personal data and access to that data with a view to its use by public authorities, irrespective of whether
the information in question relating to private life is sensitive or whether the persons concerned have
been inconvenienced in any way on account of that interference (see, to that effect, judgments of
20 May 2003, Österreichischer Rundfunk and Others, C‑465/00, C‑138/01 and C‑139/01,
EU:C:2003:294, paragraphs 74 and 75, and of 8 April 2014, Digital Rights Ireland and Others,
C‑293/12 and C‑594/12, EU:C:2014:238, paragraphs 33 to 36; and Opinion 1/15 (EU-Canada PNR
Agreement) of 26 July 2017, EU:C:2017:592, paragraphs 124 and 126).
172
However, the rights enshrined in Articles 7 and 8 of the Charter are not absolute rights, but must be
considered in relation to their function in society (see, to that effect, judgments of 9 November 2010,
Volker und Markus Schecke and Eifert, C‑92/09 and C‑93/09, EU:C:2010:662, paragraph 48 and the
case-law cited, and of 17 October 2013, Schwarz, C‑291/12, EU:C:2013:670, paragraph 33 and the
case-law cited; and Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592,
paragraph 136).
173
In this connection, it should also be observed that, under Article 8(2) of the Charter, personal data
must, inter alia, be processed ‘for specified purposes and on the basis of the consent of the person
concerned or some other legitimate basis laid down by law’.
174
Furthermore, in accordance with the first sentence of Article 52(1) of the Charter, any limitation on the
exercise of the rights and freedoms recognised by the Charter must be provided for by law and respect
the essence of those rights and freedoms. Under the second sentence of Article 52(1) of the Charter,
subject to the principle of proportionality, limitations may be made to those rights and freedoms only if
they are necessary and genuinely meet objectives of general interest recognised by the Union or the
need to protect the rights and freedoms of others.
175
Following from the previous point, it should be added that the requirement that any limitation on the
exercise of fundamental rights must be provided for by law implies that the legal basis which permits
the interference with those rights must itself define the scope of the limitation on the exercise of the
right concerned (Opinion 1/15 (EU-Canada PNR Agreement) of 26 July 2017, EU:C:2017:592,
paragraph 139 and the case-law cited).
176
Lastly, in order to satisfy the requirement of proportionality according to which derogations from and
limitations on the protection of personal data must apply only in so far as is strictly necessary, the
legislation in question which entails the interference must lay down clear and precise rules governing
the scope and application of the measure in question and imposing minimum safeguards, so that the
persons whose data has been transferred have sufficient guarantees to protect effectively their personal
data against the risk of abuse. It must, in particular, indicate in what circumstances and under which
conditions a measure providing for the processing of such data may be adopted, thereby ensuring that
the interference is limited to what is strictly necessary. The need for such safeguards is all the greater
where personal data is subject to automated processing (see, to that effect, Opinion 1/15 (EU-Canada
PNR Agreement) of 26 July 2017, EU:C:2017:592, paragraphs 140 and 141 and the case-law cited).
177
To that effect, Article 45(2)(a) of the GDPR states that, in its assessment of the adequacy of the level
of protection in a third country, the Commission is, in particular, to take account of ‘effective and
enforceable data subject rights’ for data subjects whose personal data are transferred.
178
In the present case, the Commission’s finding in the Privacy Shield Decision that the United States
ensures an adequate level of protection for personal data essentially equivalent to that guaranteed in the
European Union by the GDPR, read in the light of Articles 7 and 8 of the Charter, has been called into
question, inter alia, on the ground that the interference arising from the surveillance programmes based
on Section 702 of the FISA and on E.O. 12333 are not covered by requirements ensuring, subject to the
principle of proportionality, a level of protection essentially equivalent to that guaranteed by the second
sentence of Article 52(1) of the Charter. It is therefore necessary to examine whether the
implementation of those surveillance programmes is subject to such requirements, and it is not
necessary to ascertain beforehand whether that third country has complied with conditions essentially
equivalent to those laid down in the first sentence of Article 52(1) of the Charter.