SPECIAL COLLECTION OF THE CASE LAW ON FREEDOM OF EXPRESSION that EU Law precluded national legislation requiring providers of electronic communications services to carry out general and indiscriminate transmission of traffic data and location data to security and intelligence agencies for the purpose of safeguarding national security. In joined applications by the United Kingdom, France and Belgium, the CJEU sought to determine the lawfulness of national legislation which laid down an obligation for providers of electronic communications services to forward users’ traffic data and location data to a public authority, or to retain such data in a general or indiscriminate way on crime prevention and national security grounds. The Court found that such obligation not only interfered with the protection of privacy and personal data, but was also incompatible with the freedom of expression principle under Article 11 of the EU Charter. The Court, however, laid down that where such a retention is warranted in cases where there is a serious threat to national or public security, the nature of the measure must be “strictly” proportionate to its intended purpose. In addition, the Court also clarified the scope of powers conferred on Member States by the Privacy and Electronic Communications Directive with respect to retention of data for the aforementioned purposes. More info here. iv. Data protection and internet platforms CJEU: In the case of Data Protection Commissioner v. Facebook (Schrems II) (2020), the Grand Chamber of the Court of Justice of the European Union (CJEU) invalidated the EU-US Privacy Shield and upheld the validity of the standard data protection clauses (an EU-approved standard contract to protect data transfers between EU and non-EU countries). In 2013, Schrems had brought a complaint before the Irish Data ProThe Court noted that tection Commission against Facebook Ireland Ltd. claiming mass surveillance of the data of EU citizens companies and regulators are by US authorities. In a judgment delivered by CJEU required to conduct case-byin 2015, the Court invalidated the safe harbor privacase analyses to determine cy principles, subsequent to which Facebook used another legal tool to transfer data outside of the EU, whether foreign protections called “standard contractual clauses” (SCCs). By an concerning government amended complaint dated December 1, 2015, Schrems access to data transferred challenged the validity of Facebook’s use of SCCs to transfer EU citizens’ data to the US, arguing that the meet EU standards use of such data for mass surveillance violated Art 7, 8 and 47 of the Charter of Fundamental Rights of the European Union (CFR). While declaring the EU-US Privacy Shield void for lack of ‘adequate protection’ under EU law, the Court held that CJEU’s assessment of U.S. law must be taken into account for any transfers of personal data to the U.S., irrespective of the transfer mechanism used. Even though the validity of standard data protection clauses was upheld by CJEU, the Court noted that companies and regulators are required to conduct case-by-case analyses to determine whether foreign protections concerning government access to data transferred meet EU standards. In this decision the Court does not analyze the right to freedom of expression when considering the reasons for its ruling. Nonetheless, the scope of the protection of privacy in this particular case 14