34.

As the referring court places particular emphasis in this case on the activities of the SIAs connected with national security, I would like to reproduce some of the points I made on this issue in my Opinion in Joined Cases C‑511/18 and C‑512/18, which is also delivered today: ‘77. National security … is addressed in two ways in Directive 2002/58. First, it is grounds for excluding (from the application of the directive) all activities of the Member States specifically “concerning” it. Secondly, it is grounds for imposing restrictions, which must be adopted by legislative measures, on the rights and obligations provided for in Directive 2002/58, that is, in connection with private or commercial activities falling outside the sphere of activities reserved to the State. 78. To what activities does Article 1(3) of Directive 2002/58 apply? In my opinion, the Conseil d’État (Council of State) itself provides a good example when it cites Articles L. 851-5 and L. 851-6 of the Internal Security Code, referring to “information collection techniques which are applied directly by the State but which do not regulate the activities of providers of electronic communications services by imposing specific obligations on them”. … 79. I believe that this is the key to determining the scope of the exclusion provided for in Article 1(3) of Directive 2002/58. The provisions of the directive will not apply to activities which are intended to safeguard national security and are undertaken by the public authorities themselves, without requiring the cooperation of private individuals and, therefore, without imposing on them obligations in the management of businesses. 80. The range of public authority activities that are exempt from the general regime governing the processing of personal data must, however, be interpreted narrowly. Specifically, the notion of national security, which is the sole responsibility of each Member State under Article 4(2) TEU, cannot be extended to other sectors of public life that are, to varying degrees, related to it. … 82. I believe … that guidance can be found in the criterion contained in Framework Decision 2006/960/JHA … Article 2(a) of which distinguishes between law enforcement authorities in the broad sense — which include “a national police, customs or other authority that is authorised by national law to detect, prevent and investigate offences or criminal activities and to exercise authority and take coercive measures in the context of such activities” — and “agencies or units dealing especially with national security issues”. … … 84. There … is continuity between Directive 95/46 and Directive 2002/58 with regard to the competence of Member States over national security. Neither directive is intended to protect fundamental rights in this specific area, in which Member States’ activities are not “governed by [EU] law”. 85. The “balance” referred to in recital [11 of Directive 2002/58] arises from the need to respect the competence of the Member States over national security matters, where they exercise that competence directly, using their own resources. By contrast, where, even for those same reasons of national security, the involvement of individuals, on whom certain obligations are imposed, is required, that circumstance dictates inclusion within an area (namely the protection of privacy required of those private operators) governed by EU law. 86. Both Directive 95/46 and Directive 2002/58 seek to achieve that balance by allowing the rights of private individuals to be restricted by legislative measures adopted by Member States pursuant to Article 13(1) and Article 15(1) respectively of those directives. On this point there is no difference between them. … 89. Those public authority activities must necessarily be defined narrowly, so as not to deprive EU privacy law of its effect. Article 23 of Regulation No 2016/679 makes provision — in line with Article 15(1) of Directive 2002/58— for restricting, by way of a legislative measure, the rights and obligations established by the regulation, where necessary in order to safeguard, among other objectives, national security, defence or public security. Once again, if the protection of those objectives were sufficient grounds for exemption from the scope of application of Regulation No 2016/679, there would be no need to invoke national security as grounds for introducing legislative measures to restrict the rights guaranteed by that regulation.’