An unstoppable force and an immoveable object? EU data protection law and national security

[Extract]
The Grand Chamber of the Court of Justice of the European Union (EU) (CJEU/Luxembourg Court), the EU’s highest court, is gaining a reputation for its more purposive and expansive interpretation and application of EU data protection law. This is particularly so in relation to the right to data protection, as guaranteed by Article 8 of the EU Charter of Fundamental Rights (EU CFR) which became part of EU law in 2009 following the entering into force of the Lisbon Treaty [Treaty on the Functioning of the EU (TFEU)].

In addition to Article 8 EU CFR, another important reform of EU data protection law in 2009 was Article 16 TFEU which provides an explicit legal basis for data protection legislation. Consequently, this relatively new legal framework (especially Article 8 EU CFR) has played an instrumental role in a succession of landmark judgments concerning the requirements and minimum safeguards that must be applied by EU Member States when personal data is processed for the purposes of law enforcement and public security, or even national security with respect to third countries (non-EU states). One such new requirement is the need to provide that personal data is retained in the EU in order to ensure that it is subject to the independent supervision of EU data protection authorities. In its 2014 judgment of Digital Rights Ireland, the CJEU determined that this is ‘an essential component’ for the protection of individuals under EU data protection law.