Posts Tagged Extraterritoriality
GDPR (General Data Protection Regulation) aficionados will have already seen the draft guidelines published by the EDPB – the European data protection board – on the territorial scope of the Regulation.
Of particular interest to conflicts lawyers is the Heading on the application of the ‘targeting’ criterion of GDPR’s Article 3(2). There are clear overlaps here between Brussels I, Rome I, and the GDPR and indeed the EDPB refers to relevant case-law in the ‘directed at’ criterion in Brussels and Rome.
(Handbook of) EU Private International Law, 2nd ed. 2016, Chapter 2, Heading 220.127.116.11.3, Heading 18.104.22.168.5.
I have an ever-updated post on Google’s efforts to pinpoint the exact territorial dimension of the EU’s data protection regime, GDPR etc. Now, Facebook are reportedly (see also here) appealing a fine imposed by the UK’s data protection authority in the wake of the Cambridge Analytica scandal. Facebook’s point at least as reported is that the breach did not impact UK users.
The issue I am sure exposes Facebook in the immediate term to PR challenges. However in the longer term it highlights the need to clarify the proper territorial reach of both data protection laws and their enforcement.
One to look out for.
Choices, choices. I will continue to follow the GDPR for jurisdictional purposes, including territorial scope. (And I have a paper coming up on conflict of laws issues in the private enforcement of same). But for much of the GDPR enforcement debate, I am handing over to others. Johannes Marosi, for instance, who reviews the CJEU judgment this week in Fansites, over at Verfassungsblog. I reviewed the AG’s Opinion here.
Judgment in Grand Chamber but with small room for cheering.
As Johannes’ post explains, there are many loose ends in the judgment, and little reference to the GDPR (technically correct but from a compliance point of view wanting). (As an aside: have a look at Merlin Gömann’s paper, in CMLREv, on the territorial scope of the GDPR).
(Handbook of) EU Private International Law, 2nd ed. 2016, Chapter 2, Heading 22.214.171.124.5.
US Iran sanctions renew the spotlight on the EU’s blocking regulation: A rare EU harmonised approach to enforcement and recognition from third States.
Ross Denton at Baker & McKenzie has a gem of a briefing on the EU’s ‘blocking Regulation’ and what it would mean in light of the US’ mooted sanctions on Iran. Steptoe had earlier also pondered the impact of the US withdrawal from the ‘Joint Comprehensive Plan of Action’ or JCPOA, on the Regulation.
Regulation 2271/96 provides essentially for protection against, and counteracts the effects of the extra-territorial application of the laws of third States. WTO lawyers will remember it mostly from the days of Helms-Burton. As Ross points out, the European Commission now have delegated power to populate the Annex to the list (which details the sanctions the Regulation acts against).
Potentially extra-territorial are in particular US ‘secondary’ sanctions: i.e. those against non-US individuals (or companies) for actions undertaken outside the US.
Of particular interest to readers of the blog – including researchers I would imagine, are Articles 4, 5 and 6, which I have copy-pasted in full below. They deal with recognition and enforcement, co-operation with foreign courts, and recovery of expenses. These Articles are a rare instance where the EU adopt a harmonised approach to recognition and enforcement of judgments originating ex-EU (awaiting the potential Hague Judgments project). [Update 22 May 11:30 AM. As Enio Piovezani comments below, the GDPR, too, includes a relevant rule: See Article 48: ‘Transfers or disclosures not authorised by Union law. Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter.’]
As Ross points out, however, the proverbial US rock is harder than the equally proverbial EU stone, hence in practice many companies choose to abide by the US sanctions, anyways.
My fingers are itching to launch yet another interesting PhD topic on this issue…Takers?
No judgment of a court or tribunal and no decision of an administrative authority located outside the Community giving effect, directly or indirectly, to the laws specified in the Annex or to actions based thereon or resulting there from, shall be recognized or be enforceable in any manner.
No person referred to in Article 11 shall comply, whether directly or through a subsidiary or other intermediary person, actively or by deliberate omission, with any requirement or prohibition, including requests of foreign courts, based on or resulting, directly or indirectly, from the laws specified in the Annex or from actions based thereon or resulting therefrom.
Persons may be authorized, in accordance with the procedures provided in Articles 7 and 8, to comply fully or partially to the extent that non-compliance would seriously damage their interests or those of the Community. The criteria for the application of this provision shall be established in accordance with the procedure set out in Article 8. When there is sufficient evidence that non-compliance would cause serious damage to a natural or legal person, the Commission shall expeditiously submit to the committee referred to in Article 8 a draft of the appropriate measures to be taken under the terms of the Regulation.
Any person referred to in Article 11, who is engaging in an activity referred to in Article 1 shall be entitled to recover any damages, including legal costs, caused to that person by the application of the laws specified in the Annex or by actions based thereon or resulting therefrom.
Such recovery may be obtained from the natural or legal person or any other entity causing the damages or from any person acting on its behalf or intermediary.
The Brussels Convention of 27 September 1968 on jurisdiction and the enforcement of judgments in civil and commercial matters shall apply to proceedings brought and judgments given under this Article. Recovery may be obtained on the basis of the provisions of Sections 2 to 6 of Title II of that Convention, as well as, in accordance with Article 57 (3) of that Convention, through judicial proceedings instituted in the Courts of any Member State where that person, entity, person acting on its behalf or intermediary holds assets.
Without prejudice to other means available and in accordance with applicable law, the recovery could take the form of seizure and sale of assets held by those persons, entities, persons acting on their behalf or intermediaries within the Community, including shares held in a legal person incorporated within the Community.
Of interest to data protection lawyers is Warby J’s excellent review of the test to be applied (particularly within the common law context of misuse of private information). Of interest to readers of this blog, is what is not yet part of the High Court’s ruling: the precise wording of the delisting order. Particularly: defendant is Google LLC, a US-based company. Will the eventual delisting order in the one case in which it was granted, include worldwide wording? For our discussion of relevant case-law worldwide, see here.
Update 3 April 2018 Recently, the so-called “CLOUD Act” was passed by Congress and signed into law. This new law amends the Stored Communications Act to give it a potentially extraterritorial reach. Following this development, the U.S. Government has moved to have the Microsoft case dismissed as moot, and to have the Second Circuit’s decision vacated. [Technically, Congress has enacted, and the President has signed,
the Consolidated Appropriations Act, 2018, H.R. 1625, 115th Cong., 2d Sess. (2018). Division V of that Act is called the Clarifying Lawful Overseas Use of Data Act, or the CLOUD Act. TheCLOUD Act amends the Stored Communications Act, 18 U.S.C. 2701-2712, by adding 18 U.S.C. 2713, which now states:
A provider of electronic communication service or remote computing service shall
comply with the obligations of this chapter to preserve, backup, or disclose the contents
of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider’s possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.]
For background to the Microsoft Ireland case under the Stored Communications Act (SCA), see here. The issue is essentially whether the US Justice Department may force Microsoft to grant access to e-mails stored on Irish servers.
With a group of EU data protection and conflicts lawyers, we have filed an amicus curiae brief in the case at the United States Supreme Court last week, arguing that the Court should interpret the SCA to apply only to data stored within the United States, leaving to Congress the decision whether and under what circumstances to authorize the collection of data stored in other countries.
There is not much point in me rehashing the arguments here: happy reading.