There are exemptions for national security, but they have to be proportionate (and if you read the judgment of the court, they're pointing at a high bar there) and non-discriminatory with regards to citizenship.

Part of the problem with SH was the fact that there was no legal recourse at all for EU citizens.

Also, let's not forget that the CJEU stuck down the Data Retention Directive recently - so they are enforcing this human right against EU member states. They just have to wait for the right referral to their court.

I think it would be very interesting if the civil courts of the US and EU each forced the other entity into passing stronger privacy protections than they have currently. Specifically, I'm thinking of a scenario where the collapse of Safe Harbor helps force Congress into passing meaningful privacy legislation and drastically curtailing the NSAs overbroad powers and mandates, and the US then turns around to the EU and says "ok, now it's your turn. If we can't spy on everybody, then neither can you."