PhDSince nearly two decades threats to public security through events such as 9/11, the
Madrid (2004) and London (2005) bombings and more recently the Paris attacks
(2015) resulted in the adoption of a plethora of national and EU measures aiming at
fighting terrorism and serious crime. In addition, the Snowden revelations brought the
privacy and data protection implications of these public security measures into the
spotlight. In this highly contentious context, three EU data retention and access
measures have been introduced for the purpose of fighting serious crime and
terrorism: The Data Retention Directive (DRD), the EU-US PNR Agreement and the
EU-US SWIFT Agreement. All three regimes went through several revisions
(SWIFT, PNR) or have been annulled (DRD) exemplifying the difficulty of
determining how privacy and data protection ought to be protected in the context of
public security. The trigger for this research is to understand the underlying causes of
these difficulties by examining the problem from different angles.
The thesis applies the theory of ‘New Institutionalism’ (NI) which allows both
a political and legal analysis of privacy and data protection in the public security
context. According to NI, ‘institutions’ are defined as the operational framework in
which actors interact and they steer the behaviours of the latter in the policy-making
cycle. By focusing on the three data retention and access regimes, the aim of this
thesis is to examine how the EU ‘institutional framework’ shapes data protection and
privacy in regard to data retention and access measures in the public security context.
Answering this research question the thesis puts forward three main hypotheses: (i)
privacy and data protection in the Area of Freedom, Security and Justice (AFSJ) is an
institutional framework in transition where historic and new features determine how
Articles 7 and 8 of the Charter of Fundamental Rights of the European Union
(CFREU) are shaped; (ii) policy outcomes on Articles 7 and 8 CFREU are influenced
by actors’ strategic preferences pursued in the legislation-making process; and (iii)
privacy and data protection are framed by the evolution of the Court of Justice of the
European Union (CJEU) from a ‘legal basis arbiter’ to a political actor in its own right
as a result of the constitutional changes brought by the Lisbon Treaty