A Struggle for Competence: National Security, Surveillance and the Scope of EU Law at the Court of Justice of European Union

Abstract In Privacy International and Quadrature Du Net , the Grand Chamber of the CJEU ruled that the e‐Privacy Directive generally prevents bulk retention and transmission of traffic and location data, unless Member States can prove serious threats to national security. In such cases, bulk data can be retained during a strictly necessary period, subject to review by a court or independent administrative body. The judgments will impact other data retention and sharing arrangements, such as the PNR, proposed e‐Privacy Regulation and e‐Evidence package, and adequacy decisions under GDPR, including for post‐Brexit UK. The rulings suggest the CJEU's significance in national security, which has been outside of European integration, but has become a ground for political struggle between EU institutions and Member States. While Privacy International unequivocally asserts CJEU's authority in national security and is a victory for data protection, Quadrature Du Net does not oppose indiscriminate data retention in principle and is an ambivalent response to political pressure.