European Union Regulation of Transatlantic Data Transfers and Online Surveillance

Extract

1. INTRODUCTION

In April 2014, the Court of Justice of the European Union (CJEU or ‘the Court’) ruled in Digital Rights Ireland¹ that the mass metadata retention surveillance established in the European Union (EU) by the Data Retention Directive² interfered disproportionately with the fundamental rights to privacy and data protection enshrined in Articles 7 and 8 of the European Union Charter of Fundamental Rights (EUCFR). The judgment was hailed as a victory for fundamental rights over surveillance in Europe.³ In October 2015, a further major jurisprudential development occurred in the EU: following the Snowden revelations that the United States of America (US) has been operating a secret mass electronic surveillance programme that grants it access to Internet data, such as email, chat, videos, photos and file transfers held by leading Internet companies, including Facebook, Google, Microsoft, Yahoo, Skype, Apple and Youtube, the CJEU in its judgment in Schrems⁴ invalidated the European Commission’s (‘the Commission') decision finding that the US ensured an adequate level of protection for the transfer of personal data under the Safe Harbour privacy principles. It did so, on the basis that the authorities of the US were able to access the personal data transferred from EU Member States and process them beyond what was strictly necessary and proportionate to the protection of national security.