Schrems highlighted a number of unsatisfactory elements in the letters from U.S. authorities published by the Commission on Monday, including an authorization of bulk surveillance in Presidential Policy Directive 28.
PPD28 provides for six conditions under which bulk surveillance may be used: detecting and countering certain activities of foreign powers; counterterrorism; counter-proliferation; cybersecurity; detecting and countering threats to U.S. or allied armed forces, and combating transnational criminal threats, including sanctions evasion.
It also allows for some circumstances under which it must be used, such as to identify new or emerging threats, but notes that, whenever practicable, signals intelligence collection activities are conducted in a targeted manner rather than in bulk.
However, the CJEU found all use of bulk surveillance compromised the right to respect for private life.
"Basically, the U.S. openly confirms that it violates EU fundamental rights in at least six cases," Schrems said. "The Commission claims that there is no 'bulk surveillance' anymore, when its own documents say the exact opposite thing."
Sign up for CIO Asia eNewsletters.