Towards a European Court of Fundamental Rights

With its judgments on bulk data retention issued at the beginning of this month, the European Court of Justice (ECJ) has entitled itself to examine virtually all surveillance measures in the digital sphere. In doing so, it has once more clarified its positioning as the decisive Fundamental Rights Court in Europe. In the midst of the ultra vires-storm caused by the PSPP-judgement of the Bundesverfassungsgericht – and questions arising with regard to German Legal Hegemony in Europe – a true shift of power to the ECJ can be spotted which is, surprisingly, supported by the national constitutional courts.

European Union Law and the “National Security” Exception

Art. 4 (2) TEU emphasizes that “national security remains the sole responsibility of each Member State”. Therefore, one might conclude that these measures are only to be reviewed by national constitutional courts, and in accordance with European Court of Human Rights’ (ECtHR) interpretation of the corresponding human rights. Recently, such assumption has led to harsh criticism and the accusation of hypocrisy with regard to the ECJ’s Schrems II-decision, invalidating the EU-US-Privacy Shield (and thereby the legal basis for most of the data transfer to the US): While the ECJ reviewed the measures of US intelligence services thoroughly for assessing the adequacy of the level of data protection in the US, it would not do the same regarding such measures by EU Member States. This seems to be, by the way, also the view of the governments of nine different EU Member States (United Kingdom, Czech Republic, Estonia, Ireland, France, Cyprus, Hungary, Poland and Sweden) submitting observations in the cases decided two weeks ago, contending that Art. 4 (2) TEU would be “deprived of any practical effect if it were necessary for measures in the field of national security to meet the requirements of Directive 2002/58 [the ePrivacy Directive]” (paras. 32-33).

Following this assessment, non-EU countries would have to provide a higher standard of data protection since measures by intelligence services of the Member States could only be examined by the national constitutional courts (if such courts exist at all, which is not the case in all EU Member States).

An Exception Not Applying to Individual Obligations

With its recent bulk data retention decisions the ECJ has responded to this: No Member State can escape its obligations under EU law by simply putting the “National Security”-stamp on legislation (para. 44). Instead, the Court differentiates based on the addressee of the national legislation in question. Since in case of bulk data retention it is the electronic communication services providers who are obliged to store the data, the ePrivacy Directive – and Union law in general, including the Charter – is applicable (para. 46). Interestingly enough, the ECJ stated in an obiter dictum that the General Data Protection Regulation (GDPR), which was in the case at hand not in question, would apply to any processing of data by individuals, even if done in the interest of the prevention and detection of criminal offences or threats to national security (para. 47). This assertion is the true bombshell of the judgment: It means that every measure by a Member State obliging individuals to cooperate and handing out personal data to government agencies falls within the scope of the CFR. Looking back at recent popular cases on governmental surveillance, they all fulfill this criterion: Big Brother Watch concerned the RIPA Framework which obliged Internet Service Providers to provide access to digital communications (same goes for the US-american PRISM program), in DE-CIX the central German Internet exchange point provider was fighting back its obligation to cooperate with the German Intelligence Service (BND). New developments such as keyword warrants are also based on accessing data stored by individuals. In consequence, the ECJ has entitled itself to examine virtually all surveillance measures in the digital sphere, since the vast majority of them are executed with the support of private entities. The exception of “national security” for the scope of application of Union law was thereby reduced to an absolute minimum.

The different interpretations of „minimum standard“

In combination with the particular understanding of Art. 53 CFR, this does not only lead to one more court examining national legislation in the light of fundamental rights (next to the corresponding national constitutional courts and the ECtHR) but makes the ECJ factually the one decisive Fundamental Rights Court in Europe. This is accomplished by the ECJ’s interpretation of the “twin norm” Art. 53 CFR. Its counterpart is Art. 53 of the European Convention on Human Rights (ECHR). Both provisions state that nothing in their corresponding legal texts shall be interpreted in a manner restricting human rights. In the jurisprudence of the ECtHR, this led to an understanding of the Convention accepting and promoting the diversity of constitutional orders within Europe – as long as they are not falling behind the minimum standard set by the Convention. This is different under the Charter: The principle of primacy of European Union law – the “essential feature of the EU legal order” – would be undermined if differing (higher) standards in the protection of fundamental rights would question the execution of Union law. Member States can (theoretically) still apply higher fundamental rights standard but this must not affect the Holy Trinity of Union law: Primacy, Unity and Effectiveness.

Therefore, the ECJ has developed a broad scope of application for the Charter while at the same time narrowing the margin for acceptable interpretations of fundamental rights protection in the Union substantially: In the end, it is its own interpretation which must prevail.

The reaction of the national constitutional courts

One might expect the national constitutional courts to resist such development. Ultimately, the question is about who has “the final say”. The same issue – on the surface – which led to the PSPP-judgment of the Bundesverfassungsgericht this May. However, one can observe quite the opposite. Several national constitutional courts, inter alia the Austrian Verfassungsgerichtshof, the Belgian Constitutional Court, the French Conseil Constitutionnel, the Italien Corte costituzionale and lastly the very same Bundesverfassungsgericht in Right to be Forgotten I & II issued in November 2019, have adopted the European fundamental rights – in their interpretation by the ECJ – as standard of review for their own proceedings.

How is this compatible with PSPP and other ultra vires-judgements (and threats) by national constitutional courts? There is one important difference: PSPP was never about fundamental rights protection (even though the Bundesverfassungsgericht construed a fundamental right to democracy), it was about democratic legitimacy and the key right of parliaments, the budgetary law. In fact, it was from the outset the national courts (inter alia long time ago with Solange I) who encouraged the ECJ take a more active role in the protection of fundamental rights. Even the intention of PSPP was – according to case rapporteur Huber and then president of the court Voßkuhle – not to weaken the Court but to cheer it up to take a more active role, to intensify its review.

The One Court for Digital Fundamental Rights

On the one hand an understanding of the scope of application of the Charter of Fundamental Rights which effectively allows the review of nearly all (mass) surveillance activities by its Member States, on the other hand the good old principle of primacy of Union law, applied also in the field of interpreting fundamental rights, the ECJ has clearly expressed its will to protect to rights of Union citizens in the digital sphere – no matter who is infringing them. It becomes the one court in the European Union whose interpretation of fundamental rights, at least in the digital sphere, is pivotal. This is more than welcome in a Europe with one common digital space.