Tải bản đầy đủ - 0 (trang)
12 Article 11 Charter on Freedom of Expression and Information: An Intensified Link with Privacy and Data Protection

12 Article 11 Charter on Freedom of Expression and Information: An Intensified Link with Privacy and Data Protection

Tải bản đầy đủ - 0trang

5.12  Article 11 Charter on Freedom of Expression and Information: An Intensified…



229



11 that is at the heart of one of the controversies on Google Spain and Google Inc.265

The obligation for a search engine to remove a link is said to impinge on the right to

receive information.

As the Human Rights Committee of the United Nations states, the freedom of

expression and information constitutes a foundation stone for every free and democratic society.266 This freedom is essential, both for individual development and for

the society as a whole.267

Freedom of expression is a first generation fundamental right, which in essence

protects the individual against governments. However, the right also contains positive obligations for governments. Governments must ensure effective protection in

horizontal situations in order to prevent the freedom of expression from being hampered by acts of private persons and entities.268 Another positive obligation can be

read in Article 11(2) Charter that requires the freedom and pluralism of the media

to be respected.269

Both the rights to privacy and data protection and the freedom of expression and

information are essential values in our democratic society, and are mutually interdependent. As the European Court of Human Rights ruled in Axel Springer v

Germany270 the rights are of equal value. Also, the cases Von Hannover v Germany,271

relating to privacy and defamation, illustrate the essential value of these rights and

freedoms in a democratic society.



5.12.1  A

 n Intensifying Link: Three Reasons and Four

Concepts

The link between the rights to privacy and data protection, on the one hand, and the

freedom of expression and information, on the other hand, is changing and intensifying in an internet environment. First, the dividing line between private and public

speech is becoming blurred, for example as a result of information sharing on social

media. Second, changes are caused by the inherent impact of a free and open internet on privacy and data protection, given the fact that a free and open internet facilitates the processing of personal data. This impact is illustrated by the following

concepts: the concept of net neutrality entails that end-users must be free to access

 Case C-131/12, Google Spain and Google Inc., EU:C:2014:317.

 Human Rights Committee, General Comment No 34 on Article 19 ICCPR, Geneva 2011.

267

 Lorna Woods on Article 11, The EU Charter of Fundamental Rights, A Commentary, Edited by

Steve Peers, Tamara Hervey, Jeff Kenner and Angela Ward, Hart Publishing, 2014, at 320.

268

 Lorna Woods on Article 11, The EU Charter of Fundamental Rights, A Commentary, Edited by

Steve Peers, Tamara Hervey, Jeff Kenner and Angela Ward, Hart Publishing, 2014, at 11.32.

269

 Case C-288/89, Collectieve Antennevoorziening Gouda, EU:C:1991:323.

270

 Application No. 39954/08, at 87.

271

 Von Hannover v Germany, 2004, Application No. 59320/00 and Von Hannover v Germany (no.

2), 2012, Applications Nos. 40660/08 and 60641/08. See Chap. 2, Sect. 2.9 of this book.

265

266



230



5  Understanding and Assessing the Contribution of the CJEU to the Mandate Under…



and distribute information and content, run applications and use services of their

choice via their internet access service; the concept of open data encourages sharing

of information on open sources, including types of information that were historically protected; the concept of Web 2.0 allows individuals to publish information to

the widest public without intermediates. Web 2.0 also entails an abstention of government intervention. Third, new intermediaries – like search engines or providers

of social media platforms – play a role in promoting the freedom of expression and

information, whereas their responsibilities under data protection law are not yet

fully established.

Although these developments relating to the information society272 are positive

as such, they nevertheless also increase the risk of facilitating certain undesired

effects of the freedom of expression, such as hate speech, harm to minors, or defamation or breaching the privacy of individuals.



5.12.2  B

 alancing Privacy and Freedom of Expression, in Light

of Google Spain and Google Inc.

Google Spain and Google Inc.273 is a topical example demonstrating that balancing

the freedom of expression and information with the rights to privacy and data protection is not evident in an information society. The right to be forgotten – although

technically speaking not at stake in Google Spain and Google Inc. and as a term

probably an overstatement274 – is the perfect metaphor for demonstrating the complexity of this balancing.

The Court of Justice’s ruling in Google Spain and Google Inc.275 dealt with the

interaction and possible collision of privacy and data protection with freedom of

expression and information, although the freedom of expression and information

was not explicitly mentioned by the Court. Instead, the Court balanced the interests

of privacy and data protection with the legitimate interests of the search engine and

those of internet users in having access to information.276 Much of the controversy

surrounding the case concerns precisely the relationship between privacy and freedom of expression. The ruling was, for instance, heavily criticised in the US,

because of its presumed adverse impact on the freedom of speech.277 To a certain

extent, this controversy was even instigated by the fact that the Court did not m

­ ention

272



 This has all been explained in Chap. 3 of this book.

 Case C-131/12, Google Spain and Google Inc., EU:C:2014:317.

274

 The ‘right to be forgotten’ never leads to total oblivion. In Google Spain and Google Inc., it is

only a right to have certain personal data deleted. See on this also: The Advisory Council to Google

on the Right to be Forgotten, Final Report, 6 February 2015, https://drive.google.com/

file/d/0B1UgZshetMd4cEI3SjlvV0hNbDA/view.

275

 Case C-131/12, Google Spain and Google Inc., EU:C:2014:317.

276

 Paras 81 and 97 of the ruling.

277

 See Sect. 5.11 above.

273



5.12  Article 11 Charter on Freedom of Expression and Information: An Intensified…



231



the freedom of expression,278 although the interest of the internet user to have access

to information through a search engine – the interest used by the Court – is quite

similar to the right to receive information under Article 11 Charter.

The Court of Justice gave effect to a right that has acquired a reputation as ‘the

right to be forgotten’ and that has led to strongly polarised views. Strictly speaking,

this right does not exist under current law.279 The Court adjudicated on the basis of

the right to erasure of data under Article 12 of Directive 95/46.280 Although technically speaking the Court’s ruling has a much more limited dimension, namely the

deletion of a link on a search engine (the contested information remains available

on the internet, only the access to this information becomes more complicated), it

has provoked a further public discussion on the right to be forgotten.281 Those who

take the perspective of privacy and data protection consider it to be an essential

innovation to deliver protection in an information society, whereas others consider

it as an incentive for censorship on the internet.282

Where an individual under Articles 7 and 8 Charter is entitled to request the deletion of information, this automatically has an impact on the right to receive information under Article 11 Charter. The request for deletion also has an impact on

individuals exercising their freedom of expression, equally under Article 11 Charter.

Anyone uploading information onto the internet – comprising personal data –

becomes a controller responsible for compliance with data protection rules, including the deletion of data when asked.

This case enables a better understanding of the balancing between fundamental

rights.283 The ruling was the result of a complaint by a Spanish resident – Mr. Costeja

González – against the fact that when his name was entered in Google Search, relatively old pages of a Spanish newspaper were displayed. On these pages, his name

was mentioned in relation to the recovery of social security debts. As Mr. Costeja

González claimed, the issue had already been resolved a number of years before284



278



 See: Stefan Kulk and Frederik J. Zuiderveen Borgesius, Google Spain v. González: Did the

Court Forget About Freedom of Expression? September 4, 2014, European Journal of Risk

Regulation (2014).

279

 The right is included in the GDPR, as a right to be forgotten and to erasure (Article 17).

280

 Only the referring Spanish Tribunal mentions the right to be forgotten in its preliminary

questions.

281

 Paul Bernal even wrote a ballad of Google Spain for the International Journal of European Law,

endorsed by Joseph Weiler. See: http://www.ejiltalk.org/the-ballad-of-google-spain/.

282

 See: Hielke Hijmans, Right to have links removed: Evidence of effective data protection,

Maastricht Journal of European and Comparative Law, 2014(3). Further, e.g.: Jeffrey Rosen, The

right to be forgotten, 4 Stanford Law Review Online 88, February 13, 2012, 88, available on:

http://www.stanfordlawreview.org/sites/default/files/online/topics/64-SLRO-88.pdf/; Advisory

Council to Google on the Right to be Forgotten, Final Report, 6 February 2015; Stefan Kulk and

Frederik J. Zuiderveen Borgesius, Google Spain v. González: Did the Court Forget About Freedom

of Expression? European Journal of Risk Regulation, (2014).

283

 Taken from: Hielke Hijmans, Right to have links removed: Evidence of effective data protection, Maastricht Journal of European and Comparative Law, 2014(3).

284

 The CJEU’s ruling comes 16 years after the initial publication.



232



5  Understanding and Assessing the Contribution of the CJEU to the Mandate Under…



and the data were now entirely irrelevant. They should thus be made inaccessible.

The Court of Justice ruled that under these circumstances Mr. Costeja González had

a right to obtain that the information relating to him be no longer linked to his name

in the list of results following searches on the basis of his name.

Mr. Costeja González invoked his rights against a search engine, not against the

publisher of the website displaying the now irrelevant information.285 This allowed

the Court of Justice to underline that the activity of the search engine affects the

rights to privacy and data protection more significantly than the original source of

information, which is logical, since no one would normally consult the publication

in the Spanish newspaper anymore. In addition, the processing by the publisher of

the website may fall within the derogation in Directive 95/46 for journalistic

purposes.286



5.13  G

 oogle Spain and Google Inc. Restores a Balance,

but Raises Questions of Legitimacy

First, the European Court of Justice took into consideration287 the new reality in the

information society that has an impact on privacy and data protection, in particular

what the Podesta Report calls the persistence of data. Data, once created, is effectively permanent.288 Moreover, it is ubiquitously available, so it can be accessed

through other sources than the publisher’s website. Therefore, the only effective

way to receive protection is the removal of the link on a search engine.

Second, the reality of internet may have an impact on the protection that is given

and on the balancing between fundamental rights. The ubiquitous availability of

information affects (or harms) the data subject – at least in the circumstances of the

case –, but does not adversely impact the right to receive information. On the contrary, the internet facilitates the access people have to information.289 In these circumstances – as a rule – the right of the data subject prevails as a result of the

Court’s ruling, but this does not change the balance between privacy and data protection and the freedom of expression.290 What the Court did was to restore a perturbed balance. The Court considered that the general public had a justified interest



285



 At 84–85 of the ruling.

 Article 9 of Directive 95/46 on data protection.

287

 The ruling also raises questions as to the territorial scope of EU data protection law. This is

discussed in Chap. 9 of this book.

288

 Big Data: Seizing Opportunities, Preserving Values, Executive Office of the President (Podesta

Report), May 2014, at 9.

289

 See also Chap. 3, Sect. 3.9.

290

 This argument is not shared by all commentators. See e.g.: Stefan Kulk and Frederik

J. Zuiderveen Borgesius, Google Spain v. González: Did the Court Forget About Freedom of

Expression? September 4, 2014, European Journal of Risk Regulation, 2014.

286



5.13  Google Spain and Google Inc. Restores a Balance, but Raises Questions…



233



in access to information that may overrule the rights to privacy and data protection,

for example when the data subject is a public figure.

Third, the ubiquitous availability of information implies a lack of control of data

subjects, and therefore affects their autonomy.291 It has become normal practice for

a search engine to disseminate information on any individual, solely based on a

reference to the name of that individual in a search request, without having the consent of the individual involved or informing him or her. It is difficult to reconcile this

practice with a raison d’être of the right to data protection, which is to give an individual control over his personal data. This confirms one conclusion of Chap. 2 of

this book, namely that data protection is not a right to prevent processing of personal data; it is a claim based on fairness.292

Fourth, the Court referred implicitly to the right to receive information, but did

not address the freedom of expression and information itself, as guaranteed by

Article 11 Charter.293 Authors argue that the ruling affects the freedom of expression

by publishers, because delinking by search engines makes their publications harder

to find, and also because search engines themselves benefit from the freedom of

expression.294 In any event, the Court considered the importance of search engines

in a developing information society, as a condition for the exercise of freedom of

expression, but linked this to the responsibility to ensure privacy and data

protection.

The fifth issue relates to the differentiation based on the value a fundamental

right aims to protect. It is remarkable that the Court placed the economic interest of

the search engine and the interest of the general public to receive information, which

is, as said, closely linked to the freedom of expression and information (Article 11

Charter), on the same level. This reasoning of the Court does not correspond with

the specific role of fundamental rights in a democratic society. A possible explanation is that the Court did not consider the freedom of expression and information

because it was not included in the questions by the referring tribunal.

Finally, as a result of Google Spain and Google Inc.,295 search engines now have

the responsibility for balancing between different fundamental rights: privacy and

data protection on the one hand and the freedom of expression – although, as said,

not explicitly mentioned by the Court – on the other hand. This responsibility

requires difficult policy judgements on questions like: After how many years can

one claim that information should be removed? Which role in the public life of the



291



 Frederik Zuiderveen Borgesius, Improving Privacy Protection in the Area of Behavioural

Targeting, Kluwer Law International 2014, at 3.3. See also Chaps. 2 and 3 of this book.

292

 See the conclusions of Chap. 2.

293

 Apart from a reference to Article 9 of Directive 95/46, the derogation for journalistic purposes

under Article 9 of Directive 95/46.

294

 See e.g.: Stefan Kulk and Frederik J. Zuiderveen Borgesius, Google Spain v. González: Did the

Court Forget About Freedom of Expression? September 4, 2014, European Journal of Risk

Regulation, 2014.

295

 Case C-131/12, Google Spain and Google Inc., EU:C:2014:317.



234



5  Understanding and Assessing the Contribution of the CJEU to the Mandate Under…



data subject qualifies as relevant in order to legitimise the continuous linking to

information by a search engine?296



5.13.1  The CJEU No Longer Takes a Deferential Approach

In Satamedia297 – a ruling delivered before the entry into force of the Lisbon Treaty –

the European Court of Justice had to deal with the derogation for journalistic purposes under Article 9 of Directive 95/46. The Court chose for a deferential method:

whilst emphasising the need for balancing required under EU law, the Court left the

balancing itself to the national jurisdiction, without providing further guidance.298

In Google Spain and Google Inc.,299 the Court departed from this deferential

method. It explained the obligations of a search engine in light of the Charter, and

in particular the obligation to remove – at the request of the person concerned – a

certain type of link from the list of results of a search based on the name of that

person. The Court gave guidance on how a request for removal should be balanced

against the right of the general public to know. As a rule, so the Court stated, privacy

and data protection override the interest of the general public to know.300



5.13.2  Democratic Legitimacy Is Not Necessarily Guaranteed

This book understands legitimacy, in relation to the governance of data protection,

as ensuring that there is some degree of accountability towards political institutions.301 As a result of Google Spain and Google Inc., the search engines now have

the task of balancing between fundamental rights, a task which is closely related to

one of the core tasks of government in protecting fundamental rights and hence

requires high standards of legitimacy to be respected.302 This gives search engines a

social responsibility, in a domain where the need for balancing between various

interests already challenges the effectiveness of data protection.303 The Article 29

296



 Further read: Advisory Council to Google on the Right to be Forgotten, Final Report, 6 February

2015

297

 Case C-73/07, Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy

(Satamedia), EU:C:2008:727.

298

 To be complete, the ruling by the Finnish Court ended up with the ECtHR. ECtHR, 23 June

2015, Satakunnan Markkinapörssi Oy and Satamedia Oy v Finland, Application No. 931/13.

299

 Case C-131/12, Google Spain and Google Inc., EU:C:2014:317.

300

 At 97 of the ruling.

301

 See Chap. 1 of this book.

302

 See Chap. 4 of this book.

303

 As explained by Federico Ferretti, Data protection and the legitimate interest of data controllers:

Much ado about nothing or the winter of rights?’, CMLR, 51, Issue 3, pp. 843–868, 2014.



5.14  Article 42 Charter on the Right of Access to Documents: A Strict Scrutiny…



235



Working Party provides guidance,304 but it is doubtful whether this guidance is sufficient to ensure legitimacy, in the sense of this book.

This hesitation relates to a more general point of democratic legitimacy, where

public tasks are exercised by or with the help of private parties. Governments may

include non-governmental stakeholders in the governance of privacy and data protection, but this does not mean that the primary responsibility for the protection is

also shared with these stakeholders.305



5.14  A

 rticle 42 Charter on the Right of Access

to Documents: A Strict Scrutiny but Not When

Balancing with Privacy and Data Protection

The right of access to documents under Article 42 Charter gives effect to the value

of transparency and facilitates democratic control.306 The case law of the Court of

Justice of the European Union defined the widest possible public access to documents as being a basic principle.307

There is a close link between access to documents on the one hand and privacy

and data protection on the other hand. Article 4(1)(b) of Regulation 1049/2001308

regarding public access to European Parliament, Council and Commission documents and the case law on the basis of this article309 demonstrate this. In this case

law, which balances two (sets of) fundamental rights at the EU level, the Court of

Justice underlined that Regulation 1049/2001 and Regulation 45/2001310 on data



304



 Article 29 Working Party, Guidelines on the implementation of the Court of Justice of the

European Union ruling on “Google Spain and inc v. Agencia Espola de Protección de Datos

(AEPD) and Mario Costeja González” – WP 225.

305

 As explained in Chap. 4 of this book.

306

 Further read: Deirdre Curtin and Joana Mendes on Article 42, The EU Charter of Fundamental

Rights, A Commentary, Edited by Steve Peers, Tamara Hervey, Jeff Kenner and Angela Ward, Hart

Publishing, , pp. 1099–1119, 2014.

307

 E.g., Joined cases C-514/07P, C-528/07P and C-532/07P, Sweden v API and Commission (and

connected cases), EU:C:2010:541, at 73.

308

 Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001

regarding public access to European Parliament, Council and Commission documents, OJ 2001 L

145/43.

309

 Case C-28/08P, Commission v Bavarian Lager, EU:C:2010:378, appeal against Case T-194/04,

Bavarian Lager v Commission, EU:T:2007:334 is the leading case. See also Case T-82/09,

Dennekamp v European Parliament, EU:T:2011:688, Case T-161/04, Valero Jordana v Commission,

EU:T:2011:337; Case T-190/10, Egan and Hackett v European Parliament, EU:T:2012:165; Case

T-115/13, Dennekamp v Parliament (Dennekamp II), ECLI:EU:T:2015:497; C-615/13P,

ClientEarth and PAN Europe v EFSA, EU:C:2015:489.

310

 Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December

2000 on the protection of individuals with regard to the processing of personal data by the

Community institutions and bodies and on the free movement of such data, OJ L 8/1.



236



5  Understanding and Assessing the Contribution of the CJEU to the Mandate Under…



protection do not contain provisions granting one right primacy over the other. The

full application of both regulations should, in principle, be ensured.311



5.14.1  A

 ccess to Documents as a Promotor of Transparency

and Good Governance

Transparency means openness in the functioning of governments, in order to promote good governance and ensure the participation of civil society.312 Transparency

finds its expression inter alia in the right of access to documents, as laid down in

Article 15(3) TFEU and Article 42 Charter.313 Transparency, or openness, extends –

subject to limitations – to all parts of governments. This includes authorities which

by nature have to respect some degree of confidentiality, in particular services

responsible for national security. Openness of these services is not evident, as the

Snowden revelations demonstrate. This is why, for instance, Reidenberg proposes

that where governments use personal data in the hands of the private sector, this

must be logged and made transparent to citizens.314

Article 42 Charter on the right of access to documents is closely related to the

freedom of expression and information. Both rights and freedoms are essential for a

democratic society; they both concern the right of the general public to be informed

and they give rise to the same issues in relation to the rights to privacy and data

protection. One could interpret access to documents as a species of the right to

receive information, which is an element of Article 11 Charter. This interpretation

finds support in the case law of the European Court of Human Rights, where a right

of access to documents was recognised as part of the right to receive information.315

In Dennekamp II,316 the General Court of the European Union referred to Articles

11 and 42 Charter in one go, in ruling on the application of Article 4(1)(b) of

Regulation 1049/2001.317

311

 Case C-28/08P, Commission v Bavarian Lager, EU:C:2010:378, at 56. See also Herke

Kranenborg on Article 8, The EU Charter of Fundamental Rights, A Commentary, Edited by Steve

Peers, Tamara Hervey, Jeff Kenner and Angela Ward, Hart Publishing, 2014, at 234.

312

 Wording of Article 15(1) TFEU.

313

 Further read: Irma Spahiu, ‘Courts: An Effective Venue to Promote Government Transparency?

The Case of the Court of Justice of the European Union’, 31(80) Utrecht Journal of International

and European Law, 5, 2015.

314

 Joel Reidenberg, The Data Surveillance State in the US and Europe, Fordham Law Legal

Studies Research Paper No. 2349269, (Princeton University – Center for Information Technology

Policy/Fordham University School of Law), Wake Forest Law Review, November 2013.

315

 Albeit reluctantly; see: Deirdre Curtin and Joana Mendes on Article 42, The EU Charter of

Fundamental Rights, A Commentary, Edited by Steve Peers, Tamara Hervey, Jeff Kenner and

Angela Ward, Hart Publishing, 2014, at 1102.

316

 Case T-115/13, Dennekamp v Parliament (Dennekamp II), ECLI:EU:T:2015:497.

317

 Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001

regarding public access to European Parliament, Council and Commission documents, OJ 2001 L

145/43.



Tài liệu bạn tìm kiếm đã sẵn sàng tải về

12 Article 11 Charter on Freedom of Expression and Information: An Intensified Link with Privacy and Data Protection

Tải bản đầy đủ ngay(0 tr)

×