In its landmark judgment in Digital Rights Ireland, the Court of Justice of the European Union struck down the Data Retention Directive on the basis that it violated the fundamental rights to privacy and data retention. While the judgment has rightly been praised for its robust protection of fundamental rights, it also leaves important questions unresolved and raises deeper issues about the proper division of competence between the EU and its Member States and the respective roles of the courts and the political organs within the EU’s constitutional structure.