My interest in C-18/18 Eva Glawischnig-Piesczek v Facebook as I noted in my short first review of the case, concerns mostly the territorial reach of any measures taken by data protection authorities against hosting providers. The Court held last week and o boy did it provoke a lot of comment.
The case to a large degree illustrates the relationship between secondary and primary law, and the art of reading EU secondary law. Here: Article 15 of the e-commerce Directive 2001/31 which limits what can be imposed upon a provider; and the recitals of the Directive which seem to leave more leeway to the Member States. Scant harmonisation of tort law in the EU does not assist the Institutions in their attempts to impose a co-ordinated approach.
The crucial issue in the case was whether Article 15 prohibits the imposition on a hosting provider (Facebook, in this case) of an obligation to remove not only notified illegal content, but also identical and similar content, at a national or worldwide level? The Court held the Directive does not as such preclude such order, and that as to the worldwide injunctive issue, EU law has not harmonised and that it is up to the Member States to direct in any such orders in compliance with public international law.
The judgment to a large degree concerns statutory interpretation on filtering content, which Daphne Keller has already reviewed pre the judgment succinctly here, Dan Svantesson post the judgment here, as did Lorna Woods, and a frenzied Twitter on the day of the judgment e.g. in this thread. A most balanced analysis is provided by Andrej Savin here. e-Commerce law is not the focus of this blog, neither my professed area of expertise (choices, choices). I do want to emphasise though
- that as always it pays to bear in mind the CJEU’s judicial economy. Here: the need to interpret its judgment in line with the circumstances of the case. As Steve Peers noted, the Austrian court had ruled that the post was defamatory, which is a recognised basis for limiting freedom of expression; see also at 40: ‘In that regard, it should be made clear that the illegality of the content of information does not in itself stem from the use of certain terms combined in a certain way, but from the fact that the message conveyed by that content is held to be illegal, when, as in the present case, it concerns defamatory statements made against a specific person.‘ Nota bene, the same need to read the judgment in context goes for the earlier Google v CNIL case, applying Directive 95/46 and the GDPR, which I review here.
- that speaking strictly as a member of the public who has seen the devastating effect of ‘social’ media on people close to me, the technical discussions on filtering (‘what filter does the CJEU think might possibly ever be available to FB to remove content in the way the Court wishes’) are emphatically beside the point. The public justifiably are not interested in the how. A service is offered which clearly has negative effects on EU citisens. Remedy those effects, or remove the service from those citisens. That is true for the negative impacts of goods (in 25 years of regulatory Bar practice I have seen plenty of that). There is no reason it should be any less true for services.
The jurisdictional issues are what interest me more from the blog’s point of view: the territorial scope of any removal or filtering obligation. In Google viz the GDPR and the data protection Directive, the Court confirmed my reading, against that of most others’, of Szpunar AG’s Opinion. EU law does not harmonise the worldwide removal issue. Reasons of personal indemnification may argue in specific circumstances for universal jurisdiction and ditto reach of injunctive relief on ‘right to be forgotten’ issues. Public international law and EU primary law are the ultimate benchmark (Google V CNIL). It is little surprise the Court held similarly in Eva Glawischnig-Piesczek, even if unlike in Google, it did not flag the arguments that might speak against such order. As I noted in my review of Google, for the GDPR and the data protection Directive, it is not entirely clear whether the Court suggests EU secondary law simply did not address extraterritoriality or decided against it. For the e-commerce Directive in Eva Glawischnig-Piesczek the Court notes at 50-52
Directive 2000/31 does not preclude those injunction measures from producing effects worldwide. However, it is apparent from recitals 58 and 60 of that directive that, in view of the global dimension of electronic commerce, the EU legislature considered it necessary to ensure that EU rules in that area are consistent with the rules applicable at international level. It is up to Member States to ensure that the measures which they adopt and which produce effects worldwide take due account of those rules.
In conclusion, Member States may order a host provider to remove information covered by the injunction or to block access to that information worldwide within the framework of the relevant international law. To my knowledge, the Brussels Court of Appeal is the only national court so far to consider public international law extensively viz the issue of jurisdiction, and decided against it, nota bene in a case against Facebook Inc.
Any suggestion that the floodgates are open underestimates the sophisticated engagement of national courts with public international law.
In general, the CJEU’s approach is very much aligned with the US (SCOTUS in particular) judicial approach in similar extraterritoriality issues (sanctions law; export controls; ATS;…). There is no madness to the CJEU’s approach. Incomplete: sure (see deference to national courts and the clear lack of EU law-making up its legislative mind on the issues). Challenging and work in progress: undoubtedly. But far from mad.
(Handbook of) EU Private International Law, 2nd ed. 2016, Chapter 2, Heading 18.104.22.168, Heading 22.214.171.124.5.