Thank you Nathalie Smuha for first signalling the €600,000.00 fine which the Belgian Data Protection Authority (DPA) issued on Tuesday against Google Belgium, together with a delisting order of uncertain reach (see below) and an order to amend the public’s complaint forms. The decision will eventually be back up here I am assume (at vanished yesterday) however I have copy here.
Nauta Dutilh’s Peter Craddock and Vincent Wellens have very good summary and analysis up already, and I am happy to refer. Let me add a few things of additional note:
- The one-stop shop principle of the GDPR must now be under severe strain. CNIL v Google already put it to the test and this Belgian decision further questions its operationalisation – without even without for the CJEU to answer the questions of the Brussels Court of Appeal in the Facebook case. At 31, the DPA refers to a letter which Google LLC had sent on 23 June 2020 (a few days therefore after the French decision) to the Irish DPA saying that it would no longer object to national DPAs exercising jurisdiction in right to be forgotten cases. Of note is that in ordinary litigation, deep-pocket claimants seeking mozaik jurisdiction seldom do that because it serves the general interest.
- Having said that, the Belgian DPA still had to establish jurisdiction against Google Belgium. Here, CJEU Google v Spain, Google v CNIL, and Wirtschaftsakademie led the DPA to take a ‘realistic’ /business plan approach (such as Jääskinen AG in Google Spain) rather than a legally pure approach: at 80 following extensive reference to CJEU authority, and to the effet utile of the GDPR, the DPA holds that it matters little whether the actual processing of the date takes places outside of the EU, by Google employees ex-EU, and that Google Belgium’s activities are supportive only. A Belgian resident’s right to be forgotten has been infringed; a Google entity is available there: that would seem to suffice.
- That left the issue of the territorial reach of the delisting request. The DPA arguably cuts a few corners on the Google Belgium issue; here, it is simply most vague: at 81 ff it refers to the jurisdictional decision in e-Date Advertising, that for infringement of privacy within Brussels Ia, the courts of the person’s centre of interests are best placed to hear the case in its entirety, holding this should be applied mutatis mutandis in GDPR cases and removal orders. It then holds at 85 that neither Google v CNIL nor Belgian law give it specific power to impose a worldwide delisting order, yet at 91 that an EU-wide delisting order would seem an effective means of redress, to end up in its final order (p.48-49) not identifying a territorial scope for delisting.
I am confused. I suspect I am not the only one.
(Handbook of) EU private international law, 2nd ed.2016, chapter 2, Heading 126.96.36.199.5.
Thank you Gaetan Goldberg for flagging that the French Supreme Court has confirmed on 19 June last, jurisdiction of the French Data Protection Agency (‘DpA’), CNIL for issuing its fine (as well as confirming the fine itself) imposed on Google for the abuse of data obtained from Android users. The Court was invited to submit preliminary references to the CJEU on the one-stop shop principle of the GPDR, but declined to do so.
Readers of the blog know that my interest in the GDPR lies in the jurisdictional issues – I trust date protection lawyers will have more to say on the judgment.
With respect to the one stop shop principle (see in particular A56 GDPR) the Court held at 5 ff that Google do not have a ‘main establishment’ in the EU at least not at the time of the fine complained of, given that the Irish Google office (the only candidate for being the ‘main establishment) at least at that time did not have effective control over the use and destination of the data that were being transferred – US Google offices pulling the strings on that decision. A call by the CNIL under the relevant EU procedure did not make any of the other DPAs come forward as wanting to co-ordinate the action.
On the issue of consent the SC referred to CJEU Cc-673/17 Planet49 and effectively held that the spaghetti bowl of consent, ticking and unticking of boxes which an Android user has to perform to link a Google account to Android and hence unlock crucial features of Android, do not amount to consent or proper compliance with GDPR requirements.
Update 3 July 2007 for the opposite view in the same case, opting for the curial law as lex arbitri, see Paris Court of Appeal on 23 June 2020, discussed here. Quite the tale of conflicting views in the same case!
Thank you Filbert Lam for yet again flagging an important case. In  EWCA Civ 6 Kabab-Ji SAL v Kout Food Group Flaux LJ extensively discussed the application of Sulamerica as to the governing law of an arbitration agreement which provides for arbitration in Paris but which is contained in a main agreement which is expressly governed by English law; and as to whether the respondent became a party to the main agreement and/or the arbitration agreement notwithstanding the presence of No Oral Modification provisions in the main contract.
Parties’ choice of English law for the underlying contract was found to also be an express choice of the law governing the arbitration agreement. This meant there was no need to consider the implications (particularly viz a possible implied choice of law) of a choice of Paris as seat or other aspects of the Sulamérica test. Recognition and enforcement of the award which applied French law, was refused.
Jonathan Lim suggests here that the judgment is a departure from the understanding of separability in previous CA decisions, although the ensuing discussion on his feed also suggests that the factual interpretation of the clauses might suggest the exact opposite. I tend to agree with Jonathan: the generic nature of the clauses and the lack of (reported at least) other strong indications seem to suggest the finding of express choice of law was optimistic.
In Hong Ziyun v Chan Kwan Ming  HKCFI 2125, Chan J at the end of August summed up the Hong Kong approach (as it is that of the common law) to consolidation of jurisdiction at 31: ‘the approach of the courts should be to favor resolution of all disputes associated with a transaction in one jurisdiction.’ That is the so-called one stop shop or one stop principle (whether or not hyphenated).
As Herbert Smith Freehills note, in a host of related loan documents only one of the documents contained an express jurisdiction clause (in favour of the court of Xiamen in Mainland China). The defendants applied for and obtained a stay of proceedings in Hong Kong in favour of Mainland China. HSF summarise the reasoning (the judgment itself is not too long and logically structured) helpfully as follows:
- When there is no express jurisdiction clause, the applicable law is that which has the “closest and most real connection” with the transaction.
- Most of the defendants’ business was in Mainland China. They also spent most of their time in Mainland China. On the evidence presented, the court was unable to place significant reliance on the permanent “residence” of any of the defendants in Hong Kong as showing any real or closest connection with Hong Kong.
- The location of the debt, currency, and place of performance of the loans as well as the execution of and governing law clause in the SA all had a strong connection with Mainland China.
Thank you Chloe Oakshett for flagging  CSOH 45 BN Rendering Limited v Everwarm Ltd, in which the Commercial Court in Edinburgh considered its jurisdiction to enforce an adjudicator’s award. Bone of contention was choice of court (ditto law) in the underlying contracts in favour of the courts at England (and English law). Both parties are domiciled in Scotland. Relevant works had to be carried out in Scotland. The Brussels I Recast Regulation does not formally apply between them: Scots-English conflicts are not ‘international’ within the meaning of that Regulation.
However Lord Bannatyne (at 16) points out that even for intra-UK conflicts, the Civil Jurisdiction and Judgements Act 1982 (per instruction in section 20(5) a) must be interpreted taking into account the Brussels regime and its application by the CJEU. It is in this context that Case 24/76 Colzani resurfaces: ‘real consent’ needs to be established without excess formality.
At 28 Lord Banatyne lists claimant’s arguments: the party’s contract was not signed by both parties; nevertheless the defender’s subcontract terms and conditions form part of the contract; the subcontract order refers expressly to the defender’s subcontract terms and conditions which includes the jurisdiction exclusion clause and lastly, that express reference meets the test for real consent to the jurisdiction clause.
Put in summary: At 49: Is an express reference in the defender’s subcontract order (sent to the pursuer) to the defender’s subcontract terms and conditions, which contain the jurisdiction clause (which document is unsigned by the pursuer) sufficient to satisfy the test that it is clearly and precisely demonstrated that the parties agreed to the clause conferring jurisdiction on the English courts? Or put another way, in order to satisfy the said test is it not only necessary for there to be an express reference to the defender’s subcontract terms and conditions but for the subcontract order to have been signed by the pursuer to demonstrate that the parties agreed to the clause conferring jurisdiction on the English courts?
The judge considers the answer to the above questions to be question 1, yes and question 2, no – and I believe he is right.