52. Article 7 of the Charter guarantees the right to respect for private life, while Article 8 expressly proclaims the right to the protection of personal data. Article 8(2) and (3) states that such data must be processed fairly for specific purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law, that everyone has the right of access to data which has been collected concerning him or her and the right to have it rectified, and that compliance with those rules is to be subject to control by an independent authority.

...

67. As the Court has already held, the requirement that compliance with EU rules on the protection of individuals with regard to the processing of personal data is subject to control by an independent authority derives also from the primary law of the European Union, in particular from Article 8(3) of the Charter and Article 16(2) TFEU. It has also observed that ‘[t]he establishment in Member States of independent supervisory authorities is thus an essential component of the protection of individuals with regard to the processing of personal data’.

...

72. I note, in this connection, that there is nothing to suggest that arrangements for the transfer of personal data to third countries are excluded from the substantive scope of Article 8(3) of the Charter, which enshrines at the highest level of the hierarchy of rules in EU law the importance of control by an independent authority of compliance with the rules on the protection of personal data.

...

79. The powers of the national supervisory authorities to investigate, with complete independence, complaints submitted to them under Article 28 of Directive 95/46 must be interpreted broadly, in accordance with Article 8(3) of the Charter. Those powers cannot therefore be limited by the powers which the EU legislature has conferred on the Commission under Article 25(6) of that directive to find that the level of protection ensured by a third country is adequate.

...

85. However, I consider that, in the light of the above-mentioned provisions of Directive 95/46 and the Charter, the mandatory effect of Decision 2000/520 is not such as to preclude any investigation by the Commissioner of complaints alleging that transfers of personal data to the United States within the framework of that decision do not afford the necessary guarantees of protection that are required by EU law. In other words, such a binding effect cannot require that every complaint of that type be rejected summarily, that is to say, immediately and without any examination of its merits.

...

98. The importance of that objective and the role which the Member States must play in attaining it mean that, when particular circumstances give rise to a serious doubt as to compliance with the fundamental rights guaranteed by the Charter where personal data is transferred to a third country, the Member States and therefore, within them, the national supervisory authorities cannot be absolutely bound by an adequacy decision adopted by the Commission.

99. The Court has already held that ‘the provisions of Directive 95/46, in so far as they govern the processing of personal data liable to infringe fundamental freedoms, in particular the right to privacy, must necessarily be interpreted in the light of fundamental rights, which, according to settled case-law, form an integral part of the general principles of law whose observance the Court ensures and which are now set out in the Charter’.

100. I would refer, moreover, to the case-law according to which ‘the Member States must not only interpret their national law in a manner consistent with EU law but also make sure they do not rely on an interpretation of an instrument of secondary legislation which would be in conflict with the fundamental rights protected by the European Union legal order or with the other general principles of EU law’.

101. The Court thus held in its judgment in N.S. and Others that ‘an application of Regulation [EC] No 343/2000 on the basis of the conclusive presumption that the asylum seeker’s fundamental rights will be observed in the Member State primarily responsible for his application is incompatible with the duty of the Member States to interpret and apply Regulation No 343/2003 in a manner consistent with fundamental rights’.

102. In that regard, the Court accepted, in the context of the status of the Member States as safe countries of origin in respect to each other for all legal and practical purposes in relation to asylum matters, that it must be assumed that the treatment of asylum seekers in all Member States complies with the requirements of the Charter, the Convention relating to the Status of Refugees, signed in Geneva on 28 July 1951, and the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950. However, the Court held that ‘[i]t is not … inconceivable that that system may, in practice, experience major operational problems in a given Member State, meaning that there is a substantial risk that asylum seekers may, when transferred to that Member State, be treated in a manner incompatible with their fundamental rights’.

103. Consequently, the Court held that ‘the Member States, including the national courts, may not transfer an asylum seeker to the “Member State responsible” within the meaning of Regulation No 343/2003 where they cannot be unaware that systemic deficiencies in the asylum procedure and in the reception conditions of asylum seekers in that Member State amount to substantial grounds for believing that the asylum seeker would face a real risk of being subjected to inhuman or degrading treatment within the meaning of Article 4 of the Charter’.

104. To my mind, the contribution to the case-law made by the judgment in N.S. and Others can be applied by extension to a situation such as that at issue in the main proceedings. Thus, an interpretation of secondary EU law based on an irrebuttable presumption that fundamental rights will be observed — whether by a Member State, by the Commission or by a third country — must be considered to be incompatible with the duty of the Member States to interpret and apply secondary EU law in a manner consistent with fundamental rights. Article 25(6) of Directive 95/46 therefore does not establish such an irrebuttable presumption that fundamental rights are observed as regards the Commission’s assessment of the adequacy of the level of protection offered by a third country. On the contrary, the presumption underlying that provision — that the transfer of data to a third country complies with fundamental rights — must be regarded as rebuttable. Consequently, that provision should not be interpreted as calling in question the guarantees laid down in, notably, Article 28(3) of Directive 95/46 and Article 8(3) of the Charter, relating to the protection of and compliance with the right to protection of personal data.

105. I therefore infer from that judgment that, where systemic deficiencies are found in the third country to which the personal data is transferred, the Member States must be able to take the measures necessary to safeguard the fundamental rights protected by Articles 7 and 8 of the Charter.

...

115. As the Belgian and Austrian Governments submitted, in essence, at the hearing, the emergency exit that Article 3(1)(b) of Decision 2000/520 represents is so narrow that it is difficult to put into practice. It imposes cumulative criteria and sets the bar too high. In the light of Article 8(3) of the Charter, it is not possible for the national supervisory authorities’ scope for manoeuvre in relation to the powers resulting from Article 28(3) of Directive 95/46 to be limited in such a way that they can no longer be exercised.

...

120. It follows from all of the foregoing that Article 28 of Directive 95/46, read in the light of Articles 7 and 8 of the Charter, must be interpreted as meaning that the existence of a decision adopted by the Commission on the basis of Article 25(6) of that directive does not have the effect of preventing a national supervisory authority from investigating a complaint alleging that a third country does not ensure an adequate level of protection of the personal data transferred and, where appropriate, from suspending the transfer of that data.

...

123. Furthermore, the referring court itself observes that the guarantee provided by Article 7 of the Charter and by the core values common to the constitutional traditions of the Member States would be compromised if the public authorities were allowed access to electronic communications on a casual and generalised basis without the need for objective justification based on considerations of national security or the prevention of crime specific to the individuals concerned and attended by appropriate and verifiable safeguards. The referring court thus indirectly casts doubts on the validity of Decision 2000/520.

...

170. It also follows from the case-law of the Court that the communication of the personal data collected to third parties, whether public or private, constitutes an interference with the right to respect for private life, ‘whatever the subsequent use of the information thus communicated’. Furthermore, in its judgment in Digital Rights Ireland and Others, (64) the Court confirmed that authorising the competent national authorities to access such data constitutes a further interference with that fundamental right. In addition, any form of processing of personal data is covered by Article 8 of the Charter and constitutes an interference with the right to the protection of such data. The access enjoyed by the United States intelligence services to the transferred data therefore also constitutes an interference with the fundamental right to protection of personal data guaranteed in Article 8 of the Charter, since such access constitutes a processing of that data.

...

177. In the light of the conditions thus laid down that must be satisfied in order for limitations on the exercise of the rights and freedoms protected by the Charter to be accepted, I find it extremely doubtful that the limitations at issue in the present case may be regarded as respecting the essence of Articles 7 and 8 of the Charter. The United States intelligence services’ access to the data transferred seems to extend to the content of the electronic communications, which would compromise the essence of the fundamental right to respect for privacy and the other rights enshrined in Article 7 of the Charter. Furthermore, since the broad wording of the limitations provided for in the fourth paragraph of Annex I to Decision 2000/520 potentially allows all the safe harbour principles to be disapplied, it could be considered that those limitations compromise the essence of the fundamental right to protection of personal data.

...

184. As regards, now, the first category of limits, provided for in point (a) in the fourth paragraph of Annex I to Decision 2000/520 on account of national security, public interest or law enforcement requirements, only the first objective seems to me to be sufficiently precise to be regarded as an objective of general interest recognised by the European Union within the meaning of Article 52(1) of the Charter.

...

187. As regards judicial review of compliance with those conditions, ‘where interferences with fundamental rights are at issue, the extent of the EU legislature’s discretion may prove to be limited, depending on a number of factors, including, in particular, the area concerned, the nature of the right at issue guaranteed by the Charter, the nature and seriousness of the interference and the object pursued by the interference’.

...

192. In carrying out its review, the Court also takes into account the fact that ‘the protection of personal data resulting from the explicit obligation laid down in Article 8(1) of the Charter is especially important for the right to respect for private life enshrined in Article 7 of the Charter’.

...

200. Such mass, indiscriminate surveillance is inherently disproportionate and constitutes an unwarranted interference with the rights guaranteed by Articles 7 and 8 of the Charter.

...

203. I observe, in that regard, that in its judgment in Digital Rights Ireland and Others (81) the Court stressed the importance of providing ‘clear and precise rules governing the extent of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter’. (82) Such an interference must, according to the Court, be ‘precisely circumscribed by provisions to ensure that it is actually limited to what is strictly necessary’. The Court also drew attention in that judgment to the need to make provision for ‘sufficient safeguards, as required by Article 8 of the Charter, to ensure effective protection of the [personal data] against the risk of abuse and against any unlawful access and use of that data’.

...

207. Neither the FTC nor the private dispute resolution bodies therefore have the power to monitor possible breaches of principles for the protection of personal data by public actors such as the United States security agencies. Such a power is, however, essential in order to guarantee in full the right to effective protection of that data. The Commission was therefore not entitled to find, in adopting Decision 2000/520 and maintaining it in force, that there would be adequate protection for all personal data transferred to the United States of the right granted by Article 8(3) of the Charter, that is to say, that an independent authority would effectively monitor compliance with the requirements for the protection and security of that data.

...

214. It follows from the foregoing that Decision 2000/520 does not lay down clear and precise rules governing the extent of the interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter. It must therefore be found that that decision and the way in which it is applied entail a wide-ranging and particularly serious interference with those fundamental rights, without that interference being precisely circumscribed by provisions to ensure that it is in fact limited to what is strictly necessary.

215. By adopting Decision 2000/520 and then maintaining it in force, the Commission therefore exceeded the limits imposed by compliance with the principle of proportionality in the light of Articles 7, 8 and 52(1) of the Charter. To that must be added the finding of an unwarranted interference with the right of citizens of the Union to an effective remedy as protected by Article 47 of the Charter.

...

223. The Commission has stated in its observations that ‘there is a substantial likelihood that adherence to the Safe Harbour Privacy Principles [has] been limited in a way that fails to comply with the strictly tailored national security exemption’. It observes, in that regard, that ‘[t]he revelations in question point to a level of surveillance of a massive and indiscriminate scale incompatible with the standard of necessity laid down in that exemption as well as, more generally, with the right to personal data protection as enshrined in Article 8 of the Charter’. The Commission itself has stated, moreover, that ‘[t]he reach of these surveillance programmes, combined with the unequal treatment of EU citizens, brings into question the level of protection afforded by the Safe Harbour arrangement’.

...

226. In addition, I consider that, faced with such findings, the Commission ought to have suspended the application of Decision 2000/520. The objective of protecting personal data pursued by Directive 95/46 and Article 8 of the Charter places obligations not only on the Member States but also on the EU institutions, as follows from Article 51(1) of the Charter.