation of the ECHR if the infringement into the right to privacy (Article 8) and freedom of expression (Article 10) is not proportionate. The judgment develops the reasoning from Weber and Saravia v. Germany (no. 54934/00).[106] In this case, the court had to rule on surveillance measures which included the interception of wireless telecommunication messages for crimes listed in the German law on restrictions on the secrecy of mail, post and telecommunications (‘G10 law’). The violation of Articles 8 and 10 was still considered to be proportionate.

Lessons from the Constitutional Court Judgments and Impacts on Data Protection

6

As highlighted in the introduction, through its case law and principled judgments, the ECJ was able to build up a reputation as a respected court of last resort for all cases which the European Treaties conferred it competence upon. With the implementation of the Lisbon Treaty, leading to the Union acquiring legal personality and the enforcement of the Charter of Fundamental Rights, which is binding on the EU Institutions, the power of the court reached a new peak. Nonetheless, the court always needs to ensure that it is not overstepping its jurisdiction, while at the same time acting against Member States which are overstepping theirs.
The decisions of the Czech Republic and Denmark should have served as warnings to the court. In the case of the Czech Republic, the reasoning of the Constitutional Court has been criticized – the consequence should have been an infringement proceeding launched by the Commission.[107] This also would have showed the ECJ has teeth and is willing to enforce its jurisdiction when it is clear that it has it. However, the reaction of the EU Institutions has been rather toothless. Although the case may only deal with a small peculiarity of the transposition of the regulation on the application of social security schemes within two countries that used to be united, with the Accession Treaties, the Czech Republic accepted the acquis communautaire of European laws, which includes the principle of non-discrimination.
The more nuanced judgment from Denmark should have rung more alarm bells in Luxembourg. Again, the principle of non-discrimination was the centre of the dispute. In this case, the judgment reflected a dilemma on the demarcation of competences awarded to the European Institutions following the Treaty of Accession. This ultimately amounts to an issue in the Danish framework. The decision to set aside the judgment of the ECJ still resembles a major clash with Luxembourg. To retain face, the Commission at the least should have asked for clarification from the Danish government on how it will handle the judgment in order to align its laws with the European case law and be able to enforce the judgment of the ECJ.
The judgment from the German Constitutional Court resembles the most serious threat for the Court on multiple levels. In its Solange doctrine, the Constitutional Court has already awarded itself the option to review European laws in the light of the German Basic Law. As long as the level of protection granted by the European Union is comparable to that of the Basic Law, it will refrain from doing so. The conflict here, however, is of a different nature. As the court pointed out, it is about the (alleged) failure of the ECJ to conduct a proper analysis based on the principles of proportionality and conferral on whether the ECB had the legitimation to launch the PSPP. It should be noted that the German Constitutional Court very rarely refers a case for preliminary reference to Luxembourg – the first was the case in Gauweiler,[108] which dealt with the European financial stability mechanism. There the court accepted the opinion of the ECJ, as it was convinced that the court conducted a proper analysis on the proportionality of the measures.
Despite the Constitutional Court raising relevant concerns in the Weiss et al. judgment and the Solange doctrine of the court, the judgment must have consequences, if the ECJ is to retain its position as the court of last resort in Europe. The widespread criticism of the judgment across Europe, and most importantly by the European Institutions themselves reflect that, despite the recent turbulences, the authority of the ECJ is still respected by the majority of the Member States and within the European Institutions.
As the data protection case law shows, if the opinion becomes widespread that the ECJ does not conduct a proper assessment of the principles of proportionality and conferral, there is the risk that in the future, Member States might be more likely to rely on the national security clause included in the GDPR, or in general, question the assessment of the court if they disagree with the reasoning.
In order to restore the authority, the author proposes three ways for the European Institutions to limit the damage and ensure the authority of the court is retained in turbulent times.

The EU Institutions must condemn the judgment of the German Constitutional Court in a unified manner. Infringement proceedings against Germany should be launched if the government fails to comply with the judgment of the ECJ. Although the proceedings will likely drag on for years and might not end successfully,[109] the message the Commission sends would be that it stands with the ECJ.
The ECJ needs to reflect on the standards to which it conducts its legal assessment. Although it is clear that the court has a large workload and cannot give the same amount of attention to each case,[110] the judgment of the German Constitutional Court raises valid objections regarding the standard of review conducted in the Weiss et al. judgment.
In the mid-term, the conflict reflects a crisis of the separation of powers between Member States and Brussels. The EU itself in these turbulent times will need to address whether the solution is more Europe’s or a return of competences to the Member States.

In the worst-case scenario, as a result of the damage from the Weiss et al. judgment, Member States also may not respect the necessary balancing test conducted by the Court in the field of data protection. Fortunately, this worst-case scenario is unlikely to become reality due to the dual protection of the fundamental rights of privacy and freedom of expression by the CoE. The implementation of protocol 223 to Convention 108 will hopefully also strengthen national supervisory authorities to enforce Convention 108 and penalize violations.
Regarding the national and public security exemptions, the safeguards are also sufficient. As Big Brother Watch et al. showed, the ECtHR will call out a Member State if the derogation from the ECHR becomes too extreme. Even if the GDPR provides more leeway for this, especially after the enforcement of protocol 223, which will bring Convention 108 more in line with the GDPR, it can be expected that the ECtHR would deliver a judgment in line both with the principles of the Convention and the GDPR.

Conclusion

7

The aim of this article was to analyse recent conflicts between domestic courts and national courts, assess potential impacts in the field of data protection and provide recommendations on how the ECJ can restore normative power following the clashes with the Member States. The analysis has shown that the controversial judgment of the German Constitutional Court did not come out of nowhere. The cases from the Czech Republic and Denmark should have alarmed the judges in Luxembourg. The analysis of case law in the field of data protection has shown that issues remain regarding the national security exemption of the GDPR, privacy and data protection rights of individuals, and the scope of application of the Right to Be Forgotten. With the enforcement of protocol 223 to Convention 108 in 2023, an important step will be made towards dual protection in the field of data protection by the Luxembourg and Strasbourg Courts.
Although the judgment of the German Constitutional Court raises some relevant points regarding the standard of review of the Luxembourg Court, the damage caused by the harsh criticism of the Luxembourg Court’s standard of review regarding the principles of proportionality and conferral, the fundamental principles of the European Union need to lead to determined action of the European Institutions. Otherwise, there is a risk that in the future, similar ultra vires judgments may continue to be made by domestic courts when they find the reasoning of the Luxembourg Court to be incomplete. The analysis has shown that there are enough safeguards for this to not happen in the field of data protection; however, this could well be the case in other fields where there is not simultaneous dual protection by the Strasbourg Court.

Notes

[1] Case C-441/14, Dansk Industri (DI) v. Estate of Karsten Eigil Rasmussen, ECLI:EU:C:2016:278, available at: http://curia.europa.eu/juris/liste.jsf?num=C-441/14 (last accessed 08 May 2020).

[2] Case C-399/09, Marie Landtová v. Česká správa socialního zabezpečení, ECLI:EU:C:2011:415, available at: http://curia.europa.eu/juris/liste.jsf?num=C-399/09 (last accessed 08 May.2020).

[3] BVerfG, Judgment of the Second Senate of 05 May 2020 – 2 BvR 859/15, Paras. 1-237, available at: www.bverfg.de/e/rs20200505_2bvr085915en.html (last accessed 12 May.2020).

[4] Case C-493/17, Weiss and Others, ECLI:EU:C:2018:1000, available at: http://curia.europa.eu/juris/liste.jsf?num=C-493/17 (last accessed 13 May 2020).

[5] See, for example: ‘EU Must Act Against German Court Threat’, The Financial Times, available at: www.ft.com/content/71abe7a6-9456-11ea-abcd-371e24b679ed (last accessed 12 June 2020) and T. Marzal, ‘Is the BVerfG PSPP Decision “Simply Not Comprehensible”? A Critique of the Judgment’s Reasoning on Proportionality, Verfassungsblog on Matters Constitutional’, 2020, available at: https://verfassungsblog.de/is-the-bverfg-pspp-decision-simply-not-comprehensible/ (last accessed 12 June 2020).

[6] See K. Alter, ‘Who are the “Masters of the Treaty”?: European Governments and the European Court of Justice’, International Organization, Vol. 52, No. 1, 1998, p. 121 and A. Dyevre, ‘Uncertainty and International Adjudication’, Leiden Journal of International Law, Vol. 32, 2019, p. 131.

[7] I. Manners, ‘Normative Power Europe: A Contradiction in Terms’, Journal of Common Market Studies, Vol. 40, No. 2, 2002, pp. 244-245.

[8] T. Forsberg, ‘Normative Power Europe, Once Again: A Conceptual Analysis of an Ideal Type’, Journal of Common Market Studies, Vol. 49, No. 6, 2011, p. 1191.

[9] R. Dworkin, Law’s Empire, Cambridge, Massachusetts: Harvard University Press, 1986Law’s Empire, Cambridge, Massachusetts:Harvard University Press1986R. Dworkin, pp. 90-96.

[10] Joined Cases C-293/12 and C-594/12, Digital Rights Ireland Ltd v. Minister for Communications, Marine and Natural Resources et al. and Kärntner Landesregierung et al., available at: http://curia.europa.eu/juris/document/document.jsf?docid=150642&doclang=EN (last accessed 14 May 2020).

[11] Case C-131/12, Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, available at: http://curia.europa.eu/juris/document/document.jsf?docid=152065&doclang=EN (last accessed 14 May 2020).

[12] O. Larsson, D. Naurin, M. Derlén & J. Lindholm, ‘Speaking Law to Power: The Strategic Use of Precedent of the Court of Justice of the European Union’, Comparative Political Studies, Vol. 50, No. 7, 2017, p. 880.

[13] Ibid., p. 881.

[14] See for example: M. Ambrose & J. Ausloos, ‘The Right to Be Forgotten Across the Pond’, Journal of Information Policy, Vol. 3, 2013, pp. 1-23, and Y. Padova, ‘Is the Right to be Forgotten a Regional, Universal or “Glocal” Right?’, International Data Privacy Law, Vol. 9, No. 1, 2019, p. 24.

[15] Interinstitutional File: 2016/0206 (NLE), Comprehensive Economic and Trade Agreement between Canada, of the one part, and the European Union and its Member States, of the other part. Protocol on the mutual acceptance of the results of conformity assessment.

[16] COM (2019) 495 final, Report from the Commission to the European Parliament and the Council on the third annual review of the functioning of the EU-U.S. Privacy Shield.

[17] Regulation (EEC) No 1408/71 of the Council of 14 June 1971 on the application of social security schemes to employed persons and their families moving within the Community.

[18] For an English summary, see J. Komarek, ‘Playing with Matches: The Czech Constitutional Court’s Ultra Vires Revolution, Verfassungsblog on Matters Constitutional’, 2012, available at: https://verfassungsblog.de/playing-matches-czech-constitutional-courts-ultra-vires-revolution/ (last accessed 15 May 2020).

[19] Regulation (EEC) No 1408/71 of the Council of 14 June 1971 on the application of social security schemes to employed persons and their families moving within the Community, Art. 6.

[20] Ibid., Ann. 3, Para. 9.

[21] Case C-399/09, Marie Landtová v. Česká správa socialního zabezpečení, Para. 49.

[22] Judgment of 31 January 2012, No. Pl. ÚS 5/12, Slovak Pensions XVII (“Failure to distinguish the legal relationships arising from the dissolution of a state with a uniform social security system from the legal relationships arising for social security from the free movement of persons in the European Communities, or the European Union, is a failure to respect European history, it is comparing things that are not comparable.”).

[23] Regulation (EEC) No 1408/71 of the Council of 14 June 1971 on the application of social security schemes to employed persons and their families moving within the Community, Ann. 3.

[24] Judgment of 8 March 2006, No. Pl. ÚS 50/04, Sugar Quota Case III, Para. 113, English translation available at: https://www.usoud.cz/en/decisions/2006-03-08-pl-us-50-04-sugar-quotas-iii (last accessed 15 December 2020).

[25] Z. Kühn, ‘The Czech Republic: From a Euro-Friendly Approach of the Constitutional Court to Proclaiming a Court of Justice Judgment Ultra Vires’, in A. Albi & S. Bardutzky (Eds.), National Constitutions in European and Global Governance: Democracy, Rights, the Rule of Law, The Hague, T.M.C. Asser Press, 2019, p. 803The Czech Republic: From a Euro-Friendly Approach of the Constitutional Court to Proclaiming a Court of Justice Judgment Ultra ViresNational Constitutions in European and Global Governance: Democracy, Rights, the Rule of LawThe HagueT.M.C. Asser Press2019803Z. KuhnA. AlbiS. Bardutzky.

[26] Ibid., p. 828.

[27] Case C-253/12, JS, ECLI:EU:C:2013:212, available at: http://curia.europa.eu/juris/liste.jsf?num=C-253/12 (last accessed 13 May 2020), Translation available at and quoted from: R. Zbiral, ‘Nuclear War between the Court of Justice and Czech Constitutional Court (hopefully) averted, Verfassungsblog on Matters Constitutional’, 2013, available at: https://verfassungsblog.de/nuclear-war-between-the-court-of-justice-and-czech-constitutional-court-hopefully-averted/ (last accessed 13 May 2020).

[28] Case C-441/14, Dansk Industri (DI) v. Estate of Karsten Eigil Rasmussen, Para. 6.

[29] Ibid., Para. 11.

[30] Ibid., Para. 20.

[31] Ibid., Paras. 43-44.

[32] S. Klinge, ‘Dialogue or Disobedience Between the European Court of Justice and the Danish Constitutional Court? The Danish Supreme Court Challenges the Mangold-Principle, EU Law Analysis’, 2016, available at: http://eulawanalysis.blogspot.com/2016/12/dialogue-or-disobedience-between.html (last accessed 15 May 2020).

[33] Case C-499/08, Ingeniørforeningen i Danmark v. Region Syddanmark, ECLI:EU:C:2010:600, available at: http://curia.europa.eu/juris/liste.jsf?language=en&num=C-499/08 (last accessed 14 May 2020).

[34] Klinge, 2016.

[35] Case C-493/17, Weiss et al., ECLI:EU:C:2018:1000, available at: http://curia.europa.eu/juris/liste.jsf?language=en&num=C-493/17 (last accessed 14 May 2020).

[36] Decision (EU) 2015/774 of the European Central Bank of 4 March 2015 on a secondary markets public sector asset purchase programme (ECB/2015/10), Recital, Para. 4.

[37] Decision (EU) 2016/702 of the European Central Bank of 18 April 2016 amending Decision (EU) 2015/774 on a secondary markets public sector asset purchase programme (ECB/2016/8).

[38] Decision (EU) 2017/100 of the European Central Bank of 11 January 2017 amending Decision (EU) 2015/774 on a secondary markets public sector asset purchase programme (ECB/2017/1).

[39] Decision (EU) 2019/1558 of the European Central Bank of 12 September 2019 amending Decision (EU) 2019/1311 on a third series of targeted longer-term refinancing operations (ECB/2019/28).

[40] Case C-493/17, Weiss et al., referred questions listed in Para. 16.

[41] Art. 296 TFEU, “Where the Treaties do not specify the type of act to be adopted, the institutions shall select it on a case-by-case basis, in compliance with the applicable procedures and with the principle of proportionality. Legal acts shall state the reasons on which they are based and shall refer to any proposals, initiatives, recommendations, requests or opinions required by the Treaties. When considering draft legislative acts, the European Parliament and the Council shall refrain from adopting acts not provided for by the relevant legislative procedure in the area in question.”

[42] Case C-493/17, Weiss et al., Para. 69.

[43] Ibid., Para. 31, in this respect the Court also emphasizes that “it is not required to go into every relevant point of fact and law” (judgments of 19 November 2013, Commission v. Council, C-63/12, EU:C:2013:752, Para. 98, and of 16 June 2015, Gauweiler et al., C-62/14, EU:C:2015:400, Para. 70).

[44] Ibid., Para. 46, “Consequently, in order to exert an influence on inflation rates, the ESCB necessarily has to adopt measures that have certain effects on the real economy, which might also be sought to different ends in the context of economic policy.”

[45] Ibid., Para. 81.

[46] BVerfG, Judgment of the Second Senate of 05 May 2020 – 2 BvR 859/15 – Para. 228.

[47] Ibid., Para. 101.

[48] Art. 5 (4) TEU, “4. Under the principle of proportionality, the content and form of Union action shall not exceed what is necessary to achieve the objectives of the Treaties. The institutions of the Union shall apply the principle of proportionality as laid down in the Protocol on the application of the principles of subsidiarity and proportionality.”

[49] BVerfG, Judgment of the Second Senate of 05 May 2020 – 2 BvR 859/15 – Para. 119.

[50] Ibid., Para. 135.

[51] Ibid., Paras. 149-151.

[52] Ibid., Para. 160.

[53] Ibid., Para. 173.

[54] See, for example: Marzal, 2020 and M. Maduro, ‘Some Preliminary Remarks on the PSPP Decision of the German Constitutional Court, Verfassungsblog on Matters Constitutional’, 2020, available at: https://verfassungsblog.de/some-preliminary-remarks-on-the-pspp-decision-of-the-german-constitutional-court/ (last accessed 15 May 2020).

[55] ‘EU Must Act Against German Court Threat’, 2020.

[56] Court of Justice of the European Union PRESS RELEASE No 58/20 Luxembourg, 8 May 2020, available at: https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-05/cp200058en.pdf (last accessed 16 May 2020).

[57] Statement by President Von der Leyen, 10 May 2020, Brussels, available at: https://ec.europa.eu/commission/presscorner/detail/en/STATEMENT_20_846 (last accessed 16 May 2020).

[58] German Judges Strike Back, Say ECB Isn’t Master of Universe, Bloomberg, available at: www.bloomberg.com/news/articles/2020-05-12/ecb-isn-t-master-of-the-universe-german-top-judge-says (last accessed 16 May 2020).

[59] Komarek, 2012.

[60] In Re Wünsche Handelsgesellschaft (22 October 1986) BVerfGE 73, 339, commonly referred to as ‘Solange II’, the BVfG established that the level of fundamental rights protection on the European level was comparable to that of the German Basic Law (Grundgesetz). Therefore, it will not conduct a review of the compatibility of European laws with the German Basic Law as long as the scope of protection granted by European law is comparable to that of the German Basic Law. It further implied that a judgement would only be declared ultra vires if the Constitutional Court itself forwarded it for preliminary reference.

[61] Joined Cases C-293/12 and C-594/12, Digital Rights Ireland Ltd v. Minister for Communications, Marine and Natural Resources and Others and Kärntner Landesregierung and Others, available at: http://curia.europa.eu/juris/liste.jsf?language=en&num=C-293/12 (last accessed 15 May 2020).

[62] Council Directive 2006/24/EC, Retention of Data Generated or Processed in Connection with the Provision of Publicly Available Electronic Communications Services or of Public Communications Networks, 2006 O.J. (L 105) 54, Art. 1.

[63] Ibid., Paras. 34 and 38.

[64] Ibid., Para. 56, “the Directive requires the retention of all traffic data concerning fixed telephony, mobile telephony, Internet access, Internet e-mail and Internet telephony.”

[65] Ibid., Para. 60, “Directive 2006/24 also fails to lay down any objective criterion by which to determine the limits of the access of the competent national authorities to the data and their subsequent use for the purposes of prevention, detection or criminal prosecutions concerning offences that, in view of the extent and seriousness of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter, may be considered to be sufficiently serious to justify such an interference.”

[66] Ibid., Para. 63, “Article 6 of Directive 2006/24 requires that those data be retained for a period of at least six months, without any distinction being made between the categories of data set out in Article 5 of that Directive on the basis of their possible usefulness for the purposes of the objective pursued.”

[67] Bundesverfassungsgericht [BVerfG] (Constitutional Court) 2 March 2010, 125 BVerfGE 261.

[68] F. Fabbrini, ‘Human Rights in the Digital Age: The European Court of Justice Ruling in the Data Retention Case and Its Lessons for Privacy and Surveillance in the United States’, Harvard Human Rights Journal, Vol. 28, 2014, p. 74.

[69] Case C-203/15, Tele2 Sverige AB v. Post- och telestyrelsen and Secretary of State for the Home Department v. Tom Watson and Others, ECLI:EU:C:2016:970, available at: http://curia.europa.eu/juris/liste.jsf?num=C-203/15 (last accessed 16 May 2020).

[70] Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector.

[71] Case C-203/15, Tele2 Sverige AB v. Post- och telestyrelsen and Secretary of State for the Home Department v. Tom Watson et al.

[72] Ibid., Para. 98.

[73] Ibid., Para. 122.

[74] Case C-362/14, Maximillian Schrems v. Data Protection Commissioner, ECLI:EU:C:2015:650, available at: http://curia.europa.eu/juris/liste.jsf?num=C-362/14 (last accessed 16 May 2020).

[75] Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce, L 215/7, Ann. 1.

[76] Ibid., Art. 1.

[77] Case C-362/14, Maximillian Schrems v. Data Protection Commissioner, Para. 36 (first question abbreviated by the author).

[78] Ibid., Paras. 103-104.

[79] Ibid., Paras. 97 and 106.

[80] Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield.

[81] Case C-311/17, Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems,ECLI:EU:C:2020:559, available at: http://curia.europa.eu/juris/liste.jsf?num=C-311/18 (last accessed 15 December 2020)

[82] Case C-507/17, Google LLC v. Commission nationale de l’informatique et des libertés (CNIL), ECLI:EU:C:2019:772, available at: http://curia.europa.eu/juris/liste.jsf?num=C-507/17 (last accessed 16 May 2020) summarized from Para. 49.

[83] Ibid., at Para. 54.

[84] Ibid., at Para. 55.

[85] Ibid., at Para. 59.

[86] In Para. 62, the Court finds that, “it is in no way apparent from the wording of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 or Article 17 of Regulation 2016/679 that the EU legislature would, for the purposes of ensuring that the objective referred to in Para. 54 above is met, have chosen to confer a scope on the rights enshrined in those provisions which would go beyond the territory of the Member states”.

[87] Ibid., at Para. 64.

[88] Opinion of AG Szpunar, Case C-507/17, Google LLC v. Commission nationale de l’informatique et des libertés (CNIL), ECLI:EU:C:2019:15.

[89] M.-P. Granger & K. Irion, “The Court of Justice and the Data Retention Directive in Digital Rights Ireland: Telling Off the EU Legislator and Teaching a Lesson in Privacy and Data Protection”, European Law Review, Vol. 39, No. 4, 2014, pp. 835-850.

[90] Regulation 2016/679 definitions Para. 4. As stated in the TEU Art. 5 (4), “Under the principle of proportionality, the content and form of Union action shall not exceed what is necessary to achieve the objectives of the Treaties”.

[91] Ibid., definitions Para. 16.

[92] Ibid., definitions Para. 19.

[93] Directive 2016/680, definitions Para. 26.

[94] Ibid., Para. 35.

[95] COM (2017) 10 final, Proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications).

[96] Regarding possible exemptions for national security, in the explanation at Para. 26, “this Regulation should not affect the ability of Member States to carry out lawful interception of electronic communications or take other measures, if necessary and proportionate to safeguard the public interests mentioned above, in accordance with the Charter of Fundamental Rights of the European Union and the European Convention for the Protection of Human Rights and Fundamental Freedoms, as interpreted by the Court of Justice of the European Union and of the European Court of Human Rights.”

[97] Interinstitutional File: 2017/0003(COD) Proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications) – Progress report.

[98] Specifically, the rights to data protection, right to erasure and right to be forgotten are only listed in the GDPR, not the ECHR of the CoE.

[99] Council of Europe, Convention for the Protection of Human Rights and Fundamental Freedoms (4 November 1950), ETS No.005, Art. 8 (1).

[100] Ibid., Art. 8 (2).

[101] Chart of signatures and ratifications of Treaty 223, available at: www.coe.int/en/web/conventions/full-list/-/conventions/treaty/223/signatures?p_auth=LDT5nAh5 (last accessed 19 June 2020).

[102] Case of Big Brother Watch and Others v. The United Kingdom (nos. 58170/13, 62322/14 and 24960/15) 13 September 2018, available at: http://hudoc.echr.coe.int/eng?i=001-186048 (last accessed 18 June 2020).

[103] Ibid., Paras. 10 and 12, “As communications flow across the targeted bearers, the system compares the traffic against a list of ‘simple selectors’. These are specific identifiers (e.g. an email address) relating to a known target.”

[104] Regulation of Investigatory Powers Act 2000, available at: www.legislation.gov.uk/ukpga/2000/23/contents (last accessed 18 June 2020), Section 5 (1).

[105] Ibid., Section 81(2)(b).

[106] Weber and Saravia v. Germany (no. 54934/00) 29 June 2006, available at: http://hudoc.echr.coe.int/eng?i=001-76586 (last accessed 17 June 2020).

[107] Art. 260 TFEU, “1. If the Court of Justice of the European Union finds that a Member State has failed to fulfil an obligation under the Treaties, the State shall be required to take the necessary measures to comply with the judgment of the Court. 2. If the Commission considers that the Member State concerned has not taken the necessary measures to comply with the judgment of the Court, it may bring the case before the Court after giving that State the opportunity to submit its observations. It shall specify the amount of the lump sum or penalty payment to be paid by the Member State concerned which it considers appropriate in the circumstances.”

[108] Case C-62/14, Peter Gauweiler et al. v. Deutscher Bundestag, ECLI:EU:C:2015:400, available at: http://curia.europa.eu/juris/liste.jsf?num=C-62/14 (last accessed 16 May 2020).

[109] ‘The EU Is Entering a Constitutional Crisis’, Bloomberg, available at: www.bloomberg.com/opinion/articles/2020-05-11/german-court-pushes-eu-into-a-constitutional-crisis (last accessed 16 May 2020).

[110] Larsson et al., 2017, p. 887.