Right to be forgotten vs. right of access to information. AG opinion in Google case (C-460/20)

Freepik (iconicbestiary)

One of the characters in a well-known movie called "The Social Network" said that the internet's not written in pencil, but it's written in ink. We know that information, once posted online, does not die, but circulates for many years. However, the General Data Protection Regulation (GDPR) guarantees us the right to erasure of our personal data (also known as the right to be forgotten), and the right to object to processing. Both rights can be exercised in certain situations specified in the regulation, such as when the data is processed unlawfully or because of a particular situation of the data subject. I will not go into details, as the purpose of this post is not to comment on the GDPR provisions, but to give an overview of an opinion delivered recently in the case C-460/20 Google by Advocate General Giovanni Pitruzzella. Although this is not the first case concerning deletion of personal data available on the Internet (see, for example, judgments of the Court of Justice in cases: C-131/12 Google Spain and Google, C-136/17 GC and Others, C-18/18 Glawischnig-Piesczek), this issue still raises doubts and will probably be the subject of preliminary questions more than once.

The case concerns the processing of personal data of a man holding important positions in financial services companies and his ex-partner who was a proxy in one of those companies. One of the websites published three articles that questioned the investment model adopted by some of the companies. In addition, it posted photos of the man and his ex-partner in a luxury car, a helicopter and in front of a plane. The photos, as well as the content of the articles, suggested that they were leading a sumptuous life at the expense of third parties. Because Google's search engine displayed links to pages with the articles in its search results, as well as thumbnail images of the articles, the plaintiffs requested that both the links to the pages and the thumbnails be removed from the list of search engine results. They claimed that they contained a number of erroneous allegations and defamatory opinions based on untrue facts. In their opinion, they were victims of blackmail by the website.

The German Bundesgerichtshof (Federal Court of Justice) has raised doubts about the interpretation of Article 17(3a) of the GDPR, a provision that entitles a controller to refuse to delete personal data if the processing is necessary for the exercise of the right to freedom of expression and information. The questions referred for a preliminary ruling thus concern the balancing of two conflicting fundamental rights guaranteed by the Charter of Fundamental Rights of the European Union: the right to information and freedom of expression, and the right to respect for private life and protection of personal data.

The Advocate General recognized and emphasized in his opinion the important role of "gatekeepers" played by search engines. Their activity is essential in ensuring universal, even democratic, access to information. As he points out, "in the vast ocean of information created on the Internet, much information would remain virtually inaccessible without the intermediation of these search engines" (para. 2). At the same time, search engines exercise control over the circulation of information on the Internet, since the inclusion of a link to certain websites in a search list, on the one hand, facilitates access to information for any Internet user and contributes to the dissemination of that information, while on the other hand, it may constitute a serious intrusion into the private sphere of the individuals to whom the information relates. Nevertheless, the right to respect for private life and to protect personal data are not absolute. According to the AG Pitruzzella, given the context of the case, and in particular the fact that the data subject performs a public function (more or less important, political or economic), it must be assumed that the right to information overrides the right to protection of personal data. He notes that "the confidence both of other economic operators and of consumers is a prerequisite for the proper functioning of the market. This confidence requires public access to information about persons in professional roles that is likely to affect market dynamics and consumer interests, sometimes even more markedly than the acts of policy makers. Naturally, this information is essentially that which relates to their professional roles, but can also extend to aspects of their private sphere where they are connected or, in any event, likely to impact their professional activity and affect public confidence" (para. 28). 

However, there are exceptions to the rule. The right to information will not prevail if the information presented is false, even if it concerns a person who plays an important role in society. Incorrect information not only violates the protection of personal data but also the dignity of the data subject by distorting his or her identity (para. 31). In such a situation, the right to data protection will enjoy priority. This conclusion was drawn by the Advocate General based on the principle of data accuracy formulated in Article 5(1d) of the GDPR, according to which personal data must be accurate and, where necessary, updated, while data that are inaccurate in light of the purposes of the processing must be erased or rectified without delay (para. 32). Data accuracy is one of the basic principles of the processing of personal data and its violation implies unlawfulness of the processing.

Freepik (rawpixel.com)

A special role in this aspect is played by the operator of the Internet search engine, who acts as a data controller and is therefore responsible for the entire data processing. Its task is to assess whether a request to remove links to websites or images, i.e. a de facto request to delete personal data, should be accepted. The search engine operator, acting as a controller under the GDPR, must balance the mentioned fundamental rights. How it should be done? In the AG's view, some kind of "procedural data due process" should be introduced. This is to impose certain obligations on both the data subject and the controller, which, although not explicitly stipulated in the regulation, can be interpreted from its content and are intended to serve the effective implementation of the right to be forgotten. First, if the data subject claims that information about him or her is false, he or she should provide a prima facie evidence for its falsity unless "this is, in particular in view of the nature of the information concerned, manifestly impossible or unduly difficult" (para. 44). Secondly, the controller should carry out the verification of the disputed information "which is within the scope of his concrete capacities". Thus, he should analyze all data in his possession as the operator of the search engine, using the technological tools available. Moreover, the operator of the search engine, where possibile, should "initiate rapidly an adversarial debate with the web publisher who initially disseminated the information, who will then be able to set out the reasons supporting the truth of the personal data processed and the lawfulness of the processing" (para. 45). Then, the operator will have to decide whether or not to grant the request for de-referencing. The request may be dismissed only "if substantial doubts remain as to whether the information in question is true or false, or if the weight of the false information in the context of the publication in question is manifestly insignificant and that information is not of a sensitive nature" (para. 46). The search engine operator is thus supposed to act as a quasi court or like an arbiter by actively seeking the truth. In conclusion, the AG believes that appropriate activity should be required on the part of the data subject (by making it plausible that the information is false) and on the part of the controller (by comprehensively verifying the accuracy of the information).

As far as the removal of thumbnail images displayed in the results of an image search is concerned, the AG Pitruzzella considers that the same principles should be applied here. The controller must also balance the rights, and in this case should take into account only the informational value of the images as such, regardless of the content they illustrate on the website from which they originate. Conversely, if "in connection with a request for de-referencing of the link to a web page, the display of photographs in the context of the content of that web page were contested, it would be the informative value that those photographs have in that context which should be taken into account for the purposes of that balancing exercise" (para. 56).

The AG's opinion is not surprising, as it is in line with the existing case law of the Court. The question is whether this position, assuming that the Court will follow it, will contribute to strengthening the position of data subjects vis-à-vis the controllers, i.e. Internet search engines? It seems that the argument of universal access to information, especially information about public figures (and in the age of the Internet the boundary between "public person" and "private person" is extremely fluid and unclear), can always be used as a justification for refusing to remove links to websites from the list of search results. The right to protection of personal data interferes here not only with the right to information, but indirectly also conflicts with the economic interests of the search engine operator who makes profits from such a business model. The more information, links, clicks and views, the better. The same is true for website operators who publish content on their portals. Even imposing high fines for unjustified refusal of a data deletion request, and thus violating GDPR regulations, does not deter the "big players". However, in order not to end with such a pessimistic tone, let's hope that as time goes by, this trend will reverse and the right to be forgotten will become an effective tool for removing incorrect information online that undermines someone's reputation. Like a metaphorical eraser that wipes off the ink with which one writes on the Internet*. 

*I refer to the words of Advocate General Maciej Szpunar in his opinion in Case C-18/18 (para. 2).

In the news

Some of the interesting reads we found in the news from last week:

Five misleading pricing tactics to avoid in sales (V. Crowe in Which?) - warns which pricing offers may be misleading considering the rulings of the UK's Advertising Standards Agency from last year

How Airbnb's Tech Is Impacting People's Fundamental Human Rights (L. Coulman in Forbes) - more specifically the right to housing

Blue Planet has "huge impact" on shopper behaviour, finds report (L. Wells in Talking Retail) - Waitrose study shows more sustainable behaviour patterns of consumers and what impacts them

Effective judicial protection in unfair terms cases – mixed signals from Luxembourg

Also yesterday the Court of Justice delivered its ruling in case C-119/15 Biuro podróży Partner. The judgment may come as a surprise to some commentators as it markedly deviates from the opinion of Advocate General Saugmandsgaard Øe presented earlier this year (see our previous post here). The Court adopted a more consumer-friendly approach and accepted a national solution, according to which the use of terms equivalent to those included in the register of unfair clauses may lead to an imposition of administrative sanctions, even the term included in the register was declared unlawful in a different factual context. The Court made it clear, however, that effective judicial remedies must be available to traders, on whom the sanctions are imposed.

Underlying dispute and questions referred for a preliminary ruling

Reference for preliminary ruling came from the Court of Appeal in Warsaw, which examined an appeal from the decision of the Polish consumer protection authority (President of UOKiK) imposing a fine of PLN 27 127 (approx. EUR 4 940) on the travel agency Partner. Imposition of sanctions was based on the finding that supplier, in its contracts with consumers, made use of standard provisions equivalent to terms previously declared unlawful by a court and introduced into the public register of unfair terms. The referring court expressed doubts as to the interpretation of Directives 93/13/EEC (Unfair Contract Terms Directive) and 2009/22/EC (Injunctions Directive). It explicitly referred to the Invitel case (C‑472/10), in which the Court held, that its case-law that the effects of a judicial decision declaring unfair terms unlawful may be extended to all consumers having concluded a contract containing the same terms with the same seller or supplier, even if they did not participate in the proceedings brought against that trader. The referring court asked for clarification whether an analogous interpretation can apply to consumers who concluded a contract containing the same terms with a different seller or supplier.

The judgment

According to the Court, in light of Article 6(1) and Article 7 of Directive 93/13/EEC, read in conjunction with Articles 1 and 2 of Directive 2009/22/EC and in the light of Article 47 of the Charter of Fundamental Rights of the EU, the use of standard contract terms with content identical to that of terms which have been declared unlawful by a judicial decision having the force of law and which have been entered in a national register of unlawful standard contract terms can be regarded as an unlawful act also in relation to a seller or supplier which was not a party to the proceedings culminating in the entry in that register.

However, it is essential that the seller or supplier is provided with an effective judicial remedy against the decision which finds that contested terms are equivalent. In particular, the following two elements should be subject to a review:

a) the question whether, in the light of all relevant circumstances particular to each case, those terms are materially identical, having regard in particular to their harmful effects for consumers,

b) the amount of the fine imposed.

Comment

The judgement is noteworthy for several reasons. First of all, it elaborates on the role of the Charter of Fundamental Rights in the context of unfair contract terms. This time the Court explicitly referred to the Charter (paras. 23-27), although it had refrained from doing so in other important cases like Aziz (C-415/11). The Court also made it clear that not only consumers, but also the sellers and suppliers enjoy the fundamental right to effective judicial remedy which must be respected.

Secondly, the judgment sheds some light on the role of unfair contract terms registers, which can be adopted by Member States. The Court did not delve into the debate about the erga omnes effect of judgments, but appeared to have taken it for granted that lists of unfair terms may also be based on court rulings (para. 36), thus differing quite fundamentally from the Advocate-General's opinion (paras. 54-56 of the opinion). Instead of questioning the legitmacy of such registers, the Court focused on the way in which they work in practice and emphasised that not only the formation, but also management of such registers must comply with EU law. In particular, registers should remain transparent and up-to-date. Possible consequences of noncompliance with these requirements have not been specified, though. In case of a serious mishandling of unfair terms registers, initiation of infringement proceedings could perhaps be envisaged. It is worth mentioning that with respect to the abovementioned parameters, the Polish register – with more than 6500 often overlapping entries – left much to be desired. However, as we have already reported, legal framework in Poland has meanwhile undergone a substantial reform and no longer provides for an erga omnes effect of judgements entered into the register. Interestingly, the lack of transparency was mentioned as one of the reasons for the reform.

In the analysed case particular importance was attached to the trader’s possibility to challenge the decision. Emphasis was placed on two elements: assessment of the conduct itself (material equivalence) and the amount of the fine. In this respect the Court aligns, to a certain extent, with the Advocate General, who also stressed the need to analyse contractual terms in a broader context and to allow traders to present factual arguments. Nevertheless, the Court's understanding of the Polish system of judicial review differs rather significantly from the Advocate-General's view (see paras. 42-43 of the judgment and para. 65 of the opinion).

Notwithstanding these discrepancies, it seems justified to say that a system in which administrative sanctions are imposed based on the register of unfair clauses is only acceptable if the reviewing court is competent (obliged?) to analyse the case on the merits. In the Polish judicial practice several reviewing courts have expressed the view that conducting such an assessment should not be their task, as there is a separate procedure adopted specifically for this purpose. In the light of CJEU judgment, such an argument may be contested. According to the Court, assessment of material equivalence undertaken by the reviewing court is sufficient from the point of view of effective judicial protection. At the same time, the Court does not preclude the existence of stronger procedural guarantees for traders. In particular, it does not address the issue whether an alternative solution, in which every contractual term needs to be first assessed by the court in a dedicated procedure and only afterwards the trader can be subject to administrative sanctions, would undermine the effectiveness of EU consumer law.

The assessment of the second element – the amount of fines – has similarly been left to national courts. In this respect, however, the judgment is less controversial as it clearly refers to the well-established principle of proportionality (paras. 44-46).

Concluding remarks

The judgment in Biuro podróży Partner may be regarded as a development of Invitel jurisprudence. The Court seems to have accepted that a judicial ruling recognising particular contract terms as unfair may also produce, at least indirectly, legal effects vis-à-vis other sellers and suppliers. Nevertheless, this was not the main angle of the Court's analysis. While the CJEU acknowledged that administrative proceedings against different traders may be based on registers on unfair clauses, it did not attach much importance to the fact that the register in the case at hand was composed of clauses which had previously been declared unfair by courts in different individual cases. Emphasis was rather placed on the need to provide both consumers and traders with effective judicial remedies in light of Article 47 of the Charter. The Court provided some guidance as to the interpretation of this principle, although this can hardly be regarded as clear and comprehensive. The judgment also sheds some light on requirements concerning the management of unfair term registers, which should remain transparent and up-to-date. Furthermore, it clarifies that even if the administrative sanction is based on equivalence of contract terms, judicial review should seek to establish whether the terms are indeed materially – and not only formally – identical and sanctions are proportional. The question of what should be done if the earlier court had simply erred in its finding was not explored.

Due to a recent reform of the Polish law on unfair terms, the judgment of the Court will be particularly relevant to a number of pending proceedings, initiated before the reform came into force, which were often stayed in anticipation of the CJEU ruling. In this context, it is crucial that the Court did not reject the consumer-friendly interpretation of the previous Polish scheme in its entirety. As regards the availability of effective judicial protection, the assessment has largely been left to national courts. Limited evaluation performed by the CJEU did not disclose any significant shortcomings of the analysed legal framework, contrary not only to the opinion of the AG, but also the part of Polish jurisprudence and academia. It will thus be very interesting to see the impact of the judgment on the ongoing proceedings.

Putting an end to silos enforcement of consumer (data protection) rights?

Last month, BEUC and the European Data Protection Supervisor (EDPS) held a joint conference on the enforcement of fundamental rights- notably, the right to privacy- in the age of big data. 

BEUC urges all competent authorities to coordinate their actions and strategies in this field, putting an end to "silos" enforcement, which is unable to guarantee equal respect of consumer rights across policy areas. 

BEUC particularly welcomed the EDPS's recently published opinion on "coherent enforcement of fundamental rights in the age of big data", which contains a set of recommendations, Here an excerpt from the study summary:

"The EU institutions and bodies, and national authorities when implementing EU law, are required to uphold the rights and freedoms set out in the Charter of Fundamental Rights of the EU. Several of these provisions, including the rights to privacy and to the protection of personal data, freedom of expression and non-discrimination, are threatened by normative behaviour and standards that now prevail in cyberspace. The EU already has sufficient tools available for addressing market distortions that act against the interests of the individual and society in general. A number of practices in digital markets may infringe two or more applicable legal frameworks, each of which is underpinned by the notion of ‘fairness’. Like several studies in recent months, we are calling for more dialogue, lesson-learning and even collaboration between regulators of conduct in the digital environment. We also stress the need for the EU to create conditions online, as well as offline, in which the rights and freedoms of the Charter may thrive.

This Opinion therefore recommends establishing a Digital Clearing House for enforcement in the EU digital sector, a voluntary network of regulatory bodies to share information, voluntarily and within the bounds of their respective competences, about possible abuses in the digital ecosystem and the most effective way of tackling them. This should be supplemented by guidance on how regulators could coherently apply rules protecting the individual. We also recommend that the EU institutions with external experts explore the creation of a common area, a space on the web where, in line with the Charter, individuals are able to interact without being tracked. Finally, we recommend updating the rules on how authorities apply merger controls better to protect online privacy, personal information and freedom of expression."

According to the opinion, the Digital Single Market strategy represents a good opportunity for taking a more coherent approach. We will see whether the different actors involved will be willing to seize the chance!

Handbook on access to justice in Europe

In partnership with the European Court of Human Rights (ECtHR), the EU Agency for Fundamental Rights (FRA) has published a handbook which highlights and summarises the key principles in the area of access to justice, in particular those developed under Article 47 of the EU Charter of Fundamental Rights (EUCFR) and Articles 6 and 13 of the European Convention on Human Rights (ECHR). The handbook is meant to raise awareness and knowledge about the different avenues available to access justice.

Access to justice is a core fundamental right according to the EUCFR and a human right under the ECHR. Access to justice enables parties whose rights have been infringed to effectively enforce their rights and obtain a remedy. The handbook provides an accessible summary and analysis of the relevant case law of the EU Court of Justice and the ECtHR, supplemented by – where available – national jurisprudence, on key topics in the area of access to justice.

With respect to consumer law, the handbook refers to EU initiatives on ADR in the field of consumer protection, as well as specific remedies for consumers.

A missed opportunity? CJEU judgment in Case C-49/14 (Finanmadrid)

Today the Court of Justice of the European Union delivered its judgment in Case C-49/14 (Finanmadrid). We have reported earlier on AG Szpunar’s opinion in this case. The questions referred for a preliminary ruling gave the CJEU an opportunity to clarify the relation between the general principles of effectiveness and equivalence in EU law and Article 47 of the EU Charter of Fundamental Rights, which safeguards the right to effective judicial protection.

The Court’s judgment

The Court has not seized this opportunity. Instead, it deals with the case entirely and exclusively in the framework of the effectiveness of Directive 93/13/EEC (Unfair Contract Terms), without any reference to Article 47 of the Charter. The Court merely concludes that the referring court “has not stated the reasons which have led it to doubt the compatibility” with Article 47 of the national legislation at issue and that, for lack of “information which is sufficiently precise and complete”, it is not able to give “a useful reply” (para. 57). The Court does not clarify why it is “not necessary” to answer the questions concerning Article 47, nor does it state what (additional) information would be needed exactly. At the same time, the Court does examine the case in detail in the light of the principle of effectiveness. It seems that the Court’s consideration that the questions by the referring court must be understood broadly (para. 31) applies only to the questions concerning Directive 93/13.

What was this case about? The referring court was confronted with an application for the execution of an order for payment obtained by Finanmadrid against the defendants in enforcement proceedings, which had only involved a Secretario judicial (court registrar), not a judge. Spanish procedural law provides for intervention by a court only where the amount claimed is apparently not correct or where the debtor contests the proceedings. The referring court was precluded from an examination of the potentially unfair nature of the terms of the contract which gave rise to the enforcement proceedings, because the Secretario judicial’s decision (the order for payment) is an enforceable instrument with the force of res judicata.

The Court’s conclusion that such a procedural arrangement is liable to undermine the effectiveness of the protection intended by Directive 93/13 is, perhaps, not very surprising. The Court refers, among other things, to its judgments in Banco Español de Crédito and Sánchez Morcillo (reported by us here and here) to conclude that effective protection under Directive 93/13 can only be guaranteed if the national procedural system allows the court, either during the order for payment proceedings or before granting leave for execution, to check of its own motion whether the terms of the contract at issue are unfair. The involvement of a Secretario judicial is insufficient, because they can only check formalities; it does not fall within their powers to assess the potentially unfair nature of a term in a contract on which the debt is based (para. 50). There is also a significant risk that the consumers concerned will not lodge any objection (para. 52). In these circumstances, the Spanish rules on res judicata appear to run counter to the principle of effectiveness.

A missed opportunity?

While the Court performs an extensive analysis of the Spanish procedural rules at issue, it makes no reference to Article 47 of the Charter.

Article 47 of the Charter safeguards the (fundamental) right to an effective remedy and a fair trial before a court of law for the violation of rights within the scope of EU law. In a speech at a conference on the Charter (Brussels, 17-18 December 2014; click here), Mr. A. Rubio González, Agent for the Spanish Government before the CJEU, pointed out the growing importance of the Charter and Article 47 in particular for Spanish legal practice and effective consumer protection. In this respect, he specifically mentioned Finanmadrid as a pending case, and he observed that AG Jääskinen believes that the principles of effectiveness and equivalence should be brought under the umbrella of Article 47 of the Charter (opinion in Case C-562/12, para. 47).

However, in Finanmadrid, the relation between the principle of effectiveness and Article 47 seems to be overlooked by the Court. In his opinion, AG Szpunar remarks that it is as yet unclear whether Article 47 offers additional protection, or whether it replaces the principle of effectiveness. Other judgments (e.g. Sánchez Morcillo, paras. 35 and 50) suggest that the effectiveness of consumer protection intended by Directive 93/13 should be read in conjunction with Article 47 of the Charter. It is unclear why AG Szpunar disconnects Article 47 and the principle of effectiveness, but his opinion may have given the Court an argument to avoid answering the questions concerning Article 47 altogether.

The judgment is therefore inconclusive as regards Article 47 of the Charter. There are more (Spanish) cases pending before the CJEU referring to this Article in the context of Directive 93/13 (see, e.g., here and here). What role Article 47 has to play in this context remains yet to be seen.

New safe harbour agreement reached

A quick update for our readers on the legal guarantees surrounding data flow between EU and US: today, the Commission and the American government have reached an agreement that will replace the "safe harbour" agreement struck down by the CJEU last October (see our post here). The new agreement has been labelled "EU-US privacy shield". 

The deal is supposed to represent a major improvement compared to its predecessor, which, according to the Court of Justice, did not offer sufficient guarantees that the private data of European citizens would be processed in an acceptable ways once transferred to US-based companies and agencies.

According to the Commission's releases, the "privacy shield" should provide both clear rules for companies handling data and limitations on the US government's access to such data. Further, European citizens fearing that their data is being mishandled should have several remedies available.

Also this time, take a look at the Guardian's nice article on the topic for some more context. 

Execution proceedings enriched with an unfairness test: AG Szpunar in Finanmadrid (C-49/14)

11 November 2015: AG Szpunar's opinion in case Finanmadrid (C-49/14)

Yesterday, in another Spanish case on unfair contract terms, where a consumer defaulted on his credit payments (this time for a motor vehicle instead of a house), AG Szpunar issued an opinion following the so far set line of judgements. 

In this case the order for payment was issued by secretario judicial (court's secretary), who (at the time) was not obliged pursuant to Spanish law to ex officio test for unfairness of a penalty clause in a credit contract. Since the consumer did not raise the issue of unfairness, only when the order for payment became final, in the execution proceedings, the court raised a question whether they should not be able to test for unfairness of the contractual provision, on which the order for payment is based. Pursuant to Spanish law this was not possible.

AG Szpunar, unsurprisingly, concludes that if Spanish law did not oblige the court's secretary to assess unfairness of his own motion, then such an obligation should bind judges in the execution proceedings (par. 98). Still, he considers that conducting of the unfairness test in the execution proceedings is undesirable, e.g. because these proceedings usually do not include investigation of facts, there is a possibility that the previous decision already became final (par. 54-58). However, if this test has not been conducted at an earlier stage of the judicial process, this may be the only solution left to Spanish courts to comply with the principle of effectiveness in applying consumer protection against unfair contract terms (par. 60). The preferred solution would be, however, to oblige the secretario judicial  (as an employee of the justice system) to conduct ex officio control of unfair contract terms - which is what the recent Spanish law reform aimed at (par. 50-51).

One other interesting point: AG Szpunar refers to the relationship between art. 47 of the Charter and the principle of effectiveness. Currently, there is a lot uncertainty as this relationship and whether art. 47 of the Charter is supposed to complete the requirements following from the principle of effectiveness or whether maybe it will replace them and create a new test for effective judicial protection/remedy (par. 85). While AG Szpunar considers that art. 47 of the Charter requires effective remedies to be granted also through national procedural rules, he concludes that Spanish law in this case could not be seen as infringing art. 47 and that the level of protection granted in the UCTD reaches further than the level of protection of art. 47 (par. 89-90). This is an interesting point of view that the CJEU will most likely not delve into (since the question may be answered without any reference being made to the Charter), so it's good to take a note to AG Szpunar's arguments for anyone interested in the issue of a relationship between the Charter and EU private law.

ECJ "Facebook" case: EU -US safe harbour agreement invalid

Just today, the European Court of Justice declared (Schrems v Data Protection Commissioner, C-362/14) that the 2000 Commission decision which allowed the transmission of EU citizen's data to the United States is invalid. The decision, according to the Court, failed to show that the Commision had actually considered whether the United States guaranteed a level of protection of fundamental rights "essentially equivalent" to the one afforded in the European legal order.

See more extensively the excellent coverage by the Guardian here and, here (with some speculations on what the decision entails.

PS the case was initiated by the same guy whose other actions we had talked about some time ago.

European scrutiny of data processing by natural persons - CJEU judgment in Case C-212/13 Ryneš

This morning, the Court of Justice of the EU handed down a judgment that has important implications for the processing of personal data by private persons. In the Czech case of Ryneš v Úřad pro ochranu osobních údajů the Court established that the European Data Protection Directive applies to a video recording made with a surveillance camera installed by a person on his family home and directed towards the public footpath. It thus clarified to what extent horizontal legal relationships among natural persons fall within the sphere of scrutiny of the Directive.

The case concerned Mr Ryneš, whose family and home had been subject to attacks by unknown individuals between 2005 to 2007. In response to the attacks, he installed a surveillance camera under the eaves of his home, which recorded the entrance to his home, the public footpath and the entrance to the house opposite. A video recording made it possible for the police to identify two people who attacked Ryneš's home in October 2007, breaking a window by a shot from a catapult. In the criminal proceedings against the two suspects the question arose whether the Data Protection Directive applied to Ryneš's use of the camera. This question is of relevance for private legal relationships, since the 'processing of data in the course of a purely personal or household activity' is excluded from the scope of the Directive and, therefore, not subject to the rules on data protection laid down in this instrument.

The CJEU reaches the conclusion that Mr Ryneš's use of the surveillance camera cannot be included in the exemption and, therefore, falls within the scope of the Directive:

'The second indent of Article 3(2) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that the operation of a camera system, as a result of which a video recording of people is stored on a continuous recording device such as a hard disk drive, installed by an individual on his family home for the purposes of protecting the property, health and life of the home owners, but which also monitors a public space, does not amount to the processing of data in the course of a purely personal or household activity, for the purposes of that provision.'

According to the Court, the use of the camera does not qualify as 'processing of data in the course of a purely personal or household activity', since this provision should be narrowly interpreted:

'27. As is clear from Article 1 of that directive and recital 10 thereto, Directive 95/46 is intended to ensure a high level of protection of the fundamental rights and freedoms of natural persons, in particular their right to privacy, with respect to the processing of personal data (see Google Spain and Google, C‑131/12, EU:C:2014:317, paragraph 66)

28. In that connection, it should be noted that, according to settled case-law, the protection of the fundamental right to private life guaranteed under Article 7 of the Charter of Fundamental Rights of the European Union (‘the Charter’) requires that derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary (see IPI, C‑473/12, EU:C:2013:715, paragraph 39, and Digital Rights Ireland and Others, C‑293/12 and C‑594/12, EU:C:2014:238, paragraph 52).

29. Since the provisions of Directive 95/46, in so far as they govern the processing of personal data liable to infringe fundamental freedoms, in particular the right to privacy, must necessarily be interpreted in the light of the fundamental rights set out in the Charter (see Google Spain and Google, EU:C:2014:317, paragraph 68), the exception provided for in the second indent of Article 3(2) of that directive must be narrowly construed.'

Natural persons can, therefore, not easily escape scrutiny of data processing under the Directive. Only such activities as correspondence or keeping an address book are exempted. Camera surveillance, insofar as it, even partially, covers a public space is 'directed outwards from the private setting of the person processing the data in that manner' and is therefore not excluded from the Directive's scope.

Importantly, the Court adds that the national court, when assessing the data processing, should take into account legitimate interests pursued by the data controller (in casu, Mr Ryneš) in protecting the property, health and life of his family and himself. Thus, it is up to the national court to balance the interests of the parties within the legal framework set out by the Data Protection Directive. An interesting example of both Europeanisation and constitutionalisation of private legal relationships.

See also AG Jääskinen's Opinion in the case and the CJEU's press release.

Unfair terms, mortgage enforcement and a consumer's fundamental right to accomodation - CJEU in Kušionová (C-34/13)

10 September 2014: CJEU judgment in Kušionová (C-34/13)

Today the CJEU handed down another important judgment in the field of mortgage enforcement (for previous case law have a look at Aziz and Sánchez Morcillo). This time it was not the Spanish, but the Slovak law of mortgage enforcement that was looked at by the CJEU. Contrary to the previous judgments, the national legislation was deemed to be in line with EU law.

In 2009, Mrs Kušionová took up 10.000 Euros. The loan was secured with the family home. The terms of Mrs Kušionová's bank (SMART Capital A.S.) contained a clause relating to extrajudicial enforcement of the charge on immovable property. This specific term stated that the creditor is able to enforce the charge without a court having the opportunity to review the clause. 

Under Slovak law, the sale by auction may be contested within 30 days of the notice of enforcement of the charge. After a public auction, the contesting person has a period of three months to take steps against the conditions under which the sale took place. According to Slovak civil procedure law, national courts may furthermore adopt any interim measure to prevent an auction from going ahead during an extrajudicial enforcement of a charge (like the one in the proceeding).      

The CJEU suggests that interim measures stopping the auction of a family home are adequate and effective means to prevent the continued use of unfair terms and are thus in line with the Unfair Terms Directive. Interim measures in general constitute an effective and dissuasive penalty for businesses infringing EU law. They are furthermore a proportional penalty if the national court deciding over the measures takes into account the fact that the property subject to the charge is immovable property forming the consumer's family home, the right to accomodation being a fundamental right guaranteed under the Charter of Fundamental Rights of the EU.

Although the Slovak legislation has already been changed (see nr 31 and 32 of the judgment), the CJEU's decision is interesting on a theoretical level as it  puts a strong emphasis on consumers' fundamental rights under EU law.

No to unlimited shopping: CJEU in Pelckmans (C-483/12)

Today, the CJEU held in Pelckmans Turnhout II that the Belgian requirement for businesses to observe one day of rest per week cannot be contested on the basis of EU law. 

The facts of the case were simple: Garden centers were kept open seven days per week. Their owners argued that the Belgian provision prescribing one day of rest were contrary to EU law as they discrimintated businesses established outside railway stations, airports, port areas etc, where exceptions to the rule applied. Amongst others, they based their claim on the UCP-Directive. With its judgement of 4 October 2012 (Pelckmans Turnhout I), the CJEU had already decided that the UCP-Directive did not apply to the contested national legislation as the latter 'does not pursue consumer protection objectives'. 

In today's decision, the Court held that the princliples of equality and non-discrimination weren't applying either, the reason for this being that the subject matter didn't have any connections with EU law (paras 17-23). This point of the judgment is highly interesting as it concerns the question of when Member States are implementing EU law. Only then the Charter of Fundamental Rights is adressed to them (Art 51(1) Charter). The outcome is surprising, as the CJEU usually finds ways to 'bring' the referred questions under its jurisdiction. 

The Court recaps its case law stating that the treaty provisions on the free movement of goods do not apply to (non-discriminatory) national rules concerning the closure of shops (para 24). The same is true for the treaty provisions of the freedom to provide services (para 25), which is why the Court didn't have jurisdiction to answer the question referred to it. As a consequence, the Belgian law on the closure of shops is still applicable and shops generally must be kept closed for one day per week!

CJEU declares Data Retention Directive invalid (Joined Cases C-293/12 and C-594/12)

With today's decision, the Court of Justice has declared the Data Retention Directive invalid. (see our previous post on the opinion in this case: Challenging the Data Retention Directive...)

The Directive concerned the harmonisation of Member States' legislations as to the storage of data which are generated or processed by providers of publicly available electronic communications services or of public communications networks, to the end of fighting terrorism and other forms of organised crime. In this context, providers must retain traffic and location data as well as related data necessary to identify the subscriber or user.

The Court observed that such large-scale collection and retention of data represents a serious interference with fundamental rights such as the right to private life and respect of personal data. It then sought  to ascertain whether such interference was justified in light of the objectives pursued by the Directive.

While acknowledging that the infringement of fundamental rights brought about by the Directive is limited and linked to genuine public interest, "the Court is of the opinion that, by adopting the Data Retention Directive, the EU legislature has exceeded the limits imposed by compliance with the principle of proportionality".

First, "the directive covers, in a generalised manner, all individuals, all means of electronic communication and all traffic data without any differentiation, limitation or exception";

Second, it "fails to lay down any objective criterion which would ensure that the competent national authorities have access to the data and can use them" only in relation to the crimes that the directive was meant to prevent/fight;

Third, the data retention period seems to be established without giving any meaningful indication as to how differences could be made among different subjects and different categories of data.

Finally, the Directive doesn't seem to provide sufficient guarantees against abuse and does not "ensure the irreversible destruction of the data at the end of their retention period", and furthermore does not require the data to be kept within Europe, which leaves unclear what authorities will, in fact, have access to the data.

The decision, which is making privacy advocates rather happy, will of course have consequences. Stay tuned for updates!

A fair balance? - CJEU judgment in Case C-314/12 UPC Telekabel Wien

While the authors of this blog were enjoying the consumer law conference in Oxford (more on this in a later post), the CJEU handed down its judgment in the intriguing case of UPC Telekabel Wien v Constantin and Wega last Thursday. For a summary of the facts of the case and Advocate-General Cruz's opinion, please refer to an earlier post on this blog ('Ius est ars aequi et boni').

The UPC case concerned the topical and difficult question of how to strike a balance between the rights of copyright holders (on films, in this case), consumers / internet users and internet service providers. Can providers be assigned the responsibility to take action to prevent the infringement of copyright by internet users to which they offer their services, considering that they do not have any direct contractual relationship to the copyright holders and it might be very burdensome (if not impossible) to take adequate measures to prevent users from illegally accessing copyright-protected material?

The CJEU's judgment in general seems to be in the affirmative, or at least not in the negative, though the Court takes great care to outline the conditions under which internet service providers are to be held to this responsibility.

In a first step, the Court considers that internet services providers fall within the scope of Article 8(3) of the Copyright Directive, which states that ‘Member States shall ensure that rightholders are in a position to apply for an injunction against intermediaries whose services are used by a third party to infringe a copyright or related right’ (para. 30 of the judgment). The lack of a contractual relationship does not affect this conclusion:

'Neither the wording of Article 8(3) nor any other provision of Directive 2001/29 indicates that a specific relationship between the person infringing copyright or a related right and the intermediary is required. Furthermore, that requirement cannot be inferred from the objectives pursued by that directive, given that to admit such a requirement would reduce the legal protection afforded to the rightholders at issue, whereas the objective of that directive, as is apparent inter alia from Recital 9 in its preamble, is precisely to guarantee them a high level of protection.' (para. 35)

In a second step, then, the Court establishes that it remains mostly a matter for national laws to regulate court injunctions prohibiting internet service providers from allowing their customers to illegally access copyright-protected material. EU law does not (!) preclude an injunction that 'does not specify the measures which that access provider must take and when that access provider can avoid incurring coercive penalties for breach of that injunction by showing that it has taken all reasonable measures, provided that (i) the measures taken do not unnecessarily deprive internet users of the possibility of lawfully accessing the information available and (ii) that those measures have the effect of preventing unauthorised access to the protected subject-matter or, at least, of making it difficult to achieve and of seriously discouraging internet users who are using the services of the addressee of that injunction from accessing the subject-matter that has been made available to them in breach of the intellectual property right, that being a matter for the national authorities and courts to establish.' (para. 64)

The CJEU supports this conclusion by pointing out that an injunction restricts the service provider's freedom to conduct a business (protected under Article 16 of the EU Charter of Fundamental Rights), but does not touch upon its essence - the internet provider can choose the means to prevent users from illegally accessing copyright-protected works and may avoid liability by proving to have taken all reasonable measures. Regarding the measures to be taken, the Court observes:

'In that regard, in accordance with the principle of legal certainty, it must be possible for the addressee of an injunction such as that at issue in the main proceedings to maintain before the court, once the implementing measures which he has taken are known and before any decision imposing a penalty on him is adopted, that the measures taken were indeed those which could be expected of him in order to prevent the proscribed result.'

'None the less, when the addressee of an injunction such as that at issue in the main proceedings chooses the measures to be adopted in order to comply with that injunction, he must ensure compliance with the fundamental right of internet users to freedom of information.'

'In this respect, the measures adopted by the internet service provider must be strictly targeted, in the sense that they must serve to bring an end to a third party’s infringement of copyright or of a related right but without thereby affecting internet users who are using the provider’s services in order to lawfully access information. Failing that, the provider’s interference in the freedom of information of those users would be unjustified in the light of the objective pursued.' (paras. 54-56)

In this respect, the role of national judges is underlined:

'It must be possible for national courts to check that that is the case. In the case of an injunction such as that at issue in the main proceedings, the Court notes that, if the internet service provider adopts measures which enable it to achieve the required prohibition, the national courts will not be able to carry out such a review at the stage of the enforcement proceedings if there is no challenge in that regard. Accordingly, in order to prevent the fundamental rights recognised by EU law from precluding the adoption of an injunction such as that at issue in the main proceedings, the national procedural rules must provide a possibility for internet users to assert their rights before the court once the implementing measures taken by the internet service provider are known.' (para. 57)

Finally, copyright holders might face continuing (minor) infringements of their copyright, insofar as measures to prevent access may be circumvented and copyright is not an absolute right. Still, 'the measures which are taken by the addressee of an injunction, such as that at issue in the main proceedings, when implementing that injunction must be sufficiently effective to ensure genuine protection of the fundamental right at issue, that is to say that they must have the effect of preventing unauthorised access to the protected subject-matter or, at least, of making it difficult to achieve and of seriously discouraging internet users who are using the services of the addressee of that injunction from accessing the subject-matter made available to them in breach of that fundamental right' (para. 62)

While one cannot but admire the Houdini-like turns the Court takes in order to avoid chaining itself to a fixed balancing of the rights of all stakeholders involved, this judgment leaves many questions unanswered. The judgment re-emphasises EU law's strong right-based approach to access to films and other works through the internet, which is debatable in light of ongoing developments in the digital world. Furthermore, the Court's detailed considerations on the various aspects national judges have to take into account when considering the responsibilities of a service provider in a specific case hardly give any guidance as to the actual measures that may meet all the criteria - neither to national judges nor to internet providers. True, this is to a large extent a technical matter. Yet, it seems that the main burden of finding adequate and reasonable measures to prevent illegal access to information is now put on the internet service providers (and, indirectly, on judges assessing their cases). It may be questioned whether that outcome reflects a 'fair balance' in light of the EU Charter…

For a summary of the judgment, see also the CJEU's press release.

First European Citizens' Initiative endorsed by the Commission

The Initiative's banner

While we most often discuss "normal" commodities, it is not unfrequent to discuss issues which relate very closely to non-market rights of citizens and consumers. The distrinction between market and non-market commodities is not always straightforward and sometimes the European dimension represents a source of additional complexity- and concerns. 

In  the case of water, in particular, the concern with privatisation and universal access to clean, safe water has been at the centre of the first European Citizen Initiative to reach the final stage. The initiative, supported by over 1,5 million European citizens, has been presented before the European Parliament and the Commission in the past weeks. 

Today, the Commission has decided to give a positive response to the initiative- albeit on terms that might leave some of the proponents less-than-enthusiastic.

While Commissioner Šefčovič recalled that "the decision on how best to operate water services is firmly in the hands of the public authorities in the Member States", implicitly excluding any intervention in favour of public water management, he also expressed some important political commitments, namely:

- that the Commission will not pursue further liberalisation of water provision;

- that the domain will be safeguarded from concessions in the context of the on-going TTIP (Transatlantic Trade and Investment Partnership) negotiations between EU and US.

The Commission also announced undertakings in the areas of water safety, transparency in the sector, and supporting an open debate on the concerns raised by the ECI at both European and national level.

Besides the merits of the case, it is interesting for all European citizens (and consumers) to see that a new way of participating in EU-level agenda-setting might be finally gaining some ground.