(Almost) not another Schrems II post

Even EU member states can be tempted to overlook rulings of the CJEU when they create a tension between data protection and public security. Case in point: according to Politico, after failing to change its data retention laws further to the 2016 CJEU's "Tele2" ruling, the French government is now reportedly resisting complying with the CJEU’s October 2020 "Quadrature du Net" judgment. Both cases restrict the general and indiscriminate retention of traffic and location data and their access by public authorities in the EU without prior review by a court or an independent administrative authority. The concerns they raise for EU member states' legislations are the same as those the CJEU's "Schrems II" judgment of July 2020 raised for U.S. surveillance laws and the possible access by U.S. authorities to data transferred to the United States without a warrant, i.e., prior review by a court. Contrary to the Schrems II situation, however, transfers of personal data from other EU Member States to France cannot be stopped by the CJEU even if France refuses to comply with its case law. However, this would send a message to other countries, including the United States, and call for a serious self-examination by Europeans on the balance to be struck between personal data protection rights and security.