Posts Tagged Extraterritoriality

Steady now. Eva Glawischnig-Piesczek v Facebook. The CJEU on jurisdiction and removal of hate speech.

My interest in C-18/18 Eva Glawischnig-Piesczek v Facebook as I noted in my short first review of the case, concerns mostly the territorial reach of any measures taken by data protection authorities against hosting providers. The Court held last week and o boy did it provoke a lot of comment.

The case to a large degree illustrates the relationship between secondary and primary law, and the art of reading EU secondary law. Here: Article 15 of the e-commerce Directive 2001/31 which limits what can be imposed upon a provider; and the recitals of the Directive which seem to leave more leeway to the Member States. Scant harmonisation of tort law in the EU does not assist the Institutions in their attempts to impose a co-ordinated approach.

The crucial issue in the case was whether Article 15 prohibits the imposition on a hosting provider (Facebook, in this case) of an obligation to remove not only notified illegal content, but also identical and similar content, at a national or worldwide level? The Court held the Directive does not as such preclude such order, and that as to the worldwide injunctive issue, EU law has not harmonised and that it is up to the Member States to direct in any such orders in compliance with public international law.

The judgment to a large degree concerns statutory interpretation on filtering content, which Daphne Keller has already reviewed pre the judgment succinctly here, Dan Svantesson post the judgment here, as did Lorna Woods, and a frenzied Twitter on the day of the judgment e.g. in this thread. A most balanced analysis is provided by Andrej Savin here. e-Commerce law is not the focus of this blog, neither my professed area of expertise (choices, choices). I do want to emphasise though

  • that as always it pays to bear in mind the CJEU’s judicial economy. Here: the need to interpret its judgment in line with the circumstances of the case. As Steve Peers noted, the Austrian court had ruled that the post was defamatory, which is a recognised basis for limiting freedom of expression; see also at 40: ‘In that regard, it should be made clear that the illegality of the content of information does not in itself stem from the use of certain terms combined in a certain way, but from the fact that the message conveyed by that content is held to be illegal, when, as in the present case, it concerns defamatory statements made against a specific person.‘ Nota bene, the same need to read the judgment in context goes for the earlier Google v CNIL case, applying Directive 95/46 and the GDPR, which I review here.
  • that speaking strictly as a member of the public who has seen the devastating effect of ‘social’ media on people close to me, the technical discussions on filtering (‘what filter does the CJEU think might possibly ever be available to FB to remove content in the way the Court wishes’) are emphatically beside the point. The public justifiably are not interested in the how. A service is offered which clearly has negative effects on EU citisens. Remedy those effects, or remove the service from those citisens. That is true for the negative impacts of goods (in 25 years of regulatory Bar practice I have seen plenty of that). There is no reason it should be any less true for services.

The jurisdictional issues are what interest me more from the blog’s point of view: the territorial scope of any removal or filtering obligation. In Google viz the GDPR and the data protection Directive, the Court confirmed my reading, against that of most others’, of Szpunar AG’s Opinion. EU law does not harmonise the worldwide removal issue. Reasons of personal indemnification may argue in specific circumstances for universal jurisdiction and ditto reach of injunctive relief on ‘right to be forgotten’ issues. Public international law and EU primary law are the ultimate benchmark (Google V CNIL). It is little surprise the Court held similarly in Eva Glawischnig-Piesczek, even if unlike in Google, it did not flag the arguments that might speak against such order. As I noted in my review of Google, for the GDPR and the data protection Directive, it is not entirely clear whether the Court suggests EU secondary law simply did not address extraterritoriality or decided against it. For the e-commerce Directive in Eva Glawischnig-Piesczek the Court notes at 50-52

Directive 2000/31 does not preclude those injunction measures from producing effects worldwide. However, it is apparent from recitals 58 and 60 of that directive that, in view of the global dimension of electronic commerce, the EU legislature considered it necessary to ensure that EU rules in that area are consistent with the rules applicable at international level.  It is up to Member States to ensure that the measures which they adopt and which produce effects worldwide take due account of those rules.

In conclusion, Member States may order a host provider to remove information covered by the injunction or to block access to that information worldwide within the framework of the relevant international law. To my knowledge, the Brussels Court of Appeal is the only national court so far to consider public international law extensively viz the issue of jurisdiction, and decided against it, nota bene in a case against Facebook Inc.

Any suggestion that the floodgates are open underestimates the sophisticated engagement of national courts with public international law.

In general, the CJEU’s approach is very much aligned with the US (SCOTUS in particular) judicial approach in similar extraterritoriality issues (sanctions law; export controls; ATS;…). There is no madness to the CJEU’s approach. Incomplete: sure (see deference to national courts and the clear lack of EU law-making up its legislative mind on the issues). Challenging and work in progress: undoubtedly. But far from mad.

Geert.

(Handbook of) EU Private International Law, 2nd ed. 2016, Chapter 2, Heading 2.2.8.2, Heading 2.2.8.2.5.

, , , , , , , , , , , , , , , , , , , , , , , , , ,

Leave a comment

Court of Justice in Google sees no objection in principle to EU ‘Right to be forgotten’ leading to worldwide delisting orders. Holds that as EU law stands, however, it is limited to EU-wide application, leaves the door open to national authorities holding otherwise.

Many commentators were wrong-footed on reading Advocate-General Szpunar’s Opinion in C-505/17 Google Inc v Commission nationale de l’informatique et des libertés (CNIL), concerning the territorial limits to right to have search results delisted, more popularly referred to as ‘the right to erasure’ or the ‘right to be forgotten’ (‘RTBF’ – a product of the CJEU in Google Spain). Far from ruling out ‘extraterritorial’ or worldwide force of the right, the AG saw no objection to it in principle, even if he suggested non-application to the case at issue (he did so again in his Opinion in C-18/18 Eva Glawischnig-Piesczek v Facebook, which I review here and on which judgment is forthcoming next week).

The Court yesterday held (the Twitter storm it created was later somewhat drowned by the UK Supreme Court’s decision in the prorogation case) and overall confirmed the AG’s views. As with the AG’s Opinion, it is important to read the Judgment for what it actually says, not just how the headlines saw it. For immediate analysis, readers may also want to read Daphne Keller’s and Michèle Finck’s threads and Dan Svantesson’s impromptu assessment.

It is again important to point out that the French data protection authority’s (CNIL) decision at issue, 2016/054 is a general CNIL instruction to Google to carry out global delisting in instances where natural persons request removal; not a case-specific one. 

I have a case-note on the case and on C-137/17 (judgment also yesterday) forthcoming with Yuliya Miadzvetskaya, but here are my initial thoughts on what I think is of particular note.

1. The Court of Justice (in Grand Chamber) first of all, unusually, examines the questions in the light of both Directive 95/46, applicable to the facts at issue, and the GDPR Regulation ‘in order to ensure that its answers will be of use to the referring court in any event’ (at 41).

2. Next, at 52, the Court dismisses a fanciful distributive approach towards the computing reality of data processing:

Google’s establishment in French territory carries on, inter alia, commercial and advertising activities, which are inextricably linked to the processing of personal data carried out for the purposes of operating the search engine concerned, and, second, that that search engine must, in view of, inter alia, the existence of gateways between its various national versions, be regarded as carrying out a single act of personal data processing. The referring court considers that (and the CJEU clearly agrees, GAVC), in those circumstances, that act of processing is carried out within the framework of Google’s establishment in French territory.

3. At 55, the Court points out that de-referencing carried out on all the versions of a search engine would meet the objective of data protection in full, particularly (at 56) given the fact that ‘(t)he internet is a global network without borders and search engines render the information and links contained in a list of results displayed following a search conducted on the basis of an individual’s name ubiquitous (the Court restating here its finding in both Google Spain and Bolagsupplysningen). 

At 58 the Court employs that finding of ubiquitousness to ‘justify the existence of a competence on the part of the EU legislature to lay down the obligation, for a search engine operator, to carry out, when granting a request for de-referencing made by such a person, a de-referencing on all the versions of its search engine.’ No grand statements on public international law’s views on adjudicative extraterritoriality /universality. Just a simple observation.

The Court subsequently however (at 59-60) notes other States’ absence of a right to de-referencing and their different views on the balancing act between privacy and freedom of speech in particular. At 61-62 it then notes

While the EU legislature has, in Article 17(3)(a) of Regulation 2016/679, struck a balance between that right and that freedom so far as the Union is concerned (see, to that effect, today’s judgment, GC and Others (De-referencing of sensitive data), C‑136/17, paragraph 59), it must be found that, by contrast, it has not, to date, struck such a balance as regards the scope of a de-referencing outside the Union.

In particular, it is in no way apparent from the wording of Article 12(b) and subparagraph (a) of the first paragraph of Article 14 of Directive 95/46 or Article 17 of Regulation 2016/679 that the EU legislature would, for the purposes of ensuring that the objective referred to in paragraph 54 above is met, have chosen to confer a scope on the rights enshrined in those provisions which would go beyond the territory of the Member States and that it would have intended to impose on an operator which, like Google, falls within the scope of that directive or that regulation a de-referencing obligation which also concerns the national versions of its search engine that do not correspond to the Member States.

In other words the Court has adopted the same approach as the United States Supreme Court has done in Morrison v. National Australia Bank; and Kiobel: there is a presumption against extraterritoriality, however it is not excluded. In the absence of indications of the legislator wish to extend the right to delisting extraterritorially it does not so exist in the current state of the law.

4. At 63 the Court hints at what might be required as part of such future potential extraterritorial extension: EU law does not currently provide for cooperation instruments and mechanisms as regards the scope of a de-referencing outside the Union – in contrast with the regime it has intra-EU. This also hints at the CJEU taking a more multilateral approach to the issue than its SCOTUS counterpart.

5. At 69 the Court then adds that intra-EU, a delisting order covering all of the search engine’s EU extensions is both possible and may be appropriate: co-operation between authorities may lead to ‘where appropriate, a de-referencing decision which covers all searches conducted from the territory of the Union on the basis of that data subject’s name.’

6. A final twist then follows at 72:

Lastly, it should be emphasised that, while, as noted in paragraph 64 above, EU law does not currently require that the de-referencing granted concern all versions of the search engine in question, it also does not prohibit such a practice. Accordingly, a supervisory or judicial authority of a Member State remains competent to weigh up, in the light of national standards of protection of fundamental rights (references to CJEU authority omitted, GAVC), a data subject’s right to privacy and the protection of personal data concerning him or her, on the one hand, and the right to freedom of information, on the other, and, after weighing those rights against each other, to order, where appropriate, the operator of that search engine to carry out a de-referencing concerning all versions of that search engine.

Here I do not follow the Court: one could argue that the harmonised EU’s approach is currently not to extend the right to delisting extraterritorially. The Court on the other hand seems to be suggesting that the extraterritoriality issue was not discussed in the Directive or Regulation, that EU law does not occupy (‘pre-empt’) that regulatory space and consequently leaves it up to the Member States to regulate that right. (Update 27 September 2019: Other interpretations are collated here).

I shall need more detailed reading of the GDPR’s preparatory works to form a view as to whether the extraterritorial element was considered, and rejected, or simply not discussed. However I also want to already point out that if the decision is left to the Member States, the case-law and theory of pre-emption clarifies that such national action has to be taken in full compatibility with EU law. including free movement of services, say, which Google may rightfully invoke should there be a disproportionate impact on the Internal Market.

Geert.

(Handbook of) EU Private International Law, 2nd ed. 2016, Chapter 2, Heading 2.2.8.2, Heading 2.2.8.2.5.

, , , , , , , , , , , , , , , , , , , , , , , ,

1 Comment

Brussels Court of Appeal rejects jurisdiction against Facebook Inc, Facebook Ireland in privacy, data protection case.

The Brussels Court of Appeal held early May in a lengthy and scholarly judgment that it sees no ground in either public international law, or European law, for jurisdiction of the Belgian courts against Facebook Ireland and Facebook Inc (Palo Alto, California). I reported on the litigation inter alia here. I believe the Court is right, as readers of the blog know from my earlier postings.

Belgium’s Data Protection Authority (DPA) does not signal the rejection of jurisdiction against FB Ireland and FB Inc in its press release, however even its 3 page extract from the 121 page judgment clearly shows it (first bullet-point).

The questions which the Court of Appeal has sent up to Luxembourg concern Facebook Belgium only. The Court in the full judgment does not qualify FB Belgium’s activities as data processing. However it has very specific questions on the existence and extent of powers for DPAs other than the leading authority under the GDPR, including the question whether there is any relevance to the fact that action has started prior to the entry into force of the GDPR (25 May 2018). The Court is minded to interpret the one-stop shop principle extensively however it has doubt given the CJEU’s judgment in Fanpages

Crucial and so far, I believe, fairly unreported. (My delay explained by the possibility for use as an essay exam question – which eventually I have not).

Geert.

(Handbook of) EU private international law, 2nd ed.2016, chapter 2, Heading 2.2.8.2.5.

, , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Leave a comment

The internet’s not written in pencil, it’s written in ink. Szpunar AG in Eva Glawischnig-Piesczek v Facebook, re i.a. jurisdiction and removal of hate speech. (As well as confirming my reading of his Opinion in Google).

Case C-18/18 Eva Glawischnig-Piesczek v Facebook as I noted in my short first review of the case, revolves around Article 15 of the E-Commerce Directive. Does Article 15 prohibit the imposition on a hosting provider (Facebook, in this case) of an obligation to remove not only notified illegal content, but also identical and similar content, at a national or worldwide level?

Szpunar AG in his Opinion kicks off with a memorable Erica Albright quote from The Social Network:  The internet’s not written in pencil, [Mark], it’s written in ink’. 

His Opinion to a large degree concerns statutory interpretation on filtering content, which Daphne Keller has already reviewed succinctly here and which is not the focus of this blog. The jurisdictional issues are what interest me more: the territorial scope of any removal obligation.

Firstly, Szpunar AG matter of factly confirms my reading, against that of most others’, of his Opinion in C-505/17 Google: at 79:

‘in my Opinion in that case I did not exclude the possibility that there might be situations in which the interest of the Union requires the application of the provisions of that directive beyond the territory of the European Union.’

Injunctions (ordering removal) are necessarily based on substantive considerations of national law (in the absence of EU harmonisation of defamation law); which law applies is subject to national, residual conflicts rules (in the absence of EU harmonisation at the applicable law, level, too): at 78. Consequently, a Court’s finding of illegality (because of its defamatory nature) of information posted may well have been different had the case been heard by a court in another Member State. What is however harmonised at the EU level, is the jurisdiction for the civil and commercial damage following from defamation: see e-Date, in particular its centre of interests rule which leads to an all-encompassing, universal’ jurisdiction for the damages resulting from the defamation.

Separate from that is the consideration of the territorial extent of the removal obligation. Here, the AG kicks off his analysis at 88 ff by clearly laying out the limits of existing EU harmonisation: the GDPR and data protection Directive harmonise issues of personal data /privacy: not what claimant relies on. Directive 2000/31 does not regulate the territorial effects of injunctions addressed to information society service providers. Next, it is difficult, in the absence of regulation by the Union with respect to harm to private life and personality rights, to justify the territorial effects of an injunction by relying on the protection of fundamental rights guaranteed in Articles 1, 7 and 8 of the Charter: the scope of the Charter follows the scope of EU law and not vice versa. In the present case, as regards its substance, the applicant’s action is not based on EU law. Finally, Brussels Ia does not regulate the extra-EU effects of injunctions.

In conclusion therefore EU law does not regulate the question of extraterritorial reach in casu.

For the sake of completeness, the AG does offer at 94 ff ‘a few additional observations’ as regards the removal of information disseminated worldwide via a social network platform. At 96 he refers to the CJEU’s judgment in Bolagsupplysningen which might implicitly have acknowledged universal jurisdiction, to conclude at 100 (references omitted)

the court of a Member State may, in theory, adjudicate on the removal worldwide of information disseminated via the internet. However, owing to the differences between, on the one hand, national laws and, on the other, the protection of the private life and personality rights provided for in those laws, and in order to respect the widely recognised fundamental rights, such a court must, rather, adopt an approach of self-limitation. Therefore, in the interest of international comity…, that court should, as far as possible, limit the extraterritorial effects of its junctions concerning harm to private life and personality rights. The implementation of a removal obligation should not go beyond what is necessary to achieve the protection of the injured person. Thus, instead of removing the content, that court might, in an appropriate case, order that access to that information be disabled with the help of geo-blocking.

There are very sound and extensive references to scholarship in the footnotes to the Opinion, including papers on the public /private international law divide and the shifting nature of same (the Brussels Court of Appeal recently in the Facebook case justifiably found jurisdictional grounds in neither public nor private international law, to discipline Facebook Ireland and Facebook Inc for its datr-cookies placed on Belgian users of FB).

I find the AG’s Opinion convincing and complete even in its conciseness. One can analyse the jurisdictional issues until the cows come home. However, in reality reasons of personal indemnification may argue in specific circumstances for universal jurisdiction and ditto reach of injunctive relief. However these bump both into the substantial trade-off which needs to be made between different fundamental rights (interest in having freedom removed v freedom of information), and good old principles of comitas gentium aka comity. That is not unlike the US judicial approach in similar issues.

Geert.

(Handbook of) EU Private International Law, 2nd ed. 2016, Chapter 2, Heading 2.2.8.2, Heading 2.2.8.2.5.

, , , , , , , , , , , , , , , , , , , , , , , , , ,

Leave a comment

Kiobel v Shell in The Netherlands. Court confirms jurisdiction anchored unto mother holding and qualifies the suit as one in human rights: not tort. Also orders limited use of documents obtained in US discovery and limited continuation of the trial.

Update 26 July 2019 the English version of the judgment is now available here.

In January 2017 I reported that Ms Kiobel, following failure to convince the USSC of jurisdiction under the Alien Tort Statute, subsequently initiated proceedings in the Dutch courts to try and sue Shell over the case. (Evidently unrelated to the pursuit of Shell in The Netherlands on environmental grounds – a case which is still pending upon appeal).

The court in first instance at the Hague on 1 May accepted jurisdiction against

  • both the mother holding. That was not at all under discussion: this is done via Article 4 Brussels Ia’s domicile rule. Use of Article 33 /34’s forum non conveniens-light mechanism was not suggested;
  • two English-incorporated Shell daughters using Article 8(1) of the Brussels I a Regulation; and
  • the Nigerian daughter company. Against the Nigerian daughter company, jurisdiction needs to be anchored unto the Dutch mother holding using Article 7 of the Dutch CPR, which is a near carbon copy of Article 8(1) Brussels Ia, whose CJEU authority is followed by Dutch courts in the interpretation of the Dutch residual rule.

Coming so soon after the UKSC in Vedanta the Dutch case has received quite a bit of attention. After first not considering an English translation (not surprisingly; these are the Dutch courts, not a World Service), the clerks have now announced that there will be one, coming up some time soon.

Readers of the blog will expect me to hold the judgment against a clear jurisdictional and conflict of laws lens – in doing so, I fear I have to be a little bit less optimistic than media soundbites following the case.

Jurisdictional issues were in the end dealt with fairly summarily. Most attention went to issues of evidence and discovery, as well as a first review of the substance of the case.

Of note is:

  • At 4.3: acceptance by all parties of of Nigerian law as the lex causae; if need be, choice of law by all parties for Nigerian law as the lex causae. Rome II is not applicable ratione temporis. The case has this in common with the Milieudefensie case against Shell. This being a civil law jurisdiction, ius novit curia applies. The court has taken into account parties’ submissions on Nigerian law yet has also conducted its own research. Foreign law is ‘law’ in the civil law; not ‘fact’ as in the common law.
  • Claimants suggest that in the events in Ogoniland Shell acted as one organisation and treated the issue as one engaging the Shell concern as a whole (4.7 in fine);
  • Claimants purposedly do not wish their claim to be qualified as one engaging piercing of the corporate veil; duty of care; shareholders responsibility; or tort of negligence. Rather, as one engaging the Shell concern directly in a suit on infringement of human rights included in the African Charter on Human and Peoples Rights (ACHPR) and the Nigerian constitution. Tort is only suggested as an alternative should the court not follow the arguments on the basis of human rights (4.8).
  • At 4.12 the Court accepts the horizontal direct effect of human rights under Nigerian law, referring for that finding to Nigerian case-law. At 4.19 the Court notes the absence of statutes of limitation for human rights violations under Nigerian law: thus qualifying this as an issue of substance (lex causae), not procedure (lex fori). It revisits the statute of limitation issue at 4.47 ff (holding that under Nigerian law the suits can still be brought).
  • At 4.26 the court applies A8(1) BIa and A7 Dutch CPR in globo, given the same lines of interpretation, and finds succinctly that all conditions (Kalfelis; Roche Nederland; The Tatry) are met. It remarks at 4.26 in fine that given the same situation of law and fact, it was predictable for all parties that they might end up being sued in any of their corporate siblings’ domicile.
  • At 4.27 the court discussed summary dismissal. As seen in Vedanta, despite Owusu European courts are within their rights to reject the case in summary judgment if there is no ‘real issue’ to be tried against the anchor defendant. However this only applies against non-EU based defendants. Application of Article 8(1) does not allow such summary dismissal for EU-based defendants (see also C-103/05 Reisch Montage). The Hague court reviews summary dismissal only vis-a-vis the Nigerian defendant but finds succinctly that the suit is not prima facie without merit. There is a serious issue to be tried.
  • At 4.28 interestingly the Court rejects relevance of the High Court and the Court of Appeal‘s dismissal of jurisdiction in Okpabi, arguing that these courts employed ‘English law’. This underscores the argument I have made elsewhere, that there is a serious blank in the discussion on lex causae for the duty of care or, depending on the case, the piercing issue. The Dutch court here notes without hesitation that the English courts apply lex fori to that test, and so therefore, I am assuming, should they (meaning Dutch law in their case)?
  • At 4.29 it looks as if the Court considers some kind of reflexive argument which defendants seem to have made. Namely that the Dutch courts should respect the exclusive jurisdictional head under the Fundamental Rights (Enforcement Procedure) – FREP Rules, for the Federal High Court in cases involving alleged infringement of human rights. However the Dutch court considers this a mere internal jurisdictional distribution rule, which does not hinder the Dutch courts in their assessment of the claims. There is no written or unwritten rule in Dutch private international law which suggests such deference to a Nigerian civil procedure rule.

Importantly, a great deal of attention at 4.30 ff  goes to the debate on the use of documents obtained in US discovery, in the Dutch proceedings. A fair amount of these had to be returned following a confidentiality agreement in the US proceedings. Claimants make recourse to Article 6 ECHR to regain access for use in the Dutch proceedings however the Dutch court curtails much of that. Common law discovery rules are notoriously more claimant friendly than those of the civil law (a comment also made by Marsh CM in Glaxo v Sandoz). It leads to Shell not having to turn over quite a large part of the documents claimants had hoped to use. [Note 18 May 2019 in my original post of 17 May I had ‘common’ law and ‘civil law’ accidentally mixed up in the previous sentence].

At 4.58 ff the Court then turns to the substance of the case for case management reasons, with a view to determining which parts of the claim may be made subject to further proof. It holds in a way which I imagine must have been very disappointing for claimants. Only limited claims (of the Nigerian daughter’s involvement in the bribing of witnesses) will be allowed to continue.

The court held that claims of controlling meddling in the Nigerian court proceedings were not proven with sufficient force for these claims to continue – instead it held that Shell’s policy of silent diplomacy, in line with its business policies, had been consistently carried out.

All in all I would suggest claimants have scored clear points on jurisdiction, minor points on discovery and a disappointing outcome for them on substance. Albeit that the witness bribe leg may still lead to a finding of human rights infringement.

Geert.

(Handbook of) European private international law, second ed. 2016, Chapter 8, Headings 8.3.1.1., 8.3.2.

, , , , , , , , , , , , , , , , , , , , , , , , ,

Leave a comment

Eva Glawischnig-Piesczek v Facebook. Hate speech at the CJEU.

In Case C-18/18, Eva Glawischnig-Piesczek v Facebook, the Austrian Supreme Court has referred a ‘hate speech’ case to Luxembourg – hearing will be tomorrow, 12 February. The Case revolves around Article 15 of the E-Commerce Directive: one sentence Twitter summary comes courtesy of Tito Rendas: does Article 15 prohibit the imposition on a hosting provider (Facebook, in this case) of an obligation to remove not only notified illegal content, but also identical and similar content, at a national or worldwide level?

Mirko Brüß has more extensive analysis here. I used the case in my class with American University (my students will be at the hearing tomorrow), to illustrate the relationship between secondary and primary law, but also the art in reading EU secondary law (here: A15 which limits what can be imposed upon a provider; and the recitals of the Directive which seem to leave more leeway to the Member States; particularly in the light of the scant harmonisation of tort law in the EU). To readers of the blog the case is probably more relevant in light of the questions on territorial scope: if a duty to remove may be imposed, how wide may the order reach? It is in this respect that the case is reminiscent of the Google etc. cases.

Yet another one to look out for.

Geert.

(Handbook of) EU Private International Law, 2nd ed. 2016, Chapter 2, Heading 2.2.8.2, Heading 2.2.8.2.5.

, , , , , , , , , , , , , , , , , , , , , , , , , , ,

Leave a comment

Forget what you have read. Szpunar AG does not restrict EU ‘Right to be forgotten’ /data protection laws to European territory in ‘Google’ case.

I have previously reported extensively on various national and European developments re the right to have search results delisted, more popularly referred to as the ‘right to be forgotten’ (‘RTBF’ – a product of the CJEU in Google Spain) and its territorial limits. (Search string ‘Google’ or ‘rtbf’ ought to assist the reader). Szpunar AG opined mercifully  succinctly last Thursday in C-505/17 Google Inc v Commission nationale de l’informatique et des libertés (CNIL).

Possibly because of the English-language press release (‘Advocate General Szpunar proposes that the Court should limit the scope of the de-referencing that search engine operators are required to carry out to the EU‘) and because of the actual text of the Opinion hitherto being available in French only, general reporting has been almost unequivocally (note Michèle Finck’s 10th Tweet in an early thread on the Opinion as a cautious exception), that the AG suggests that the RTBF is limited to EU soil only.

Except, he does not. Update June 2019 and confirms as much in his Opinion in Eva Glawischnig-Piesczek v Facebook which I review here.

The Conseil d’Etat has referred one or two specific Qs but also, just to be sure, has also asked the Court of Justice for general insight into how data protection laws apply to the internet.

The AG of course departs from the core objective of the data protection Directive and now the GDPR, and Google Spain, and points out that the CJEU has put the protection of the fundamental rights of the data subject at the centre. At 46 he summarises his view before justifying it:

‘in my opinion one should distinguish according to the place in which the search is carried out. Searches carried out outside the EU ought not to be made subject to delisting’. (My translation from the French).

Geo-blocking can be ordered and ensures that within the EU territory, no Google extension may be used to access the information at issue (at 64 ff) after duly having balanced the right of freedom of information against the right to be forgotten.

Turning to his arguments, the AG points out at 47 ff first of all – briefly: see e.g. Belgian case-law on Facebook for more extensive discussion –  that public international law defines the borders of the EU and its Member States. The AG sees no reason (48-49) exceptionally to extend the scope of application beyond that border in the case of the Directive or the GDPR.

(51-52) Other examples of ‘extraterritoriality’ do not sway him, such as the Trademark Directive or EU competition law. He argues that in these cases the Internal Market is impacted and EU law applies to these situations ex-EU only because the Internal Market is a finite, territorial unit. The internet is not (at 53: Le marché intérieur est un territoire clairement délimité par les traités. En revanche, l’internet est, par nature, mondial et, d’une certaine manière, est présent partout. Il est donc difficile de faire des analogies et des comparaisons).

Note that references to other instances of ‘extraterritoriality’ (or not) could have been made: such as the cases surrounding animal welfare (Zuchtvieh), cosmetics, or the EU’s emissions trading scheme.

The AG also briefly discusses ‘extraterritorial’ protection of rights under the ECHR, but distinguishes the EU Charter from same. (On the topic of the ‘extraterritorial’ impact of the EU’s human rights obligations, see excellently Lorand Bartels here).

At 60-61 the AG argues (paras which have been more or less literally translated in the Press release) that if worldwide de-referencing were permitted, the EU authorities would not be able to define and determine a right to receive information, let alone balance it against the other fundamental rights to data protection and to privacy. This, the AG argues, is all the more so since ‘the right of the public to access such information’ (un tel intérêt du public à accéder à une information; this word string bizarrely translated in the press release as ‘such a publication’) will necessarily vary from one third State to another depending on its geographic location. There would be a risk, the AG suggests, that if worldwide de-referencing were possible, persons in third States would be prevented from accessing information and, in turn, that third States would prevent persons in the EU Member States from accessing information. This might in turn lead to a race to the bottom in the right to access of information.

This is an important point, because it essentially encapsulates a core argument made by Google: that particularly in the US, the constitutional right to free speech and the corollary of the freedom to receive information, gazumps a right to be forgotten – putting Google in the event of worldwide delisting orders between SCOTUS’ rock and CJEU’s hard place.

Crucially however at 62 the AG then in my view perhaps not quite torpedoes but certainly seriously softens his overall general analysis by suggesting that his views on territoriality are the default position only, which may be varied should specific instances of the balancing act of fundamental rights, so require: it’s just that the specific circumstances of the case do not.

Les enjeux en cause n’exigent donc pas que les dispositions de la directive 95/46 soient d’application au-delà du territoire de l’Union. Cela ne signifie pas pour autant que le droit de l’Union ne saurait jamais imposer à un exploitant de moteur de recherche tel que Google qu’il entreprenne des actions au niveau mondial. Je n’exclus pas qu’il puisse y avoir des situations dans lesquelles l’intérêt de l’Union exige une application des dispositions de la directive 95/46 au-delà du territoire de l’Union. Mais dans une situation telle que celle de la présente affaire, il n’y a pas de raison d’appliquer les dispositions de la directive 95/46 d’une telle manière.

The circumstances of the case do not justify worldwide blocking. Yet other circumstances might. This is a crucial section for the French data protection authority’s (CNIL) decision at issue, 2016/054 [thank you again to the Dutch Ministry of Foreign Affairs for providing the factual background to the case; also note that in the French decision Google’s name, amusingly, is anonymised] is a general CNIL instruction to Google to carry out global delisting in instances where natural persons request removal; not a case-specific one. In other words the ‘circumstances of the case’ concern a generic, not a factual balancing.

In yet other words: there could be many instances where national data protection authorities might find worldwide delisting to be the only proper means to balance the various fundamental rights at stake. The AG Opinion offers little to no support that such worldwide delisting in concrete cases were to infringe the Directive /the GDPR. Such balancing act would be akin to X v Google LLC at the Tribunal de grande instance de Paris on which I reported last week.

Note that in his Opinion of the same day in C-136/17, the AG Opines that the default response of search engine providers must be to honour requests for delisting, and to only exceptionally not do so.

Some issues for the Grand Chamber to chew on. And then some more.

Geert.

(Handbook of) EU Private International Law, 2nd ed. 2016, Chapter 2, Heading 2.2.8.2, Heading 2.2.8.2.5.

, , , , , , , , , , , , , , , , , , , , , , ,

Leave a comment

%d bloggers like this: