Legal landscape¶

The garden has a planning code. Most of it is publicly available. None of it says what people assume it says.

Surveillance in the EU is not lawless. It is the opposite: a dense, mostly public body of law that permits, mandates and channels it. The code runs from the national-security hole at the centre of data-protection law, through the courts that police its edges, the collection built into the network, the routes data takes across borders, to the newer fronts where the rules are being loosened, extended into private messages, and wired into biometric databases.

One pattern runs through all of it. Counter-terrorism powers enacted after the 2001 attacks, and expanded after later attacks on European soil, arrived framed as exceptional and temporary. They did not contract when the crisis passed. They were absorbed into the standard toolkit, normalised through routine use, and in several cases extended. The envelope expands; it does not return to its original shape.

Last reviewed: 2026-07-08.