Case C-817/19, Ligue des Droits Humains v. Council of Ministers (C.J.E.U.)

Introduction

On June 21, 2022, the Court of Justice of the European Union (CJEU), sitting as a Grand Chamber, rendered its decision in the preliminary ruling procedure C-817/19, Ligue des Droits Humains v. Council of Ministers.¹ In its ruling, the CJEU held that the surveillance regime established by the Passenger Name Record Directive 2016/681² (PNR Directive) was compatible with the Charter of Fundamental Rights of the European Union (CFREU/EU Charter).³ Nevertheless, the CJEU strictly circumscribed the Directive's transposition within EU member states' domestic laws. While restricting permissible interpretations of the PNR Directive's provisions and imposing strict limitations on its scope to ensure its conformity with the EU Charter, for the first time the Court upheld an instrument of indiscriminate surveillance as compatible with EU primary law. This represents a significant development in the CJEU's case law on privacy rights, which is likely to affect the negotiation and development of future PNR agreements with third countries, as well as the development of the ePrivacy Regulation, discussions surrounding the regulation of AI, and negotiations for international instruments aiming to address serious crimes. Further, the ruling confirms the CJEU's increasing convergence with the European Court of Human Rights' (ECtHR) case law on the matter, thus inscribing national security as a legitimate exception to the general prohibition of indiscriminate bulk data collection and retention in Europe.

Background

Since its original 2014 pronouncement in Digital Rights Ireland,⁴ the CJEU has grappled with a number of instruments and domestic laws concerning indiscriminate data collection and retention. Originally extremely protective of privacy rights, the Court has slowly evolved towards a stance more deferential to states' national security concerns.

In Digital Rights Ireland, the CJEU rejected a model of mass surveillance based on the general and indiscriminate retention of communication metadata as incompatible with the EU Charter. As a result, it annulled the Data Retention Directive.⁵ In this landmark judgment, the CJEU thus rejected the possibility that indiscriminate data retention could constitute a proportionate interference with the right to respect for private and family life (Article 7 CFREU) and to the protection of personal data (Article 8 CFREU). The Court's principled opposition to mass surveillance was reaffirmed in further cases concerning EU member...