We analyse two recent landmark decisions delivered by the Court of Justice of the European Union which bring EU member state’s national legislation on mass surveillance within the scope of EU Privacy law. The decisions involving the UK, France and Belgium effect member state’s national legislation which allows national governments to have access to our data in circumstances where national security is at risk. The judgment may have a significant impact on the EU’s adequacy determination for the UK after they leave the EU in January 2021.