Since 2017, individual EU Member States have used spyware surveillance software to evade the privacy rights of individual citizens. Without citizens’ knowledge, Member States access individuals’ tracking data, messages, and phone calls. While no legal challenges have emerged from individual citizens against states, the Court of Justice of the European Union’s current data privacy jurisprudence is woefully unprepared to hold states accountable for what appear to be the plain security rights of individual citizens.
This paper seeks to define the current state of the Court of Justice of the European Union’s current jurisprudence and offer two critiques to its jurisprudence. First, this paper argues that the lack of a substantive definition of “national security” allows states to invoke the term to circumvent the European Union’s privacy requirements. Secondly, this paper argues that the Court of Justice of the European Union should replace the “independence” test when assessing reviewing courts for the “established by law” test. Doing so, this paper argues, it would more meaningfully constrain Member States from violating individual citizen’s privacy rights with a perfunctory referral to “national security.”
Finally, this paper briefly analyses current proposals made by the European Parliament’s Task Force and considers why those proposals would not be as effective as the European Parliament suggests they might be.