New Media Internet Expression & European Data Protection

Dr. David ErdosFaculty of Law

University of Cambridge

4 Claims on EU Data Protection & InternetCJEU and European DPAs have adopted an

expansive interpretative stance as regards DP and expression

That paradigm has serious implications for a range of internet actors beyond search engines.

Enforcement has been limited and sporadic.

A focus on enforcement can result in interpretative guidance in severe tension with interpretative stance.

EU Data Protection: Formal Structure

Processing of

Personal Data

Data Quality Principles

Sensitive Data Rules

Transparency Rules

Control Regime

Subject to a number of Exemptions and Derogations

CJEU Stance: Not Much Is ExcludedKey terms of the Directive have a broad

scope:Lindqvist (2003) – “Personal Data”;

“Processing”Satamedia (2008) – “Personal Data” & public

domain

Exemptions are very limitedLindqvist (2003) – general publication coveredSatamedia (2008) – exemptions narrow &

exhaustiveRyneš (2013) – other personal purpose

activities covered

CJEU Stance: Special Purposes not unboundedSatamedia (2008)

Lindqvist (2003)

Google Spain (2014): search engine not within this.

“The Commission submits that an internet page such as that at issue in the main proceedings … constitutes … an artistic and literary creation within the meaning of

Article 9 of that Directive.” (at 33)

Special purposes cover “disclosure to the public of information, opinions or ideas.” (at 62)

CJEU Stance: May be need for balanceLindqvist (2003)

Explicitly extended to the interpretation of transposing law in Promusicae (2008)

“Authorities and courts of the Member States [must] …make sure they do not rely on an interpretation of it [the Directive] which would be in conflict with the

fundamental rights….or with other general principles of Community law, such as inter alia the principle of

proportionality.” (at 87)

CJEU Stance: DP Norms Often OverridingBavarian Lager (2010)

IPI (2013)

“any undermining of privacy and the integrity of the individual must always be examined and assessed in

conformity with the legislation of the Union concerning the protection of personal data” (at 59)

“Article 13 (1) … Member States have no obligation but have the option, to transpose into their national

law one or more of the exemptions which it lays down to the obligation to inform data subjects of the

processing of their personal data.”

CJEU Stance: Other Expansive DecisionsSchrems (2015) on data transfer adequacy

Weltimmo (2014) on local law application within EU

“controller exercises, through stable arrangements in the territory of that Member State, a real and effective

activity – even a minimal one – in the context of which that processing is carried out.”

“the term ʻadequate level of protectionʼ must be understood as requiring the third country in fact to ensure … a level of protection … that is essentially equivalent to that guaranteed within the European

Union”

DP Laws broadly apply to Online Expression

Online

Media

1. News Archive

2. Blogger

3. Social Networke

r

4. Social Networkin

g Site5. Rating Website

6. Search Engine

7. Street Mapping Service

What is the stance of DPAs here?DPAs are even more central than Courts in

this space.Survey run to explore their views (&

enforcement actions)≈80% national EEA DPAs + 6 sub-national

answered• Seven cases involving internet expression specified.• In each case four standard answers presented:

1. DP does not apply2. DP special purposes applies3. General DP applies but need regard for rights4. General DP applies in full

DPA Stance: News Media

Exem

pt

Spec

ial D

erog

ation

Regar

d for

Righ

ts

Full A

pplic

ation

0%20%40%60%80%

100%

4%

67%

26%

4%

News Story

Exem

pt

Spec

ial D

erog

ation

Regar

d for

Righ

ts

Full A

pplic

ation

0%20%40%60%80%

100%

12%

48%32%

8%

News Archive

DPA Stance: Social Media and Blogs

Exem

pt

Spec

ial D

erog

ation

Regar

d for

Righ

ts

Full A

pplic

ation

0%20%

40%60%80%

100%

8%

28%

60%

4%

Blog about Celebrity Gossip

Exem

pt

Spec

ial D

erog

ation

Regar

d for

Righ

ts

Full A

pplic

ation

0%

20%

40%

60%

80%

100%

16%4%

32%48%

Social Networker re: photo tag

Exem

pt

Spec

ial D

erog

ation

Regar

d for

Righ

ts

Full A

pplic

ation

0%

20%

40%60%

80%100%

0% 4%

23%

73%

Social Network re: photo tag

Exem

pt

Spec

ial D

erog

ation

Regar

d for

Righ

ts

Full A

pplic

ation

0%

20%

40%

60%

80%

100%

3% 0%

50% 47%

Teacher Rating Website

DPA Stance: New Web Information Services

Exempt Special Derogation Regard for Rights Full Application0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

0% 0%7%

93%

Street Mapping Service

Exempt Special DerogationRegard for Rights Full Application0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

8%0%

12%

81%

Search Engine

Self-Reported DPA Enforcement: By Actor

(N.B. Chart excludes German Federal & Spanish Catalan DPAs)

Street Mapping

Individual Blogger

Social Network

Social Networker

News Archive

Rating Website

Search Engine

0 10 20 30 40 50 60 70 80 90 100

55

48

48

45

41

41

28

% of Responding DPAs having taken action under Directive

Self-Reported DPA Enforcement: By DPA

Zero One Two Three Four Five Six Seven0%

5%

10%

15%

20%

25%

30%

Number of specified online media actors against which publication enforcement action taken

(N.B. Chart excludes German Federal & Spanish Catalan DPAs)

DPA Interpretative GuidanceDetailed guidance in this area is somewhat

sporadic.

Nevertheless, it is clear that in some cases this can be also very stringent (e.g. social networking)

However, an enforcement focus can lead to the production of guidance sitting in tension with essential stance.

A case in point in this regard may be search engines post-Google Spain.

C-131/12 Google Spain: Core DecisionCJEU confirmed that search engines’ use of

data from web was covered by data protection.

No acknowledgement of freedom of expression.“akin to marching into a library and forcing it to pulp

books”Index on Censorship

“one of the most wide-sweeping internet censorship laws I’ve ever seen”

Jimmy Wales of Wikipedia

EU DPAs Google Spain Guidelines (2014)“Search engine operators …qualify as data

controllers” & their “interest in processing personal data is economic”.

Despite this, the DPA Working Party suggested that they:1. “only have to respond to data subjects’ requests for

the exercise of their rights” with specific URLs i.e. specific & post-hoc.

2. “only affects the results obtained from searches made on the basis of a person’s name” i.e. processing by reference to subject.

3. “a balance of the relevant rights and interests has to be made” i.e. detailed rules on e.g. sensitive data not applied

C-131/12 Google Spain: Obiter

“Inasmuch as the activity of a search engine is … liable to affect significantly, and additionally

compared with that of publishers of websites … the operator of the search engine … must ensure,

within the framework of its responsibilities, powers and capabilities, that the activity meets the

requirements of Directive 95/46 in order that the guarantees … may have full effect and that

effective and complete protection of data subjects … may actually be achieved.” (at [38])

ConclusionsEU (& esp. DPAs) in theory adopts expansive

interpretation of data protection vis-à-vis internet expression.

But enforcement has been very limited and sporadic.

A focus on enforcement can also lead to the production of guidance in severe tension with interpretative stance.

This confused reality will likely continue essentially unchanged under the forthcoming Regulation.