Despite many of the CJEU's rulings saying mass surveillance is banned in the EU, member states have ruthlessly exploited loopholes to collect and keep the data
Context & Ripple Effects
The EU's highest court has twice drawn the legal line: in [[a:1160949|October 2020 the CJEU ruled that member states cannot collect citizens' mass mobile and internet data]], extending a line of judgments that began with the European Court of Human Rights finding that aspects of the former UK regime's bulk data collection violated human rights law. Politico's reporting now documents what happened next: rather than dismantling programs, member states have worked through the rulings' loopholes to keep collecting and retaining the same data.
First-order effects
- Member states continue operating mass data-collection programs under national-security framings the CJEU rulings did not fully close off, meaning the court's bans exist on paper while retention persists in practice.
Second-order effects
- Enforcement falls to bodies like the EU data watchdog, which ordered Europol to delete an unlawfully obtained trove of roughly 4PB of personal data — signaling that where member-state compliance lags, EU institutions will pursue deletion orders case by case.
Third-order effects
- If the loophole pattern holds, EU data-protection law settles into a cycle of repeated court rulings followed by partial state compliance, with watchdogs and litigation — not the rulings themselves — becoming the real constraint on mass surveillance.
The trend: Europe's privacy architecture is converging on rulings-without-enforcement: courts define the bans on mass surveillance, while member states test how much they can retain before watchdogs force deletions.