Following the decision of Europe’s top court, the Court of Justice of the European Union (“CJEU”) to strike down the Data Protection Directive (the “Directive”) in 2014, national governments have been in flux as to the status of legislation they introduced to transpose the Directive. An Opinion from the European Parliament’s Legal Services, which has been obtained and published online by various privacy advocacy groups, sets out specific guidance that the EU must follow if it intends to legislate again in this area.

Lessons

Some of the standout commentary from the Opinion states that:

  1. Any national data retention measures must now be examined to see whether they comply with the principles of law set out in the CJEU’s decision. At page 26 of the Opinion, member states are warned that they, ‘run an ever higher risk than before of having their legislation annulled by the national courts, in a similar way to what has already happened in a number of Member States’.
  2. The CJEU’s ruling opens the possibility of other methods of surveillance carried out by national governments being reviewed by the European courts. Furthermore, national governments are no longer obliged to retain data in the electronic communications sphere and may repeal existing statutes which transposed the terms of the Directive (at pages 26 and 27 of the Opinion).
  3. EU legislation and any international agreements governing the transfer of personal data must comply with the principles set down in the CJEU’s judgment. The Opinion references the fact that the CJEU stated the EU legislature’s discretion is ‘reduced’ in the sphere of ‘general programmes of surveillance’ (at pages 13 and 26 of the Opinion).
  4. The CJEU’s decision has incorporated additional protections from the European Convention on Human Rights (“ECHR”) into EU law generally, not just in the sphere of data protection. The CJEU’s judgment referred to specific case law of the European Court of Human Rights on the issue of ‘general programmes of surveillance’. By its judgment, the CJEU effectively incorporated these principles into EU law. The Opinion, at page 25, states, ‘in view of the fact that the cited case-law of the [ECHR] itself relates to a diverse category of surveillance measures (which is not at all limited to data retention issues), it is to be expected that the [CJEU] will, in future, also apply the same reasoning when assessing the validity, under the Charter, of other EU legislative acts in this same field of “general programmes of surveillance”’.

Going Forward

It remains to be seen if there is sufficient political appetite in Brussels to revive the Directive in any form. This leaked Opinion will give EU lawmakers food for thought and underscores the interpretation that the CJEU’s decision to strike down the Directive will have repercussions that will be felt for many years in the future by policy makers and national governments.