This analysis examines the balance between the right to privacy and national security, as framed in Opinion 1/15 of the CJEU on the draft agreement between Canada and the European Union dealing with the transfer of PNR data. Moving from this case-study and taking into account previous landmark judgments on personal data (Digital Rights Ireland, Schrems and Tele2 Sverige), this work argues that the CJEU is increasingly managing to take a right-oriented stance, without disregarding actual security needs. In this decision, the CJEU held mass surveillance not incompatible with EU law. Nonetheless, it laid down strict conditions to be respected in order not to impair privacy and data protection. Furthermore, Opinion 1/15 will have two sets of consequences, addressed by this study. First, it will impact on other PNR agreements, both in place (e.g. with the US and Australia) and forthcoming (e.g. with Mexico, Argentina, Japan); second, the EU institutional framework will be affected.