INTRODUCTION

The Court of Justice of the European Union (CJEU) issued two landmark decisions in April and May 2014, effectively applying Article 7 – the right to private life and Article 8 – the right to personal data protection, provided for in the Charter of Fundamental Rights of the European Union (the Charter), in order to protect the fundamental rights of the person in two different dimensions of the Surveillance Society. The first dimension opposes the individual and the state; the second one opposes the individual and private bodies. By doing so, the Court established itself as a prominent actor in the protection of fundamental rights in the digital age, not only in the EU, but also on the global stage.

In the first decision, Digital Rights Ireland,2 the Court annulled Directive 2006/24/EC3 – the “Data Retention Directive”, in its entirety, arguing that its provisions run counter to both Article 7 and Article 8 of the Charter. The Data Retention Directive enshrined an obligation for telecom service providers to retain traffic data of all their clients for a period of minimum 6 months and maximum 2 years, depending on the national laws transposing the directive. While the Court found that this operation does not touch on the essence of the right to private life and the right to personal data protection, and it genuinely satisfies an objective of general interest (fi ght against serious crime), it is not proportionate to the purposes it pursues. Among other things, the Court observed that the directive “entails an interference with the fundamental rights of practically the entire European population” and took into account the “general absence of limits” from its provisions.

In the second decision, Google v. Spain, the Court interpreted the provisions of Directive 95/46/EC – the “Data Protection Directive”, and Article 8 of the Charter in the sense that EU data protection law is applicable ratione personae to United States-based company Google Inc., due to the “inextricably link” with its subsidiary Google Spain, and to the fact that it meets the criteria to be considered a “data controller”.