The NSA Phone Call Database: The European Perspective

Professor Francesca Bignami of Duke Law School, guest blogging at Concurring Opinions, wonders "Had a European government, instead of the Bush administration, created the NSA’s call database, would that government be in violation of European privacy law?" She believes they would and goes on to explain why in a really interesting post covering the divergence in the US and EU approaches to regulating privacy since the 1970s.

Prof. Bignami follows this up with a very informative post about the ECJ decision invalidating the EU-US agreement on airline passenger data (PNR) transfers, one of the most useful facets of which is a nice explaination of the EU's constitutional structure.

"To explain the Court’s logic, I must get into some basic EU law. The European Union has a bizarre constitutional structure that comes out of the fact that it used to be an international organization, now is a quasi-federal polity. It has three “Pillars.” The First Pillar governs the regulation of the common market—things like the rules that apply when a plane takes off from Rome and lands in Munich. This is not an area that goes to the core of national sovereignty, and so the European Union (actually “European Community” when we’re talking about First Pillar) has acquired a lot of power in the First Pillar—and the Member States have lost a lot of power. In the PNR episode, the European institutions acted under the First Pillar: the Commission based its decision on the Data Protection Directive (a market-regulating, First Pillar law) and the Council based its decision on the Data Protection Directive, together with its more general First Pillar powers.

By contrast, the Second and the Third Pillars apply to matters that do go to the core of national sovereignty: defense and other types of foreign policy (Second Pillar) and fighting crime and protecting against internal security threats like terrorism (Third Pillar). The European Union has powers in these areas, but it is hamstrung in various ways by Member States anxious to preserve national sovereignty.

Since the PNR agreement involved private, commercial European air carriers, the Commission and the Council thought they could act under the First Pillar. But the Court of Justice disagreed—essentially the Court said that the European Union would have to act under the Third Pillar or not at all. Here I’m simplifying slightly."

Basically the ECJ said Commission and the Council chose the wrong rules - those dealing with markets (1st pillar) rather than those dealing with terrorism (3rd pillar) - to justify the agreement to give the US authorities the passenger data. Not surprisingly they chose the first pillar route because there were fewer procedural obstacles. Now if they are going to prolong the aggreement beyond the Court's deadline of September this year they'll have to choose an alternative route.