Court of Justice of the European Union Judgement: Mass Surveillance Is Unlawful

Today the Grand Chamber of the Court of Justice of the European Union ruled that mass surveillance is in violation of the right to privacy and that a legal system that provides no legal redress against interference with someone's privacy falls short of EU human rights standards.

The Court was seized following a complaint initiated by Mr Schrems to the Irish Data Protection Commissioner about the transfer of his Facebook data from Ireland to the US under the now defunct “Safe Harbour” system.

Consumer organisations have welcomed the judgement as a vindication of the right to individuals for data protection.

Importantly, the Court, in annulling “Safe Harbour”, reconfirmed and clarified its jurisprudence on the right to privacy and data protection as enshrined in Articles 7 and 8 of the EU Charter of Fundamental Rights. In doing so, the Court's scrutiny focussed in particular on the powers of the surveillance agencies and the laws that underpin them.

The Court found the “Safe Harbour” system flawed because it could not protect access of personal data against national security requests by US public authorities. In fact the EU Commission decision 2000/520 establishing “Safe Harbour” does not even consider the issue of protection of privacy under the US surveillance laws. Nor does the 2000 Commission decision refer to the existence of effective legal protection against privacy interference originating from the US authorities.

In reaffirming that under Articles 7 and 8 of the EU Charter any interference with privacy needs to be based on clear and precise rules, and apply “only in so far as it is strictly necessary”, the Court found that “legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for privacy life”. This is among the most clear and authoritative judicial statements to date that mass surveillance violates the right to privacy.

Similarly, the Court found that legislation that do not give individuals the right to legal remedies in order to have access to their personal data or obtain rectification or erasure of such data is in violation of “the fundamental right to effective judicial protection”.

The debate on the scope and effect of this judgment is bound to continue and intensify. No doubt many will continue to criticise it as imposing undue restriction to the free flow of information and data. It will spur the EU and the US to come up with some solutions. However, any such solution needs to include a substantial reform of US surveillance laws and the introduction of the long overdue comprehensive data protection legislation.

But EU governments, including the UK and France, should not feel immune by the effect of today's decision. The Court's statement that mass surveillance legislation does not stand the strict test of legality, necessity and proportionality under human rights law should serve as an important signal that their laws and practice need reform too.