Mass Surveillance of Personal Data by EU Member States and its Compatibility with EU Law. CEPS Liberty and Security in Europe No. 61, 6 November 2013

In the wake of the disclosures surrounding PRISM and other US surveillance programmes, this paper assesses the large-scale surveillance practices by a selection of EU member states: the UK, Sweden, France, Germany and the Netherlands. Given the large-scale nature of these practices, which represent a reconfiguration of traditional intelligence gathering, the paper contends that an analysis of European surveillance programmes cannot be reduced to a question of the balance between data protection versus national security, but has to be framed in terms of collective freedoms and democracy. It finds that four of the five EU member states selected for in-depth examination are engaging in some form of large-scale interception and surveillance of communication data, and identifies parallels and discrepancies between these programmes and the NSA-run operations. The paper argues that these programmes do not stand outside the realm of EU intervention but can be analysed from an EU law perspective via i) an understanding of national security in a democratic rule of law framework where fundamental human rights and judicial oversight constitute key norms; ii) the risks posed to the internal security of the Union as a whole as well as the privacy of EU citizens as data owners and iii) the potential spillover into the activities and responsibilities of EU agencies. The paper then presents a set of policy recommendations to the European Parliament.

Who will monitor the spies? CEPS Commentary, 8 January 2014

A majority of national governments across the EU have long tried to cordon off their practices of mass interception of communications data and cyber-hacking of foreign companies and diplomats from supranational scrutiny by the EU institutions and courts, arguing that they remain within the remit of their ‘exclusive competence’ on grounds of national security. In light of the revelations that some EU member states (namely the UK, France, Germany and Sweden) are running their own secret interception programmes, however, the question of whether the EU can and should intervene becomes more pressing. This commentary, by a team of JHA specialists at CEPS, offers four important legal reasons why the covert surveillance programmes of member states should not be regarded as falling outside the scope of EU intervention.