I. INTRODUCTION
Article 8 of the EU Charter of Fundamental RightsFootnote 1 (EU Charter) sets out a right to data protection which sits alongside, and in addition to, the right to privacy in the Charter. This inclusion of an independent right to data protection in the EU Charter differentiates it from other international human rights documents which tend to treat data protection as a subset of the right to privacy.Footnote 2 When the Charter was signed and proclaimed as a solemn political declaration in 2000, the Court of Justice of the EU (CJEU) had yet to recognize the existence of a right to data protection in the EU legal order.Footnote 3 Moreover, the European Data Protection Directive,Footnote 4 enacted in 1995, makes no reference to the right to data protection. Its inclusion in the Charter therefore merits justification. Unfortunately, the Charter's explanatory memorandumFootnote 5 offers little by way of explanation. It laconically states that the right to data protection is based on Article 286 EC,Footnote 6 the Data Protection Directive,Footnote 7 Article 8 ECHRFootnote 8 and the Council of Europe's Convention No 108.Footnote 9 It therefore does little to elucidate why such a new right was introduced, in addition to the pre-existing right to privacy, and how these two rights should interact.
The failure to provide a convincing rationale for the inclusion of a right to data protection in the EU Charter prompted scholars to advance potential justifications. It has been suggested, for instance, that the Charter's right to data protection was introduced in order to bolster the legitimacy of EU data protection law by emphasizing the fundamental rights dimension of the Data Protection Directive.Footnote 10 Indeed, although the Directive's stated objectives are to ensure the free flow of personal data in the EU internal market and to protect fundamental rights, the Directive was legally justified on the basis of internal market considerations alone as the EU lacks competence to enact fundamental rights legislation.Footnote 11 This potential justification is therefore plausible. Nevertheless, it seems unsatisfactory to accept that a new right has been recognized in the EU legal order to provide ex post legitimacy to existing legislation. Moreover, if data protection is a subset of the right to privacy, why would the right to privacy, long recognized by the CJEU as a general principle of EU lawFootnote 12 and set out in the EU Charter, not be sufficient to legitimize the fundamental rights dimension of the EU's data protection framework?
Other scholars suggest that the right to data protection was included in the Charter in order to extend the application of the data protection rules to personal data processing in areas which are explicitly excluded from the material scope of the Data Protection Directive (namely, personal data processing for the purposes of Common Foreign and Security Policy and Police and Judicial Cooperation in Criminal Matters).Footnote 13 This view has received some implicit support from the Article 29 Working Party (A29WP), an advisory group on data protection matters composed of representatives of national data protection authorities.Footnote 14 Indeed, prior to the adoption of the Charter, the EU's Expert Group on Fundamental Rights identified data protection as an area in which the EU's commitment to fundamental rights differed across the three pillars of EU activity.Footnote 15 However, even if this was indeed the rationale when the Charter was enacted in 2000, the right to data protection has not subsequently served this purpose. Although the Lisbon Treaty left less scope for such differentiation (as a result of the collapse of the EU pillar structure as well as the introduction of a legal basis for data protection legislation covering all aspects of Union lawFootnote 16), this differentiation continues to exist. The European Commission's proposed reform package for data protection makes this abundantly clear: the Commission's Proposed RegulationFootnote 17 sets out the general rules applicable to personal data processing, while the Proposed DirectiveFootnote 18 sets out specific rules applicable to personal data processing for the purposes of law enforcement. Consequently, even if the right to data protection was introduced with the objective of ensuring that uniform data protection rules apply in all areas of EU law, it has not achieved this objective. However, what is apparent from this scholarly speculation is that the EU has not adequately justified the introduction of the right to data protection in the EU legal order or explained its content.
The objective of this paper is to examine whether there is, or could be, a credible rationale for introducing an independent right to data protection to the EU legal order. In particular, this paper seeks to ascertain whether data protection is merely a subset of the right to privacy or whether there are grounds to treat it as a self-standing right. At present, conceptions of the role data protection norms should play in society differ greatly between EU Member States. Several continental European jurisdictions refuse to systematically link the application of data protection rules to the right to privacy. For instance, in Germany, the Constitutional Court has held that data protection rights flow from the individual's right to ‘informational self-determination’,Footnote 19 a right which the Court had previously derived from the rights to human dignityFootnote 20 and free development of personalityFootnote 21 in the German Basic Law. In contrast, in the UK, data protection is treated as a subset of the right to privacy with Courts refusing to apply data protection legislation in situations where the right to privacy is not engaged.Footnote 22 However, there has been one recent notable exception to this pattern in the UK, as a judgment of the High Court highlighted the distinction between the two rights in order to limit the justiciability of the Charter right to data protection.Footnote 23 This judgment simply adds further impetus to the need to examine the relationship between the rights to data protection and privacy.
This paper does not purport to take a comparative law approach to data protection. Rather, these differing conceptions of the foundations and purposes of data protection are highlighted because of their practical consequences for the application of EU data protection law by Member States. The Commission's Proposed Regulation, the centrepiece of the EU data protection reform proposals, seeks to achieve further procedural and substantive harmonization of national laws. This begs the question, is such substantive harmonization possible when the central objectives of the right to data protection, which is given expression by EU data protection legislation, are disputed? For instance, would a court in the UK and a court in Germany reach the same conclusion when adopting a purposive approach to the interpretation the Proposed Data Protection Regulation? It seems unlikely. Perhaps more fundamentally however, this lack of clarity regarding the objectives of the right to data protection also detracts from the legitimacy of the EU data protection regime. How can the EU justify the de facto extraterritorial application of its regime or encourage the global application of its data protection standards when it cannot, or does not, articulate the precise purposes of such a regime? The question addressed in this paper is therefore one which is integral to the coherence, proportionality and legitimacy of EU data protection law.
In order to expound a potential rationale for an independent right to data protection, this paper is structured as follows. In section II, the jurisprudence of the CJEU is analysed to see whether it sheds light on the meaning of an independent right to data protection or on the relationship between the rights to data protection and privacy. The analysis of this jurisprudence reveals that the CJEU consistently conflates the two rights which would indicate that the right to data protection is no more than a facet of the right to privacy. This finding is tested in section III by comparing the protection offered by the right to data protection, as given expression in EU data protection legislation, to that offered by the right to privacy, as interpreted by the European Court of Human Rights (ECtHR). A systematic analysis of the protection offered by the two rights reveals that although heavily overlapping, the rights to data protection and privacy are distinct. It is argued that in the context of personal data processing, data protection offers individuals more rights over more types of information than the right to privacy. Consequently, the ‘added value’ of data protection is that it offers individuals enhanced control over their personal data. Section IV suggests that this enhanced control serves two primary functions: first, it strengthens the hand of the individual when faced with power and information asymmetries and, second, it proactively promotes the individuals' personality rights which are threatened by personal data processing. This paper therefore concludes that while the content of the right to data protection overlaps significantly with that of the right to privacy, data protection nevertheless merits recognition as an independent right.
II. THE RIGHT TO DATA PROTECTION BEFORE THE CJEU
The explanation proffered by the EU for the inclusion of a right to data protection in the EU Charter is both vague and circular, as mentioned in section I. The jurisprudence of the CJEU, which will be examined in this section, constitutes one logical starting point for insights into the purpose of this right in the EU legal order and its relationship with the established right to privacy. The examination of this jurisprudence takes place in two stages. The EU Charter became binding on EU Member States with the entry into force of the Treaty of Lisbon in December 2009.Footnote 24 The Court's case law from before this point shall firstly be examined before considering its case law following the Charter's acquisition of binding force.
The reason for this bifurcated examination of the case law is that it might be expected that the CJEU would be less forthright in its support of a self-standing right to data protection prior to the entry into force of the Treaty of Lisbon. This is because, unlike the right to privacy, the right to data protection is not a general principle of EU law recognized on the basis of the common constitutional traditions of Member States, nor is it a right which is explicitly mentioned in the ECHR. From the Court's perspective, it would therefore appear more prudent to emphasize data protection's link to the established right to privacy in those early years rather than carving out an independent existence for this right. The introduction of an explicit legal basis for data protection in the Treaty of Lisbon, which coincided with the Charter acquiring binding force, arguably paved the way for the CJEU to clearly demarcate the distinctions, if any, between these two rights. However, as this section will demonstrate, the CJEU has not seized this opportunity to distinguish between the two rights. Rather, with one exception, the Court's jurisprudence has been characterized by its consistent conflation of the rights to data protection and privacy during the period prior to and after the entry into force of the Lisbon Treaty.
A. The Right to Data Protection in a Pre-Charter Era
In Rundfunk,Footnote 25 one of the earliest cases to appear before the Court of Justice regarding the Data Protection Directive, a national jurisdiction asked the Court to assess the compatibility of a national auditing requirement with the Directive. Austrian legislation stipulated that the salaries of senior public officials must be communicated to the national audit body, transmitted to the Parliament and later made publicly available. In reaching its conclusion, the Court emphasized that the provisions of the Directive must be interpreted in light of fundamental rights, in particular privacy. Therefore, ‘for the purposes of applying the Directive’, the Court systematically examined whether there had been an interference with the right to privacy contrary to Article 8 ECHR and, if so, whether it was justified. In so doing, the Court entirely overlooked the specific rules set out in the Data Protection Directive. In other words, the Court simply substituted privacy rules for data protection rules. As the interpretation of Article 8 ECHR alone was decisive in resolving the dispute, this led to concern regarding the future role and relevance of data protection rules.Footnote 26 Moreover, as Rundfunk treated data protection and privacy as interchangeable, it lent credence to the assertion that data protection is a subset of the right to privacy. Nevertheless, a strong argument could be made to limit the Rundfunk reasoning to its facts as the Court would have reached an identical outcome had it relied on the Directive. Therefore, while the Court should have exercised more caution in substituting the application of secondary legislation with the application of a general principle of EU law, it could not be stated with certainty post-Rundfunk that data protection and privacy were substitutable rights in all circumstances.
In Promusicae Footnote 27 the Court considered whether EU law requires Member States to adopt national legislation placing an obligation on internet service providers (ISPs) to supply the personal data of alleged copyright infringers to copyright holders in order to facilitate civil proceedings. In particular, the Spanish referring court asked the Court of Justice whether a positive obligation to supply such personal data to copyright holders flowed from three EU intellectual property (IP) Directives.Footnote 28 The Court of Justice reformulated the questions asked by the national court by firstly considering whether European Data Protection law, in particular the Data Protection Directive and the E-Privacy Directive,Footnote 29precludes a Member State from laying down such an obligation. It then addressed the question asked by the Spanish Court; whether the three IP Directives require a Member State to adopt legislation setting out such an obligation. Finally, the Court considered what impact the EU Charter, which was not yet binding on Member States, should have on its conclusions regarding the first two questions. It noted that the factual situation involved, on the one hand, the rights to property and to effective judicial protection, and, on the other hand, ‘a further fundamental right, namely the right that guarantees protection of personal data and hence of private life’.Footnote 30 Therefore, while the Promusicae judgment offered some initial promise as the Court raised data protection concerns of its own volition, this promise was short-lived given the Court's reference to the distinct rights to data protection and privacy as one right. Although the Court noted that the E-Privacy Directive ‘seeks to ensure full respect for the rights set out in Articles 7 and 8 of the Charter’Footnote 31 it went on to state in the following paragraph that ‘[t]he present reference for a preliminary ruling thus raises the question of the need to reconcile the requirements of the protection of different fundamental rights, namely the right to respect for private life on the one hand and the rights to protection of property and to an effective remedy on the other’.Footnote 32 Therefore, to the Court data protection is synonymous with privacy.
In the later case of Satamedia,Footnote 33 where the Court was asked to reconcile data protection legislation and the right to freedom of expression, the Court seemingly returned to its pre-Promusicae position. No reference was made to the right to data protection and the Directive was treated as a privacy protection tool. For instance, the Court noted that Article 9 of the Directive seeks to reconcile two fundamental rights: ‘the protection of privacy and freedom of expression’Footnote 34 thereby reflecting the wording of Article 9 of the Directive. In conclusion, it can be stated that during the period prior to the entry into force of the Lisbon Treaty, the right to data protection is considered by the Court of Justice as a subset of the right to privacy which does not merit independent consideration.
However, one judgment of the General Court, the lower instance of the CJEU, sits uneasily with this line of jurisprudence. In Bavarian Lager Footnote 35 the General Court was asked to reconcile the right to data protection with the right of access to documents (also enshrined in the EU Charter). The Bavarian Lager company made a request to the European Commission under EU access to documents legislation (Regulation 1049/2001Footnote 36) for minutes to a particular meeting and the names of the meeting attendees. The Commission would only provide the data in anonymized form on the basis that the information requested contained personal data and the disclosure of the data would not be in compliance with the data protection rules applicable to the EU Institutions (Regulation 45/2001Footnote 37). The General Court was asked to determine whether this Commission decision to refuse the relevant data struck the correct balance between the freedom of information and data protection in the EU legal order.
Article 4(1)(b) of the access to documents regulation determines the relationship between these two rights. It provides that a request for access to a document shall be refused where the document's disclosure would undermine the protection of ‘privacy and the integrity of the individual, in particular in accordance with Community legislation regarding the protection of personal data’. Article 4(1)(b) therefore arguably contains two limbs: access to a document should be refused when ‘disclosure would undermine the privacy and integrity of the individual’ (first limb), ‘in particular in accordance with Community legislation regarding the protection of personal data’ (second limb). The dispute in Bavarian Lager centred upon the interaction between these two limbs. Indeed, Article 4(1)(b) could be read in a number of ways. On the one hand, it could be assumed that the second limb is merely expanding on the first and that the data protection rules should be applied to determine whether disclosure would undermine privacy. Yet, according to an alternative reading of these two limbs, it is only when the first limb is satisfied (ie privacy is undermined) that it is necessary, pursuant to the second limb, to apply the data protection rules. This is the interpretation preferred by the European Data Protection Supervisor (EDPS), who intervened before the Court in Bavarian Lager.Footnote 38 The General Court also seemingly preferred this interpretation as, when applying Article 4(1)(b), it began by examining whether the disclosure of the names of those attending the meeting would breach their Article 8 ECHR right to privacy. It concluded that the disclosure would not result in a violation of the right to privacy and therefore that the Article 4(1)(b) exception was not applicable.Footnote 39 As a result, the General Court held that the application to the request of the ‘additional conditions' set out in the European data protection legislation, such as the need for consent of the data subject, would be contrary to Regulation 1049/2001.Footnote 40 The General Court therefore annulled the Commission decision.
The reasoning of the General Court in this case appears clear; in the absence of a violation of the right to privacy as a result of the disclosure of a document, the data protection rules do not apply. The Court interpreted the wording of Article 4(1)(b) of Regulation 1049/2001 to mean that in cases of conflict between data protection and freedom of information, the data protection rules prevail only when privacy is undermined. When privacy is not undermined, the freedom of information rules prevail over the data protection rules. Therefore, the interpretation of Article 4(1)(b) advanced by the General Court and the EDPS acknowledges that not all data processing adversely affects the right to privacy and, consequently, that data protection applies to a wider variety of personal data processing than privacy law. In other words, the material scope of application of the two rights is distinct. Indeed, this was explicitly stated by both actors. In its pleading before the Court, the EDPS stressed that the interest protected by Article 4(1)(b) is private life, and not the much broader concept of personal dataFootnote 41 while in its judgment the General Court asserted that privacy and data protection are not synonymous.Footnote 42 While De Hert and Gutwirth suggest that the ease with which the General Court distinguished between two types of personal data—those that are protected by the right to privacy and those that are not—‘does not sit comfortably with the formal constitutional codification of data protection within EU law’,Footnote 43 it is suggested here that the opposite may in fact be true. By recognizing that data protection rules could apply even in the absence of an infringement of privacy, the General Court and the EDPS were liberating the data protection rules from the right to privacy and paving the way for the emergence of a truly independent right to data protection in the EU legal order. However, as will be demonstrated presently, the Court of Justice has steadfastly overlooked this distinction in its jurisprudence, even following the entry into force of the Treaty of Lisbon.
B. The Post-Lisbon Jurisprudence of the CJEU
The binding force acquired by the EU Charter as well as the introduction of an explicit legal basis for data protection legislation in the Lisbon Treaty provided the CJEU with the necessary legal tools to elaborate on the content and meaning of an independent right to data protection. However, as this section will demonstrate, the Court has not taken this opportunity to expound a new vision for the right to data protection.
In her Opinion in Volker, delivered soon after the entry into force of the Lisbon Treaty, Advocate General Sharpston clearly distinguished between the rights to data protection and privacy stating that ‘[t]wo separate rights are here invoked: a classic right (the protection of privacy under Article 8 ECHR) and a more modern right (the data protection provisions of Convention No 108)’.Footnote 44 While, unfortunately, the Advocate General did not expand upon the meaning of this distinction, her statement, coupled with the General Court's judgment in Bavarian Lager, should have provided the Court of Justice with food for thought on the differences between the two rights.
However, when the General Court's Bavarian Lager judgment was appealed to the Court of Justice,Footnote 45 the Court of Justice held that the lower instance had erred in law. It found that by limiting the application of the Article 4(1)(b) exception to situations in which the privacy or integrity of the individual would be infringed under Article 8 ECHR, the General Court had disregarded the wording of Article 4(1)(b), which requires that this assessment should be made in conformity with the Union's data protection legislation.Footnote 46 Personal data processing cases could not, according to the Court, be separated into two categories: those examined in light of the ECHR right to privacy and those examined for compliance with European data protection legislation.Footnote 47 Therefore, the Court of Justice concluded that in all situations where access is sought to a document containing personal data EU data protection rules become applicable in their entirety.Footnote 48 The practical consequence of this finding is that EU data protection rules must systematically prevail over the EU rules on freedom of information.
The Court's judgment is noteworthy not only because it allows one fundamental right in the EU Charter to consistently trump another in this manner, but also because of what it reveals regarding the Court's view of the relationship between the rights to data protection and privacy. It follows implicitly from the judgment that even when there is no infringement of the individual's right to privacy (as was arguably the case in Bavarian Lager), the data protection rules trump the freedom of information rules. This begs the question, if the interest being protected by the Court in this instance is not privacy, what is the Court protecting? While the Court did not consider the matter explicitly, the Court may have assumed that a failure to comply with data protection legislation always undermines the right to privacy. In other words, despite the assertions of the EDPS to the contraryFootnote 49 and the findings of the General Court, the Court treats data protection as a subset of the right to privacy. It is unclear whether this represents a conscious choice on the part of the Court or simply highlights that the Court has not given the distinction between the two rights adequate (or perhaps any) consideration. The subsequent Volker judgment seems to point to the latter conclusion. In Volker the Court firstly states that the two rights are ‘closely connected’Footnote 50 before soon thereafter treating them as a hybrid species when it refers to ‘the right to respect for private life with regard to the processing of personal data, recognised by Articles 7 and 8 of the Charter’.Footnote 51
One explanation for the conflation of the two rights by the Court of Justice is that the Court has erroneously interpreted the ECtHR's Article 8 ECHR jurisprudence and applied this interpretation directly to the EU Charter articles. Indeed, in the Volker judgment the Court of Justice states that the Article 7 and 8 rights concern ‘any information relating to an identified or identifiable individual’. It cites the ECtHR judgments in Amann v Switzerland Footnote 52 and Rotaru v Romania Footnote 53 as authority for this assertion.Footnote 54 However, the case law cited does not necessarily support the proposition that Article 8 ECHR applies to ‘any information relating to an identified or identifiable person’. Rather, the ECtHR notes in these cases that the concept of ‘personal data’ is defined in this way in the Council of Europe's Convention No. 108 and states that its own broad interpretation ‘corresponds with that of the Council of Europe's Convention’.Footnote 55 The ECtHR therefore appears to endorse a broad interpretation of the right to privacy rather than to incorporate the definition of ‘personal data’ into its Article 8 ECHR jurisprudence. Indeed, as will be seen in the following section, despite the ECtHR's expansive interpretation of the right to privacy, it is frequently advocated that the right to privacy does not apply to the same wide range of data to which data protection rules apply.Footnote 56
More recently in his Opinion in Google Spain,Footnote 57 Advocate General Jääskinen argued that the scope of application of the EU data protection rules has become ‘surprisingly wide’ and highlighted that ‘the wide interpretation given by the Court to the fundamental right to private life in a data protection context seems to expose any human communication by electronic means to scrutiny by reference to this right’.Footnote 58 As a result, the Advocate General called for what he termed a ‘rule of reason’ approach to the application of the data protection rules.Footnote 59 However, it is suggested that the conflation of the rights to privacy and data protection caused confusion in the Advocate General's Opinion. It is not ‘the fundamental right to private life in a data protection context’ which is given a wide interpretation. Rather, it is argued here that it is the fundamental right to data protection which is in fact more widely interpreted—and broader in scope—than the right to privacy. The Advocate General overlooks the fact that data protection rules were purposely designed to be broader in scope than the right to privacy by the EU legislature and seems to suggest that technological development is responsible for their wide application. As will be demonstrated in the next section, this is a false assumption.
A clear picture emerges from the few data protection cases which have appeared before the CJEU both prior to and following the entry into force of the Treaty of Lisbon. Contrary to the instinct of the General Court, the Court of Justice deems the newly articulated right to data protection to be nothing more than a subset of the right to privacy thereby putting ‘new wine in old bottles’.Footnote 60 This paper shall argue that, despite the jurisprudence of the CJEU, data protection and privacy are distinct, albeit heavily overlapping, rights and that there is adequate justification to treat them as such. However, at present, the conflation of these two rights by the Court of Justice risks subjecting the modern right of data protection to the limitations that have been imposed on the ‘classic’ right to privacy thereby stunting its development. It also precludes debate, both inside and outside the Court, of what independent objectives data protection pursues and how best to reconcile these objectives with competing rights and interests.
III. DIFFERENTIATING DATA PROTECTION: LESSONS FROM THE EUROPEAN COURT OF HUMAN RIGHTS
In this section, the key distinctions between the protection offered by the right to data protection, as given expression in EU secondary legislation, and the right to privacy, set out in Article 8 ECHR, will be identified. This can be done by comparing the scope and safeguards offered by EU data protection law to the scope and safeguards offered by the right to privacy (the latter can be deduced from the jurisprudence of the ECtHR).Footnote 61 It is argued in this section, that the right to data protection includes a broader range of data and data-related actions within its scope and guarantees more data-processing related rights to the individual than the right to privacy.Footnote 62 In other words, data protection offers individuals more control over more types of data than the right to privacy. Data protection should therefore be conceived as a right which heavily overlaps with the right to privacy yet offers distinct, additional benefits for individuals.
A. The Broader Range of Data and Data-Related Actions Covered by the Right to Data Protection
In this part it shall be demonstrated that the material scope of application of the data protection rules—determined by what constitutes ‘personal data’ and ‘personal data processing’—is broader than the concept of ‘privacy interference’ which defines the scope of application of Article 8(1) ECHR.
1. The broader range of data
The right to data protection, as given expression by EU data protection legislation, applies to personal data: that is, data relating to an ‘identified’ or ‘identifiable’ natural person.Footnote 63 The notion of ‘personal data’ was purposely defined as broadly as possible by the European legislature in order to include all data which might be linked to an individual.Footnote 64 Indeed, despite the ECtHR's expansive interpretation of the notion of privacy,Footnote 65 it is argued that the right to privacy does not apply to the same wide range of data to which the data protection rules apply.Footnote 66 Two distinctions regarding the range of data falling within the scope of both rights can be observed: first, unlike the notion of ‘privacy interference’, the concept of ‘personal data’ is not context-dependentFootnote 67 and, second, the concept of personal data includes data relating to unidentified yet identifiable individuals.
The jurisprudence of the ECtHR often conflates its analysis of, first, whether a prima facie privacy interest exists and, second, if so, whether there is an interference with this privacy interest. This makes it difficult to directly compare the notions of ‘privacy interest’ and ‘personal data’ although these notions determine the scope of the rights to privacy and data protection respectively. The ECtHR's conflated analysis also however demonstrates that the notion of ‘privacy interest’ is often circumstance-dependent and requires a contextual assessment. For instance, the assessment of whether an individual has a privacy interest in his name is context-dependent. The facts of the Bavarian Lager case illustrate this point well as it was questioned whether an individual has a privacy interest in his name when he is appearing before a public authority in a professional capacity. Advocate General Sharpston argued in her Opinion that names fall within the scope of Article 8 ECHR and therefore the disclosure of a name, even in a business context, constitutes a potential interference contrary to the ECHR. In contrast, the EDPS argued that no such privacy interest existed in Bavarian Lager as ‘the disclosure of a name in the context of professional activities does not normally have a link to private life’.Footnote 68 Similarly, the General Court inferred that there was not a privacy interest at stake in that case. Although the General Court merged its consideration of whether a privacy interest exists and whether it had been undermined, in so doing it highlighted that even though professional activities are not in principle excluded from the concept of private life under Article 8 ECHR, the mere fact that a document contains personal data does not mean that the privacy or integrity of the persons concerned is affected.Footnote 69 This, it is argued, is the preferred finding.Footnote 70 However, what is notable for present purposes is that there is a clear lack of consensus regarding whether, and if so in what circumstances, an individual has a privacy interest in his name. In contrast, as the EDPS highlighted, ‘a reference to the name of a participant in the minutes of a meeting constitutes personal data’.Footnote 71 Thus, it can be seen that while the question of whether a ‘privacy interest’ exists in particular circumstances requires a context-dependent assessment, whether data constitutes personal data can be an easier issue to assess.
Furthermore, as mentioned above, data protection rules apply to processing of data that relates to an identified or identifiable person.Footnote 72 In this regard, data protection rules apply where identification is possible, regardless of whether or not identification occurs. However, in some Article 8 ECHR proceedings emphasis is placed on whether or not an individual is actually identified when considering whether there is a breach. For instance, in Friedl Footnote 73 the applicant complained that there was an interference with his right to privacy when the police took a photograph of him participating in a public demonstration. The European Commission of Human Rights (ECommHR)—a predecessor of the ECtHR—struck the case off the list, explicitly attaching weight to the fact that no action was taken to identify the persons photographed by means of data processing.Footnote 74 Therefore, it is suggested that the notion of personal data is broader than the interest protected by the right to privacy. Moreover, as will now be demonstrated, the concept of ‘personal data processing’ which also helps delimit the scope of application of the right to data protection is clearly more expansive than that of ‘privacy interference’,Footnote 75 which determines what falls within the scope of the right to privacy.
2. The broader range of data-related activities
For the purposes of EU law, data processing is defined as ‘any operation or set of operations which is performed upon personal data, whether or not by automatic means’ and could, therefore, encompass any form of data handling.Footnote 76 As Kuner highlights ‘it is difficult to conceive of any operation performed on personal data in electronic commerce which would not be covered by it’.Footnote 77 While the ECtHR is willing to include even publicly available data within the scope of Article 8 ECHR provided it is systematically collected or stored, it is submitted that the notion of ‘personal data processing’ is nevertheless more inclusive than that of ‘privacy interference’. Some examples will help to illustrate this point.
In the case of Pierre Herbecq and the Association ‘Ligue des droits de l'homme’ v Belgium,Footnote 78 the ECommHR declared that an application was manifestly ill-founded and therefore inadmissible. In their application, the applicants challenged the Belgian government's failure to enact legislation concerning filming for surveillance purposes where the visual data obtained was not recorded. The ECommHR examined, inter alia, whether the visual data related to private matters or public incidents and whether it was likely to be made available to the general public. It held that, since nothing was recorded, it was difficult to see how the footage could be made available to the general public or used for alternative purposes. The ECommHR also noted that all that could be observed is ‘essentially public behaviour’. Therefore this recording, which would constitute personal data processing and therefore fall within the scope of the right to data protection, was excluded from the scope of the right to privacy.
In the EU Court of Justice's Rundfunk Footnote 79 judgment it also implicitly acknowledges this distinction. The Court noted that ‘the mere recording by an employer of data by name relating to the remuneration paid to his employees cannot as such constitute an interference with private life’ under Article 8 ECHR.Footnote 80 However, such recording would constitute ‘data processing’ and thus fall within the scope of the right to data protection.
It is possible to think of numerous other day-to-day examples of data processing which falls within the scope of the right to data protection but arguably not privacy. For instance, if a student competes for her university athletics team, the name and age category of the student may be published on the university webpage. This publication constitutes data processing and would fall within the scope of the right to data protection. However, such an act would not fall within the scope of the right to privacy as the information concerned constitutes publicly available data which is not systematically collected or stored. Moreover, it is arguable that the student should have reasonably expected her personal data to be processed in this way.Footnote 81 It can, therefore, be concluded that EU data protection rules, which give expression to the right to data protection, apply when data is manipulated in ways which would not be subject to privacy protection,Footnote 82 although this subtle distinction is increasingly difficult to discern.
B. The Limited Range of Information Rights Covered by Article 8 ECHR
Not only is the scope of the right to data protection different to that of the right to privacy, the substantive protection offered by both rights also differs. Many of the rights provided for in the EU data protection regime have been encompassed in the ECtHR's Article 8 ECHR jurisprudence. When considering whether the collection or storage of data is in accordance with the law and is proportionate under Article 8(2) ECHR, the ECtHR has taken the opportunity to enumerate a number of requirements which must be respected. These requirements effectively mirror the principles relating to data quality set out in both the Data Protection DirectiveFootnote 83 and the Proposed RegulationFootnote 84 (for example, that data should be ‘preserved in a form which permits identification of the data subject for no longer than is required for those purposes’Footnote 85). Moreover, the jurisprudence of the ECtHR is constantly evolving and, in recent years, its evolution has encompassed rights offered by data protection law. For instance, although the ECtHR initially refused to acknowledge that a data subject had a general right of access to his personal data,Footnote 86 in later judgments it went a long way towards introducing such a general right of access for individuals.Footnote 87
There is therefore considerable, and growing, overlap in terms of the substantive protection offered to individuals by the EU right to data protection and the ECHR's right to privacy. Nevertheless, some rights granted by the EU data protection regime are not referred to in the Article 8 ECHR jurisprudence, for instance the individual's right not to be the subject of a decision which significantly affects him and is based on automatic processing.Footnote 88 It is submitted that this type of right is designed to tackle non-privacy related concerns, such as power asymmetry between individuals and those who process their data.Footnote 89 This differentiation in terms of substantive protection would be made more conspicuous if the Proposed Regulation was adopted in its present form. For example, although privacy law might recognize the right of the data subject to ensure the erasure of his personal data in certain instances, it does not recognize anything akin to the ‘right to be forgotten’ set out in the Proposed Regulation.Footnote 90 Moreover, the ECtHR case law does not recognize a right to data portability.Footnote 91 This confirms that the objective of such a right is not to protect individual privacy; it must therefore serve a different, independent objective.
In conclusion, when determining whether the protection offered by Article 8 ECHR is coextensive to that offered by the right to data protection, it can be seen that the two differ in terms of scope and also the substantive protection they offer. Therefore, it is suggested that the rights to data protection and privacy are significantly overlapping yet distinct. In this regard, the Proposed Regulation is perhaps an indicator of future direction as it clearly illustrates that EU data protection law includes elements within its scope which do not fit easily under a privacy umbrella. These other elements are therefore what distinguish the right to data protection from the right to privacy. In the following section, a justification for the distinction between these two rights will be offered.
IV. THE VALUE-ADDED OF A RIGHT TO DATA PROTECTION IN THE EU LEGAL ORDER
The rights to data protection and privacy serve many of the same objectives. Both privacy violations, such as unauthorized surveillance, and personal data processing can have a ‘chilling effect’ on individuals causing them to feel monitored and consequently modify their behaviour, for instance. The rights to data protection and privacy help to deter and regulate such unauthorized surveillance or dataveillanceFootnote 92 allowing individuals to behave in an uninhibited manner and to exercise the rights guaranteed in democratic societies, such as freedom of expression and association, without fear of repercussion.Footnote 93 The fact that data protection and privacy promote many of the same goals is consistent with the finding in section III that the two rights are heavily overlapping. However, it was also established in section III that data protection grants individuals more rights over more personal data than the right to privacy. The aim of this section is to elucidate an explanation for this finding.
A. The Functions of an Independent Right to Data Protection
According to the Data Protection Directive its aim is to ‘protect the fundamental rights and freedoms of natural persons, in particular their right to privacy with respect to the processing of personal data’ and to ensure that states do not restrict or prohibit data flows for reasons connected with the protection offered to individuals. The Directive does not elaborate on these rather vague objectives. Nor, looking at this issue from an alternative angle, have the harms which EU data protection law seeks to prevent or mitigate been identified by the EU Institutions. This failure to identify the objectives of the law is remiss, particularly at a time when the legislative framework for data protection is in flux and there is increasing support for a ‘risk-based’ approach to data protection law. This part therefore seeks to identify the functions of an independent right to data protection.
The data protection rules, which give expression to the right to data protection, are arguably more effective than the right to privacy at minimizing the risk for individuals of certain tangible harms caused by data processing.Footnote 94 Take the example of discrimination. Data protection reduces the risk of discrimination by decreasing the possibility that proxies or presumptions will be used to make decisions which negatively affect individuals. This is because data protection prohibits decision-makers from taking decisions which are likely to significantly affect the individual based solely on automated data processing.Footnote 95 Accordingly, human attention must be given to an individual's personal data before a decision can be made which may significantly affect that individual, arguably therefore making direct and indirect discrimination more difficult. For instance, an employer cannot automatically refuse to consider all applicants aged over 30 from a job selection process (direct discrimination) nor could the employer exclude all candidates whose University qualifications were acquired over ten years ago from the process (indirect discrimination).Footnote 96
Equally, it could be argued that the right to data protection is distinct from the right to privacy as it provides tools to minimize the risk of identity theft. As has been noted in a European Commission report, ‘the creation of centralised databases of identifying data … represents in principle a single point of vulnerability for large-scale identity theft and it would be reasonable, on these grounds alone, to try to minimize the number of such databases'.Footnote 97 While, paradoxically, data protection rules may encourage and facilitate the creation of such centralized databases, these data protection rules also reinforce the vulnerable architecture of such databases thereby reducing the risk of identity theft. For instance, pursuant to data protection rules there is an obligation on data controllers to ‘implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access’.Footnote 98 Pursuant to the Proposed Regulation, competent data protection authorities and the data subject must be informed when there is a data breach.Footnote 99 However, beyond the prevention or minimization of such tangible harms, it is submitted that the right to data protection is distinct from, and adds value to, the right to privacy in two key ways.
1. Promoting informational self-determination and individual personality rights
Personal data processing poses multiple challenges to individual development. As previously mentioned, surveillance conducted via data processing can have a chilling effect on individual behaviour. Crucially, whether or not an individual is actually being monitored is not decisive in these circumstances: the mere perception of surveillance may be sufficient to inhibit individual behaviour. Indeed, this is the premise on which Jeremy Bentham's famous Panopticon architectural design is based: the potentially ‘all-seeing’ structure of the Panopticon assures the ‘automatic functioning of power’.Footnote 100 Such surveillance, which both privacy and data protection seek to deter, can hinder individual development by leading to conformity and ‘an unarmed occupation of individuals’ lives'.Footnote 101 However, surveillance—actual or perceived—is not the only such obstacle to personal development.
An individual may feel more or less inhibited in different circumstances. For instance, a student may feel comfortable discussing his thoughts on government immigration policy in a student bar with his friends but may feel less comfortable discussing the same topic in his local town or with his family. Stated otherwise, an individual's public persona may have mutliple facets. Consequently, individuals may want to engage in what this paper terms ‘selective presentation’: presenting to others only those parts of themselves which they want those others to see. Such selective presentation enables individuals to put forth different versions or aspects of themselves in different contexts. Consequently, those in work may see one side, those at home will see another while those at social events or competitions may see yet another side again.Footnote 102 This differentiation in terms of how people present themselves to others is an accepted part of daily life. For example, the possibility on social networking sites, such as Google+ and Facebook, to limit the availability of certain content to only specific contacts is a reflection of this fact. Equally, individuals frequently tailor the content of what they express to their target audience: few would speak as frankly to their boss about their work as they would to their spouse, for instance. The merging of the various facets of an individual's persona can have serious tangible consequences. For example, anecdotal evidence would suggest that individuals have been denied employment or access to certain universities on the basis of the personal data they have made available on social networking sites.Footnote 103 However, perhaps more significantly the merging of personas can also have a censoring effect on individual behaviour and expression similar to that engendered by surveillance.Footnote 104 Indeed, it has been documented that individuals make less effort to tailor how they present themselves and have fewer inhibitions when fewer people are around.Footnote 105
It is suggested that the right to data protection more effectively facilitates ‘selective presentation’ than the right to privacy thereby promoting self-development and the personality rights of individuals. While the right to privacy is a broad notion which is ‘not susceptible to exhaustive definition’ and which lends support to the ‘autonomous capacities of individuals to act and cooperate’,Footnote 106 a right to self-determination has not yet been established in the ECtHR's Article 8 jurisprudence.Footnote 107 Indeed, informational self-determination is not explicitly mentioned in Article 8 of the EU Charter despite the fact that draft formulations of the right to data protection in the Charter had a greater emphasis on the notion of informational self-determination. For instance, the draft of the Charter dating from 5 May 2000 provided that ‘[e]veryone has the right to determine for himself whether his personal data may be disclosed and how they may be used’.Footnote 108 A number of factors may explain the late change of wording of the Charter text. For example, ‘informational self-determination’ may have been perceived by the drafters as more closely aligned to the German legal systemFootnote 109 than was appropriate in the pluralistic EU legal order.
Nevertheless, despite the departure from the concept of informational self-determination in the final wording of the Charter right, it is argued that this concept remains a central tenet of the right to data protection and one which distinguishes it from the right to privacy.Footnote 110 The additional rights granted to individuals by data protection, such as the right to data portability, allow individuals to better determine how their data is processed, by whom and for what purposes. In other words, they promote informational self-determination. This informational self-determination allows individuals to self-present: by providing individuals with more control over their personal data, they can reveal different elements of their personality to different audiences in contrast to the ‘one size fits all’ revelations which characterize a lack of control over personal information.
Moreover, the idea that informational self-determination is not an end in itself but rather serves to promote the individual's right to personality (whether through freedom from unauthorized surveillance or by facilitating individual self-presentation) is one which has been endorsed by the German Constitutional Court. In its 1983 Population Census decisionFootnote 111 the Court held that that the right to informational self-determination of individuals is itself based on the right to personality and human dignity.Footnote 112 This perspective has also been endorsed by data protection scholars such as Rodotà who observed that the EU had ‘reinvented’ data protection by turning it into ‘an essential tool to freely develop one's personality’.Footnote 113
2. Data protection as a positive right to reduce information and power asymmetries
The second benefit which data protection offers is that it is a proactive tool to reduce power and information asymmetries as it strengthens the hand of the individual vis-à-vis data controllers and processors. In this regard, the regulatory origins of the right to data protection become apparent as these power and information asymmetries are market failures which data protection legislation seeks to correct.Footnote 114 Power asymmetries are present when one party in a relationship is in a position of strength relative to the other while information asymmetries are present when one party in a relationship is in possession of more information than another.Footnote 115 Power and information asymmetries therefore lead to an unbalanced relationship between individuals (or data subjects) and other data processing actors. Information technology often serves to exacerbate the problem.Footnote 116
Purtova notes that as a result of such power asymmetries ‘an individual is almost always a weaker party who is unable to protect his interests without state intervention’.Footnote 117 The position of relative weakness of the individual is problematic for several reasons. First, information asymmetries make it more difficult for individuals to make an informed choice about whether to allow their personal data to be processed, in particular because it is difficult for individuals to assess the likelihood that the use of their data will result in harm and the seriousness of this potential harm.Footnote 118 Secondly, information asymmetries can also constitute an obstacle which individuals must surmount in order to hold those who process their personal data accountable. Individuals are often unable to identify the responsible actors as a result of these information asymmetries.Footnote 119 Thirdly, information and power asymmetries also clearly disadvantage the bargaining position of an individual vis-à-vis a data processor or controller. For instance, Rotenberg has convincingly argued that the effect of data profiling is that ‘consumers give up the privacy of their reservation price but the seller doesn't’. In this way, the balance of power in a transaction (for instance, the purchase of flights online) is tipped in favour of the profiler to the detriment of the consumer.Footnote 120
Information and power asymmetries can also have less immediately discernible effects however. Broadly speaking, these asymmetries can have a negative impact on individual autonomy.Footnote 121 This is because individuals may feel helpless when faced with such asymmetries. As Dyson highlights, ‘[N]o one knows what is known and what isn't. It's the one-way mirror effect that makes people so uneasy’.Footnote 122 Indeed, Solove argues that it is incorrect to frame the problems engendered by personal data processing in Orwellian ‘Big Brother’ terms on the basis of surveillance. Rather, he suggests that the harm which data processing causes relates to the sense of powerlessness felt by individuals in the face of personal data processing.Footnote 123 Solove therefore describes the problem as Kafkaesque:Footnote 124 data processing alters the relationships that individuals have with those making decisions about their lives. Similarly, Glancy notes that the movements of individuals can increasingly be tracked without their knowledge, and that ‘the realisation that such centralised tracking is possible impresses a profound sense of powerlessness upon an individual and affects her choices about where, and where not, to go’.Footnote 125
It is suggested that the right to data protection goes further than the right to privacy in mitigating and rectifying these power and information asymmetries by anticipating that ‘individuals … have difficulty asserting their preferences for privacy protection’ and therefore providing for norms which balance individual interests against those of public and private sector entities.Footnote 126 Indeed, the Dutch Government explicitly rejected the recognition of a constitutional right to informational self-determination ‘fearing that such a right would tilt the balance between the individual and the state too far in favour of the data subject’.Footnote 127 How then does the right to data protection help mitigate and redress these power and information asymmetries? The right to data protection, as given expression by data protection regulation, helps to readjust the balance of power between the individual data subject and those who process personal data primarily by ensuring that the latter ‘adhere to established limits on the way they use personal information’ without which individuals feel powerless.Footnote 128 One such obvious limitation is the principle of purpose limitation according to which personal data must be ‘collected for specified, explicit and legitimate purposes and not be further processed in a way incompatible with those purposes’.Footnote 129 Indeed, Article 8 of the EU Charter explicitly reiterates this principle when it states that data must be processed for specified purposes. This principle helps to create an ‘informational division of powers’Footnote 130 as personal data cannot be freely exchanged in and between public and private bodies: it can only be processed and exchanged for specified purposes.Footnote 131
The EU's Proposed Data Protection Regulation, which like the Data Protection Directive gives expression to the right to data protection, also contains several provisions which seek to redress these power and information imbalances. Take the following examples. First, pursuant to the Proposed Regulation consent will not constitute a valid legal basis for data processing when there is a clear imbalance of power between individuals and the data controller.Footnote 132 The Regulation states that this is especially the case where the data subject is in a situation of dependence on the controller and provides the example of when personal data of an employee are processed by an employer in the employment context.Footnote 133 The UK regulator, the Information Commissioner's Office (ICO), has correctly highlighted that this broad claim—that consent should be invalid where there is a ‘significant imbalance’ between the data subject and the controller—requires qualification.Footnote 134 Indeed, it could be argued that this tips the balance of power too much in favour of the data subject: it is easy to think of examples where employer data processing is in fact data subject led, for instance when an employee consents to personal data processing to join a subsidized cycle-to-work scheme. Secondly, the Proposed Regulation now explicitly requires consent to be ‘opt-in’ in order to be valid.Footnote 135 This ‘opt-in’ default setting means that the data subject must indicate his or her agreement to the data processing ‘either by a statement or by a clear affirmative action’.Footnote 136 Such an opt-in default setting can reduce information asymmetries as it is ‘information-forcing’ in so far as it places ‘pressure on the better-informed party to disclose material information about how personal data will be used’.Footnote 137 Thirdly, the Proposed Regulation seeks to render the rights of data subjects more effective. For instance, it imposes an obligation on controllers to adopt procedures and mechanisms to respond to data subject access requests within set deadlines and to give reasons in the event that they refuse to take action.Footnote 138 These more effective rights strengthen the hand of the individual data subject vis-à-vis those who process personal data.
In this section, it has been argued that the right to data protection grants individuals more control over more data than the right to privacy for two primary reasons: first, to promote informational self-determination which itself flows from the individual's right to personality and second, to redress detrimental power and information asymmetries between data subjects and those that process their personal data. Indeed, De Hert and GutwirthFootnote 139 argue that while privacy is a tool which facilitates individual opacityFootnote 140 as it protects individuals from intrusion, data protection promotes transparency and accountability.Footnote 141 While in practice the distinction between privacy and data protection may be more nuanced—as the right to privacy has evolved beyond protecting intrusion into seclusion and data protection can also protect individuals from such intrusion—this distinction serves to highlight that data protection constitutes a positive instrument which seeks to equip the individual to cope with personal data processing.
Given the significant overlap between the rights, some may nevertheless seek to argue that this distinction is merely an academic one with little practical significance. Indeed, as was demonstrated in section II, the EU's highest jurisdiction, the Court of Justice, continues to conflate the two rights. However, it is argued that clarity on the distinction between the two rights is necessary for two reasons. Firstly, and perhaps most crucially, the continued conflation of these rights stunts the development of the right to data protection with the risk that its ‘added value’—its potential to foster the individuals' right to personality and reduce information and power asymmetries—will be overlooked. Secondly, the current lack of consensus in EU jurisdictions regarding the relationship between these rights jeopardizes the harmonized application of EU data protection rules. Take the following example. In the English case of R v Brown (Gregory Michael) Footnote 142 the defendant, a police officer, accessed the Police National Computer (PNC) database on two occasions to assist a friend who ran a debt-collection agency by checking vehicles owned by debtors from whom the agency had been employed to recover debts. No personal data was retrieved on the first occasion; on the second occasion, personal data was revealed but no subsequent use was made of that data. The defendant was charged with the criminal offence of ‘use’ of personal data for purposes other than those permitted, contrary to the UK's Data Protection Act. On appeal, the House of Lords rejected the prosecution's contention that the offence was committed as soon as personal data were retrieved from the computer with the intention of using the information for an unregistered purpose. The House of Lords held that something had to be done with the data beyond accessing them in order for criminal sanctions to ensue. Clearly, if a purposive approach to data protection was taken in this context, it could be argued that the access to the personal data on the PNC database for entirely unauthorized purposes exacerbated the power asymmetries between the police officers—the data controllers —and the individual and therefore the data protection rules should apply. However, in advocating a narrow definition of the term use, Lord Goff ignored these purposes of the Act by arguing that ‘the statutory purpose of the Act is to protect personal data from improper use (or disclosure)’.Footnote 143 While this case can be confined to its facts as it involves the imposition of a criminal penalty,Footnote 144 it nevertheless demonstrates the importance of clearly identifying the objectives of the right to data protection in the EU. A court in a different jurisdiction taking a different view of the purposes of the right to data protection (for instance, acknowledging that it seeks to promote informational self-determination) could easily have reached the opposite conclusion on the same facts. In this way, a lack of consensus regarding the role of intangible harm in the interpretation and application of EU data protection law also undermines data protection's market integration objective.
V. CONCLUSION
The summer 2013 revelations that the US and UK government engaged in large-scale individual surveillance based on data gathered by or transmitted on behalf of private entities had the positive effect of pushing personal data protection to the forefront of public consciousness. Data protection has occupied this prominent position on the legislative agenda in the EU since the Commission published its proposed reform package in January 2012. This reform package is largely touted as the most contentious and lobbied piece of legislation to ever pass through the EU legislative process with over 4,000 amendments to its text proposed during its initial reading by the European Parliament. Data protection is therefore beginning to take shape and gain importance in the eyes of the public as well as policymakers. The aim of this paper was to explore the relationship between this key right in the EU legal order and the existing right to privacy. It demonstrates that, to date, the right to data protection has been treated as a subset of the right to privacy by the CJEU. However, it argues that this conflated vision of the two rights is misconeived and that the right to data protection provides individuals with more control over more personal data than the right to privacy. This enhanced control, it is submitted, serves two key purposes: first, it promotes the right to personality of individuals through informational self-determination and second, it reduces the information and power asymmetries which can have a negative impact on individual autonomy. At a time when personal data processing has reached an unprecedented scale, the benefits of this enhanced individual control should not be overlooked as readily as they have been to date by the CJEU. It is time to recognize the merits of a truly independent right to data protection.
