Court of Justice of the European Union (CJEU)
The , based in Luxembourg, is the EU's judicial body, deciding issues of EU law and enforcing EU decisions. It must not be confused with the , which is not an EU body. The CJEU has two parts: the Court of Justice (ECJ) and the General Court (former Court of First Instance). The ECJ has 27 judges (six-year terms) and eight advocates general giving non-binding opinions, and hears, among others, preliminary rulings referred by national courts. It has shaped data protection through cases like Google Spain, and Schrems II.
The CJEU, based in Luxembourg, is the EU's judicial body. It decides issues of EU law and enforces EU decisions - whether in actions by the Commission against a member state or actions by individuals enforcing EU-law rights. It is divided into the Court of Justice (ECJ) and the General Court (the renamed Court of First Instance, CFI).
- The ECJ has 27 judges, appointed by common accord of member-state governments for six-year terms; they elect a president for three years
- It has eight advocates general giving reasoned, non-binding opinions
- Jurisdiction includes: actions for failure to fulfil treaty obligations, review of legality of EU acts, failure to act, preliminary rulings referred by national courts, opinions on international agreements, and appeals on points of law from the General Court
- In the power-flow diagram: Commission proposes, Parliament supervises the Commission, Council appoints the Commission, Parliament + Council adopt EU law via co-decision, and the Court of Justice feeds in via arbitration
| Case | What the ECJ held |
|---|---|
| Google Spain (2014) | Right to be forgotten - search engines must, in certain circumstances, remove results from a name search; addressed EU-law applicability where a controller has an EU establishment |
| Digital Rights Ireland (2014) | Invalidated the Data Retention Directive under Charter Articles 7, 8 and 11 |
| ANAF / Bara (2015) | Personal data may not be transferred between public bodies without informing individuals |
| Weltimmo (2015) | Even minimal activities in a member state can trigger that state's data protection law |
| (Oct 2015) | Invalidated Safe Harbor as an adequate transfer framework to the US |
| Tele2 / Tom Watson (2016) | General and indiscriminate data retention breaches the ePrivacy Directive read with the Charter |
| Schrems II (Jul 2020) | Invalidated Privacy Shield; held SCCs valid but subject to a case-by-case assessment |
The CJEU is an EU institution in Luxembourg ruling on EU law. The ECtHR in Strasbourg is NOT an EU body - it belongs to the Council of Europe and oversees the ECHR across its many signatories, including non-EU states. They are frequently confused.