Press release: Ruling by EU’s highest court finds that UK, French and Belgian mass surveillance regimes must respect privacy, even in the context of national security

By treating everyone as a suspect, the bulk data collection or retention regimes engage European fundamental rights to privacy, data protection, freedom of expression, as guaranteed respectively by Articles 7, 8, and 11 of the EU Charter of Fundamental Rights.

Caroline Wilson Palow, Legal Director of Privacy International, said:

"Today’s judgment reinforces the rule of law in the EU. In these turbulent times, it serves as a reminder that no government should be above the law. Democratic societies must place limits and controls on the surveillance powers of our police and intelligence agencies.

While the Police and intelligence agencies play a very important role in keeping us safe, they must do so in line with certain safeguards to prevent abuses of their very considerable power. They should focus on providing us with effective, targeted surveillance systems that protect both our security and our fundamental rights."

Hugo Roy, who represents Privacy International in the French case, said:
“This judgment is a landmark after nearly six years of actions in French courts to restore the right to privacy with respect to our electronic communications. We hope now that the French Conseil d’ État will finally apply European human rights law standards to the French State.”

Lori Roussey, chair of Data Rights, said:
“Now the French Conseil d’Etat must stop tiptoeing and will have to apply European human rights standards once and for all.”

Notes to Editors

• In the UK case (Case C-623/17), the underlying challenge was brought by PI before the Investigatory Powers Tribunal (IPT) on 8 June 2015.
• PI challenged the bulk acquisition and use of communications data by the Security and Intelligence Agencies (SIAs) (that is GCHQ, MI5 and MI6).
• As part of its case, PI claimed that the UK regime was unlawful under EU law. The UK government countered that the bulk communications data regime, as it related to national security, was outside the scope of the EU law.
• The IPT referred the case to the CJEU, asking the CJEU to decide, first, whether requiring an electronic communications network to turn over communications data in bulk to the SIAs falls within the scope of EU law; and second, if the answer to the first question is yes, what safeguards should apply to that bulk access to data?
• In the French case (joined Cases C-511/18 and C-512/18), La Quadrature du Net, the French Data Network, and the Fédération FDN (federation of non-profit Internet access providers) requested the annulment of French regulatory provisions, in relation to data retention (Decree No. 2006-358 of 24 March 2006) and in relation to the two French intelligence and international surveillance laws of 2015, which allow the indiscriminate retention of personal data, as well as realtime access to that data and other real time measures such as “black boxes” on providers’ networks.
• PI intervened, in February 2016, before the French highest administrative court (the Conseil d’État), along with the Center for Democracy and Technology, in support of the request of French organisations.
• In July 2018, the Conseil d’État referred the questions regarding France’s data retention legislation to the CJEU.
• The French case raised similar concerns as the UK case, with regard to whether EU law should apply and, if it does, what safeguards govern the French data retention and access regimes.
• The CJEU decided to hold a joint hearing to examine the above two cases arising from the UK and France as well as case C-520/18 (Ordre des barreaux francophones et germanophone and others) from Belgium.
• On 15 January 2020, the CJEU Advocate General issued his opinions on how the Court should rule. He suggested that the UK bulk data collection regime is incompatible with EU law. He similarly found the French data retention regime incompatible with EU law.

For more information: CJEU Bulk Challenge page case.