Data protection as a fundamental right and the proposal for a General Data Protection Regulation

1. Data protection as a fundamental right and the proposal for a General Data Protection Regulation  Giuseppe Francesco AIELLO Phd candidate at ScuolaSuperioreSant’Anna, Pisa g.aiello@sssup.it Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

2. Privacy & Data protection • E.U. vs. U.S. • The right to be forgotten • The impact of the Lisbon Treaty on the data protection legislation. • The Regulation Proposal Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

3. Facebook psychological experiment on users The experiment was to find if Facebook could alter the emotional state of its users and prompt them to post either more positive or negative content. The researchers tested whether reducing the number of positive messages people saw made those people less likely to post positive content themselves. Would scrubbing posts with sad or angry words from someone’s Facebook feed make that person write fewer gloomy updates? The British Information Commissioner's Office (ICO) started an investigation concerning an eventual infringement of data protection laws. Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

4. E.U.-U.S. PRIVACY COLLISIONPaul M. Schwartz(2013) Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

5. The EU approach to the protection of privacy rights is spreading outside its boundaries. THE BRUSSELS EFFECTAnu Bradford, NORTHWESTERN UNIVERSITY LAW REVIEW, 2012 Europe’s unilateral power to regulate global markets: “RACE TO THE TOP”. Multinational corporations have adjusted their global data management systems to reduce their compliance costs with multiple regulatory regimes U.S. firms active in the EU market comply with EU privacy rules even when their data are processed in the United States. Privacy by design. Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

6. Samuel Warren and Louis BrandeisThe Right to Privacy, 1890 “What Judge Cooley calls the right «to be let alone»” « Le but des modernes est la sécurité danslesjouissancesprivées ; et ilsnommentlibertélesgarantiesaccordées par lesinstitutions à cesjouissances. » (B. Constant, 1819) “It is like the right not be assaulted or beaten, the right not be imprisoned, the right not to be maliciously prosecuted, the right not to be defamed. In each of these rights, as indeed in all other rights recognized by the law, there inheres the quality of being owned or possessed - and (as that is the distinguishing attribute of property) there may some propriety in speaking of those rights as property” Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

7. The fortune of Warren & Brandeis’ privacy • In the U.S. Supreme Court, Kyllo v. UnitedStates, 533 U.S. 27 (2001) it’scited by the majority and even in dissent. • Bundesgerichtshof [BGH] [Federal Court of Justice] Dec. 19, 1995 • Opinion Of Advocate GeneralJääskinen(25 June 2013) on the Google Spain case. Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

8. “the sacred precincts of private and domestic life” (Warren-Brandeis) ECHR art. 8Right to respect for private and family life 1. Everyone has the right to respect for his private and family life, his home and his correspondence. … CFREU, Article 7 Respect for private and family life Everyone has the right to respect for his or her private and family life, home and communications. Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

9. German “informationalself-determination” • BundesverfassungsgerichtVolkszählungsurteil, 1983 The worth and dignity of individuals, who through free self-determination function as members of a free society, lie at the core of the constitutional order. Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

10. Any content including personal data can instantly and permanently be made accessible in digital format world wide. Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

11. “The biggestthreat to free speech on the Internet in the comingdecade” (Rosen) ECJ, C-131/12, 13 may 2014, Google Spain SL, Google Inc. / AgenciaEspañola de Protección de Datos Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

12. Lisbon Treaty CFREU, Article 8 Protection of personal data 1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consentof the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 3. Compliance with these rules shall be subject to control by an independent authority. • New legal basis • Interference  of directives and regulations with the rights laid down in articles 7, 8 and 11 of the Charter • The right to data protection must be considered in relation to its function in society Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

13. The right to protection of personal data is not an absolute right • It must be considered in relation to its function in society Other potentially affected fundamental rights enshrined in the Charter are the following: • freedom of expression (Article 11 of the Charter); • freedom to conduct a business (Article 16); • the right to property and in particular the protection of intellectual property (Article 17); • the prohibition of any discrimination amongst others on grounds such as race, ethnic origin, genetic features, religion or belief, political opinion or any other opinion, disability or sexual orientation (Article 21); • the rights of the child (Article 24); • the right to a high level of human health care (Article 35); • the right of access to documents (Article 42); • the right to an effective remedy and a fair trial (Article 47). Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

14. CGUE, (GrandChamber) 8 April 2014, C‑293/12 and C‑594/12, Digital Rights Ireland Ltd Directive 2006/24 harmonising Member States’ provisions concerning the retention of data in order to ensure that the data are available for the purpose of the prevention, investigation, detection and prosecution of serious crime. To establish the existence of an interference with the fundamental right to privacyit does not matter whether the information on the private lives concerned is sensitive or whether the persons concerned have been inconvenienced • Article 52(1) of the Charter provides that any limitation on the exercise of the rights and freedoms laid down by the Charter must be • provided for by law, • respect their essence • and, subject to the principle of proportionality. Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

15. Article 16 TFEU 1. Everyone has the right to the protection of personal data concerning them. 2. The European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities. … Article 286 TEC 1. From 1 January 1999, Community acts on the protection of individuals with regard to the processing of personal data and the free movement of such data shall apply to the institutions and bodies set up by, or on the basis of, this Treaty. 2. Before the date referred to in paragraph 1, the Council, acting in accordance with the procedure referred to in Article 251, shall establish an independent supervisory body responsible for monitoring the application of such Community acts to Community institutions and bodies and shall adopt any other relevant provisions as appropriate. Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

16. Changes in the aim of the E.U. legislation Directive 95/46 • ensuring a free flow of personal data within the internal market. After 2009 • protecting the fundamental right to data protection Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

17. European Data Protection RegulationProposal Heightens individual rights • Right to be forgotten • Right not to be subject to a measure based on profiling • Data protection impact assessment and prior authorisation • Transfer of personal data to third countries or international organisations • Centralizes power in the European Commission. • Reduces the policy autonomy of the member states. Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

18. Amendments approved by the European Parliament’s Civil Liberties, Justice and Home Affairs Committee Art.7, § 4 - Consent shall not provide a legal basis for the processing, where there is a significant imbalance between the position of the data subject and the controller. …The execution of a contract or the provision of a service shall not be made conditional on the consent to the processing of data that is not necessary for the execution of the contract or the provision of the service pursuant to Article 6(1), point (b). Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

19. The right tocontract away privacy The EU General Data ProtectionRegulation: Toward a Property Regime for Protecting Data Privacy Jacob M. Victor, Yale Law Journal, 2013 Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

20. Giorgio Resta Art. 3, § 2, CFREU: “prohibition on making the human body and its parts as such a source of financial gain” It is possible to profit from intangible attributes of personality Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

21. Stefano Rodotà • Article 3 deals with the "right to the integrity of the person", i.e. the protection of the physical body. • Article 8 deals with data protection, i.e, the electronic body. “These provisions are directly related to human dignity, which article 1 of the Charter declared to be inviolable” Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014

22. U.S. Supreme CourtRILEY v. CALIFORNIA 25.6.2014 “Our answer to the question of what police must do before searching a cell phone seized incident to an arrest is accordingly simple— get a warrant.” “modern cell phones, which are now such a pervasive and insistent part of daily life that the proverbial visitor from Mars might conclude they were an important feature of human anatomy” Fundamental Rights and Private Law after the Lisbon Treaty Summer School 2014