Google v CNIL – The EU Court of Justice Seeks a Via Media on Global Internet Publication and European Data Protection

2020 ◽  
Author(s):  
David Erdos
Author(s):  
Maria Tzanou

This chapter provides an analysis of the data protection rules in EU law, focusing on the constitutional and legal developments after the entry into force of the Lisbon Treaty. It examines the jurisprudence of the Court of Justice of the EU on data protection issues, including the recent decisions of the Court on metadata retention and the new right to be forgotten. It concludes with a critical comment on the possibilities and limitations of the EU to provide for effective and comprehensive data protection.


Author(s):  
David Erdos

This chapter explores the development of European data protection, both as a codified form of regulation and as a human right, from its inception to the present day. In contrast to more ʻclassicalʼ rights, such as freedom of expression and even privacy, data protection only emerged as a discrete concept with the rise of computer power in the 1970s. The focus in Europe from this time has been on elaborating a progressively more detailed and harmonized regulatory code to govern the processing of personal data across the EU and wider European Economic Area (EEA). Advisory Council of Europe Resolutions in the 1970s led to a binding but optional Data Protection Convention in the 1980s, to a mandatory Data Protection Directive in the 1990s, and finally to a General Data Protection Regulation (GDPR) in the 2010s which is directly applicable across the EU. In addition, data protection has increasingly been recognized as a fundamental right and, in particular, was included within the EU Charter that was drafted in 2000 and acquired pan-EU legal status in 2009. These developments have dovetailed with the emergence of a significant body of relevant Court of Justice of the EU (CJEU) jurisprudence. However, the regulatory Data Protection Authorities (DPAs) also remain critical interpretative actors and have issued a number of important opinions including through the Article 29 Working Party that under the GDPR has become the European Data Protection Board.


Author(s):  
Rita De Sousa Costa

[PT]No presente texto, apresentamos as grandes linhas de aplicação do direito europeu da protecção de dados conforme gizadas pela jurisprudência do TJUE, com o objectivo de demonstrar como e em que medida este Tribunal modelou – e continua a modelar – o quadro jurídico em vigor, na certeza de que aquela jurisprudência impõe um conjunto de desafios determinantes para a realização material do direito europeu da protecção de dados pessoais. [ESP]Este texto presenta las líneas generales de la aplicación de la legislación europea de protección de datos tal como se establece en la jurisprudencia del TJUE, con el objetivo de demostrar cómo y en qué medida este Tribunal ha configurado -y sigue configurando- el marco jurídico vigente, con la certeza de que la dicha jurisprudencia plantea una serie de retos cruciales para la aplicación material del derecho europeo de la protección de datos personales. [ENG]This text outlines the implementation of the European data protection law as laid down in the case-law of the Court of Justice of the European Union, with the aim of demonstrating how and to what extent the Court has shaped – and continues to shape – the current legal framework. The case-law analysed points out a plethora of challenges which are key to the implementation of the European personal data protection law.


Author(s):  
Fabiana Accardo

The purpose of this article is that to explain the impact of the landmark decision Schrems c. Data Protection Commissioner [Ireland] - delivered on 7 October 2015 (Case C-362/2014 EU) by the Court of Justice - on the European scenario. Starting from a brief analysis of the major outcomes originated from the pronunciation of the Court of Justice, then it tries to study the level of criticality that the Safe Harbor Agreement and the subsequently adequacy Commission decision 2000/520/EC – that has been invalidated with Schrems judgment – have provoked before this pronunciation on the matter of safeguarding personal privacy of european citizens when their personal data are transferred outside the European Union, in particular the reference is at the US context. Moreover it focuses on the most important aspects of the new EU-US agreement called Privacy Shield: it can be really considered the safer solution for data sharing in the light of the closer implementation of the Regulation (EU) 2016/679, which will take the place of the Directive 95 /46/CE on the EU data protection law?


Author(s):  
Edward L. Carter

The right to be forgotten is an emerging legal concept allowing individuals control over their online identities by demanding that Internet search engines remove certain results. The right has been supported by the European Court of Justice, some judges in Argentina, and data-protection regulators in several European countries, among others. The right is primarily grounded in notions of privacy and data protection but also relates to intellectual property, reputation, and right of publicity. Scholars and courts cite, as an intellectual if not legal root for the right to be forgotten, the legal principle that convicted criminals whose sentences are completed should not continually be publicly linked with their crimes. Critics contend that the right to be forgotten stands in conflict with freedom of expression and can lead to revisionist history. Scholars and others in the southern cone of South America, in particular, have decried the right to be forgotten because it could allow perpetrators of mass human rights abuses to cover up or obscure their atrocities. On the other hand, those in favor of the right to be forgotten say that digital technology preserves memory unnaturally and can impede forgiveness and individual progress. The right to be forgotten debate is far from resolved and poses difficult questions about access to, and control of, large amounts of digital information across national borders. Given the global nature of the Internet and the ubiquity of certain powerful search engines, the questions at issue are universal, but solutions thus far have been piecemeal. Although a 2014 decision by the Court of Justice of the European Union (EU) garnered much attention, the right to be forgotten has been largely shaped by a 1995 European Union Directive on Data Protection. In 2016, the EU adopted a new General Data Protection Regulation that will take effect in 2018 and could have a major impact because it contains an explicit right to be forgotten (also called right to erasure). The new regulation does not focus on the theoretical or philosophical justification for a right to be forgotten, and it appears likely the debate over the right in the EU and beyond will not be resolved even when the new rule takes effect.


2019 ◽  
Vol 15 (2) ◽  
pp. 162-176 ◽  
Author(s):  
Orla Lynskey

AbstractThis paper examines the application of the latest iterations of EU data protection law – in the General Data Protection Regulation, the Law Enforcement Directive and the jurisprudence of the Court of Justice of the EU – to the use of predictive policing technologies. It suggests that the protection offered by this legal framework to those impacted by predictive policing technologies is, at best, precarious. Whether predictive policing technologies fall within the scope of the data protection rules is uncertain, even in light of the expansive interpretation of these rules by the Court of Justice of the EU. Such a determination would require a context-specific assessment that individuals will be ill-placed to conduct. Moreover, even should the rules apply, the substantive protection offered by the prohibition against automated decision-making can be easily sidestepped and is subject to significant caveats. Again, this points to the conclusion that the protection offered by this framework may be more illusory than real. This being so, there are some fundamental questions to be answered – including the question of whether we should be building predictive policing technologies at all.


2020 ◽  
Vol 13 (1) ◽  
pp. 125-152
Author(s):  
Oskar J. Gstrein

The Digital Age has fundamentally reshaped the preconditions for privacy and freedom of expression. This transpires in the debate about a "right to be forgotten". While the 2014 decision of the European Court of Justice in "Google Spain" touches upon the underlying issue of how increasing amounts of personal data affects individuals over time, the topic has also become one of the salient problems of Internet Governance. On 24th September 2019 the European Court of Justice delivered its judgment in "Google vs CNIL" (C-507/17) which was supposed to clarify the territorial scope of the right. However, this judgment has raised doubts about the enforceability of the General Data Protection Regulation, and reveals the complex, multi-layered governance structure of the European Union. Acknowledging such complexity at a substantive and institutional level, this article starts by analysing the judgment. Additionally, to better understand the current situation in the European Union and its member states, recently produced draft guidelines by the European Data Protection Board are presented and discussed, as well as two judgments of the German Federal Constitutional Court. Subsequently, the European developments are put in international context. Finally, the insights from these sections are combined which allows to develop several conceptual ideas. In conclusion, it is argued that the right to be forgotten remains complex and evolving. Its success depends on effective multi-layer and multistakeholder interaction. In this sense, it has become a prominent study object that reveals potential venues and pitfalls on a path towards more sophisticated data protection frameworks.


Sign in / Sign up

Export Citation Format

Share Document