Professor Nóra Ní Loideáin’s book is a deeply researched and meticulously written analysis of the issue of ‘the retention and surveillance of digital communications’, which she persuasively contends is ‘one of the most dynamic and technically complex areas of privacy and data protection law’ (p 1). This issue has been at the heart of important decisions by both the European Court of Human Rights (ECtHR, Strasbourg Court) and the Court of Justice of the European Union (CJEU, Luxembourg Court).
Chapter One discusses the explosion of communications data in recent years, as smartphones and now artificial intelligence result in the collection of ever-increasing types and varieties of personal data about each individual. The production and retention of this data means that the government may use its coercive powers to collect data and violate human rights, in what has been called ‘the Golden Age of Surveillance’ (p 44).
The heart of the book, Chapters Two to Seven, examines how the Strasbourg and Luxembourg Courts have addressed the challenge of ever-increasing communications data. To simplify the subtle legal analysis, Ní Loideáin makes four crucial claims. First, the rapid expansion of communications data means that there is a critical need for effective restraints on secret government surveillance in order to protect fundamental rights and ultimately democracy. Second, the ECtHR for many years was a praiseworthy pioneer in explaining how Article 8 of the European Convention of Human Rights (ECHR) requires detailed limits on governmental powers of secret surveillance.
Third, the ECtHR went astray in 2021, in its cases of Big Brother Watch v United Kingdom and Centrum för Rättvisa v Sweden. Although the Strasbourg Court continued to apply its ‘old-fashioned’ safeguards from earlier communications data cases (p 49), it became too lax in addressing new threats from secret surveillance. Among other doctrinal critiques, Ní Loideáin states that the Court provided too great a ‘margin of appreciation’ for governments in justifying surveillance and intrusion into the private lives of individuals (pp 82–84).
Fourth, the book argues that the CJEU has laudably stepped into the gap in protection left by the Strasbourg Court. Chapter Five examines ‘the seismic shift in the approach of the CJEU and its rights-based scrutiny of data retention systems following the Snowden revelations and the elevation of the EU Charter to its legally binding status under EU law’ (p 283). Cases including Digital Rights Ireland (2014) set limits with respect to data retention requirements justified by serious crimes. In 2020, in Quadrature du Net, the Court added that the fact that a national data retention measure was taken for national security purposes ‘cannot render EU law inapplicable’ (p 250). The author concludes that ‘[t]his is a welcome development towards ensuring the effective mainstreaming of fundamental rights across EU lawmaking’ (p 277).
The internal logic of the book is clear: fundamental rights are pervasively and increasingly at risk due to the expansion of the types of communications data and the sensitivity of the information that they reveal about individuals. Therefore, the CJEU has correctly constrained governments from secret surveillance under the protections in the Charter of Fundamental Rights of the European Union (EU). Writing as a United States law professor who has long studied European data protection law, the reviewer agrees with Ní Loideáin on the risks of secret government surveillance, but notes the reviewer’s own lack of good criteria for assessing the legal correctness of the CJEU’s data retention decisions.
However, concerns exist in relation to the CJEU’s conclusion in Quadrature du Net that only temporary retention of communications data can be justified by national security and that such measures must be limited in time. At the time of writing in early 2026, the Baltic States and other EU Member States who border Russia are facing what almost any observer would conclude is a long-running national security threat from Russia. In light of the Russian invasions of Ukraine, and hostile Russian acts such as drone incursions into the EU, these risks to national security are not ‘limited in time’. Even if active hostilities cease in Russia’s most recent invasion of Ukraine, which began approximately four years ago, the European States bordering Russia will continue to face substantial threats from an expansionist Russia. The CJEU’s insistence on temporary retention measures is a bad fit with this long-term threat. Perhaps Ní Loideáin and other fundamental rights scholars could articulate in more detail how to address such national security risks that are not meaningfully limited in time.
Going beyond the strict scope of this book, perhaps thoughtful scholars such as Ní Loideáin could help policy-makers, the reading public and the courts to consider how this area of jurisprudence might respond to the disruptions prompted by President Trump’s Realpolitik and ‘America First’ foreign policy. The fundamental rights jurisprudence addressed in this book developed during what has been called the ‘Long Peace’ since the Second World War. As of early 2026, President Trump has recently seized the head of State of Venezuela and called for long-time North Atlantic Treaty Organization ally Denmark to relinquish control of Greenland. Then he began military action against Iran, with scant reference to international law justifications. These developments have prompted discussion of the current status of the post-Second World War international rules about territorial integrity. How, if at all, should fundamental rights jurisprudence adjust to such changed conditions? What might scholars in this tradition contribute to discussion of national security and fundamental rights, if Europe indeed faces changed national security realities?
Such requests for future work should not detract from Ní Loideáin’s accomplishments in this book. The book makes its point that data retention poses potentially grave risks to fundamental rights. Technology has changed, and this book helps us to contemplate how European law should change as well.
