Tải bản đầy đủ - 0 (trang)
9 Jurisdictional Issues: Public International Law and the Internet

9 Jurisdictional Issues: Public International Law and the Internet

Tải bản đầy đủ - 0trang

474



9  Understanding the EU Mandate Under Article 16 TFEU in the External Domain…



protection. This focus of scope is made whilst fully recognising that private international law is relevant for data protection, in particular because private international

law determines the applicable law or the competent court, in cases where a company or an individual engages in a law suit under private law. This book also recognises commentators noting that data privacy blurs the distinction between public

law and private law.135

A third foundation of jurisdiction is the jurisdiction laid down in international

fundamental rights treaties, imposing extraterritorial obligations on states to protect

individuals, even where there would be no jurisdiction in public international law

and the state has no power to act.136 This foundation of jurisdiction in international

human rights law may be relevant for the exercise of jurisdiction based on Article 8

ECHR, on Convention 108 or on Article 17 ICCPR. However, as Moreno-Lax and

Costello explain, this foundation of jurisdiction is controversial and – as they underline – ill-fitting in the EU context.137 This argument is not necessarily undisputed,138

but, this book – which does not address jurisdiction as a core topic – does not further

elaborate on international human rights law jurisdiction.



9.9.1  E

 U Jurisdiction Under Public International Law: A Wide

Power to Prescribe

Under public international law, there is no generally accepted solution for internet

jurisdiction. One must rely on general public international law. In public international law, jurisdiction means a limitation of states to act, because of sovereign

claims of other states.139 The main rule of jurisdiction is that the jurisdictional competence of a state – or the European Union, which in this particular context equals

a state – is primarily territorial. Within its territory, the state has exclusive power to

enact and to enforce the law.

The power of a state outside its territory was defined in 1927 by the Permanent

Court of International Justice, in Lotus.140 This case is still the main standard of

135



 Further read: Extraterritorial Data Privacy Law, Dan Jerker B. Svantesson, 2013, at 2.2.

 Violeta Moreno-Lax and Cathryn Costello in: The EU Charter of Fundamental Rights, A

Commentary, Edited by Steve Peers, Tamara Hervey, Jeff Kenner and Angela Ward, Hart

Publishing 2014, at 1659. The authors refer to the work of Milanovic, Extraterritorial Application

of Human Rights Treaties (OUP 2011).

137

 Violeta Moreno-Lax and Cathryn Costello in: The EU Charter of Fundamental Rights, A

Commentary, Edited by Steve Peers, Tamara Hervey, Jeff Kenner and Angela Ward, Hart

Publishing, 2014, at 1668.

138

 Milanovic, referred to by Moreno-Lax and Costello attaches more importance to fundamental

rights jurisdiction.

139

 Violeta Moreno-Lax and Cathryn Costello in: The EU Charter of Fundamental Rights, A

Commentary, Edited by Steve Peers, Tamara Hervey, Jeff Kenner and Angela Ward, Hart

Publishing, 2014, at 1659.

140

 P.C.I.J., S.S. Lotus, P.C.I.J. Reports, Series A, No. 10 (1927).

136



9.9 Jurisdictional Issues: Public International Law and the Internet



475



reference for jurisdiction. Lotus made a distinction between enforcement and prescriptive jurisdiction. The rule is that “States are precluded from enforcing their

laws in another State’s territory”, but “international law would pose no limits on a

State’s jurisdiction to prescribe its rules for persons and events outside its borders”.141

In an era of globalisation, the exercise of extraterritorial jurisdiction is often

inevitable. On the internet, the European Union is vulnerable due to adverse effects

of foreign activities142 in the internal EU legal order. This vulnerability justifies

extraterritorial jurisdiction in an internet environment. Article 4(1)(c) of Directive

95/46143 is an example of how the European Union establishes extraterritorial

­jurisdiction to address these adverse effects by bringing data controllers in third

countries, who make use of equipment in the European Union, within the scope of

EU law.

Other bases for jurisdiction outside the territory of a state have been recognised,

all founded on the notion that there must be a meaningful link with the state claiming competence. Some other bases are: nationality, flag, diplomatic and consular

relations, effect, protection, passive personality and universality.144 These bases do

not all have the same relevance for the subject of this book.145 Obviously, diplomatic

and consular relations are not directly relevant for privacy and data protection on the

internet. The same could probably be said about passive personality, used in criminal law as a basis for a state to protect its citizens abroad. The passive personality

principle allows states, in limited cases such as terrorism, “to claim jurisdiction to

try a foreign national for offenses committed abroad that affect its own citizens”.146

Also a flag is not directly relevant on the internet in view of its networked nature.

The following bases for the European Union147 to claim jurisdiction outside of the



141



 Cedric Ryngaert, Jurisdiction in International Law, United States and European Perspectives,

Doctorate Thesis Katholieke Universiteit Leuven, 2007, at 35.

142

 Cedric Ryngaert, Jurisdiction in International Law, United States and European Perspectives,

Doctorate Thesis Katholieke Universiteit Leuven, 2007, at 770.

143

 The directive applies where “the controller is not established on Community territory and, for

purposes of processing personal data makes use of equipment, automated or otherwise, situated on

the territory of the said Member State […]”.

144

 This list is taken from the ruling of the ECtHR in Bankovic v Belgium, Application No. 52207/99,

at 59. See also: Violeta Moreno-Lax and Cathryn Costello in: The EU Charter of Fundamental

Rights, A Commentary, Edited by Steve Peers, Tamara Hervey, Jeff Kenner and Angela Ward, Hart

Publishing, 2014, at 1667.

145

 Further read: Dan Jerker B. Svantesson, Extraterritoriality in Data Privacy Law, Ex Tuto

Publishing, 2013.

146

 Source: http://www.britannica.com/topic/passive-personality-principle (July 2015).

147

 This perspective of applicability of EU law means that this section is not about internet jurisdiction on general, which would cover also other methods to establish jurisdiction, such as the choice

of law. See on this: Joel R. Reidenberg, “Technology and Internet Jurisdiction”, University of

Pennsylvania Law Review, vol. 153/1951, 2005.



476



9  Understanding the EU Mandate Under Article 16 TFEU in the External Domain…



EU territory could, however, be relevant: nationality, effect, protection and universality, as will be discussed below.

The exercise of jurisdiction on these bases is limited by sovereign territorial

rights of other states. An example is the exercise of jurisdiction on the basis of personality over nationals abroad. This exercise is subordinate to the territorial competence of the other state concerned and, in principle, the latter’s consent is required.148

In addition, for the European Union, the exercise of extraterritorial competence

is – just like any action of the European Union – subject to the principle of effectiveness.149 In principle, this exercise of jurisdiction is only legitimate if there is effective control over the persons or activities outside the territory, a requirement that

acquires a new dimension on the internet. Laws on the internet must actually be

enforceable, otherwise this would undermine the trust in the legal system.150

However, this does not per se exclude a wider claim of jurisdiction, where the

European Union has no power to enforce. Svantesson makes a difference between

“bark-jurisdiction” and “bite-jurisdiction”.151

Especially in a rapidly developing information society, the European Union –

acting as a state – could also claim extraterritorial jurisdiction in accordance with

public international law, in situations where – at this stage of development – effective enforcement is not guaranteed or even absent. This claim makes sense, for two

reasons. First, the European Union underlines the values it defends in an internet

environment, which could encourage interlocutors in third countries to comply ‘voluntarily’. Second, the absence of effective enforcement power does not mean that

enforcement power will not evolve in the immediate future.



9.9.2  T

 he Respect of Territorial Sovereign Rights: Overlapping

Jurisdictions in Cyberspace but a Wide Discretion

for the EU Legislator

The territoriality principle is the most basic principle of international jurisdiction,

meaning that a state has jurisdiction over acts that have been committed within the

territory.152 Territoriality, however, does not fully work on the internet as a global



 ECtHR in Bankovic v Belgium, Application No. 52207/99, at 60.

 Paul Craig and Grainne de Búrca, EU Law, Text, Cases and Material (Fifth Edition), Paul Craig

and Grainne de Burca, 2011, at 223–231.

150

 Dan Jerker B. Svantesson, Extraterritoriality in Data Privacy Law, Ex Tuto Publishing, 2013, at

70.

151

 Dan Jerker B. Svantesson, A jurisprudential justification for extraterritoriality in (private) international law, Santa Clara Journal of International Law, Volume 13, Issue 1 2015.

152

 Cedric Ryngaert, Jurisdiction in International Law, United States and European Perspectives,

Doctorate Thesis Katholieke Universiteit Leuven, 2007, at 47.

148

149



9.9 Jurisdictional Issues: Public International Law and the Internet



477



network, or – with reference to Castells153 – a networked society.154 The overlapping

of jurisdictions on the internet is no longer an exception, but it is the essence of the

internet as a global network itself. This is the background for a short exploration of

alternative grounds of jurisdiction.

In a paper on extraterritorial jurisdiction in cyberspace,155 Hildebrandt discusses

alternative grounds of jurisdiction. The first alternative she refers to is to compare

the internet to the freedom of the seas, as developed by Grotius in his Mare Liberum,

first published in 1609. In line with the view of Grotius, the internet should be a free

space – or a common good – where national laws do not apply. This view was found

attractive by scholars in the earlier age of the internet, like Johnson and Post who

rightly claimed in 1996 that the internet “radically subverts a system of rule-making

based on borders between physical spaces, at least with respect to the claim that

cyberspace should naturally be governed by territorially defined rules”.156

Consequently, the internet should be governed by a separate body of law. This claim

provoked a debate between Goldsmith and Post on this point, in which Goldsmith

claimed that the internet is functionally identical to other transnational activities, the

traditional legal tools being applicable, and Post replied that this was not the case.157

In our view, the argument that the internet should be governed by a separate body

of law certainly has its merits, but is at present difficult to reconcile with the pervasiveness of the internet in our daily lives. It makes ever less sense to consider the

internet as a space that can be separated from the physical world.158 RFID, the

Internet of Things and the ubiquitous connectivity through mobile devices are logical illustrations. Another example, which is illustrative for jurisdiction, is that the

internet facilitates cross-border remote control.159

Another alternative ground for jurisdiction in Hildebrandt’s paper is what she

calls “occupatio”. Where interests of sovereign states are a stake, states take the law

into their own hands and enforce the law outside their physical borders. The hacking



153



 Manuel Castells, The Rise of the Network Society, Volume I: The Information Age: Economy,

Society and Culture, 2nd edition (2010), as explained in Chap. 3, Sect. 3.4 of this book.

154

 Further read: Mireille Hildebrandt, Extraterritorial jurisdiction to enforce in cyberspace?:

Bodin, Schmitt, Grotius in cyberspace, University of Toronto Law Journal, Volume 63, Number 2,

Spring 2013, pp. 196–224.

155

 Mireille Hildebrandt, Extraterritorial jurisdiction to enforce in cyberspace?: Bodin, Schmitt,

Grotius in cyberspace, University of Toronto Law Journal, Volume 63, Number 2, Spring 2013,

pp. 196–224

156

 David R. Johnson and David G. Post, “Law And Borders: The Rise of Law in Cyberspace”, 48

Stanford Law Review, 1367, 1996.

157

 Jack L. Goldsmith, “Against Cyberanarchy”, 65 University of Chicago Law Review 1199

(1998); David G. Post, Against Cyberanarchy, 17 Berkeley Technology L aw Journal 1365 (2002).

158

 As argued by Julie E. Cohen, “Cyberspace As/And Space”, Columbia Law Review, Vol. 107,

No. 1, pp. 210–256, Jan. 2007.

159

 Mireille Hildebrandt, Extraterritorial jurisdiction to enforce in cyberspace?: Bodin, Schmitt,

Grotius in cyberspace, University of Toronto Law Journal, Volume 63, Number 2, Spring 2013,

pp. 196–224, at 204.



478



9  Understanding the EU Mandate Under Article 16 TFEU in the External Domain…



of a computer system located abroad for law enforcement purposes is an example.160

Another example is provided by the practices revealed by Snowden, which demonstrate that surveillance by the NSA also takes place outside US territory.

The case law on internet jurisdiction is still limited. This is why the case law in

areas with similarities to the internet has relevance. Air Transport Association of

America and Others161 concerned the sovereignty over the airspace. In this case, the

European Court of Justice ruled on EU legislation giving wide territorial effect to the

EU measures on greenhouse gas emissions trading schemes, based on the Kyoto

Protocol, by applying these measures to all flights departing or arriving in the European

Union. The Court accepted this wide territorial effect, which led to criticism, in view

of the extensive interpretation of public international law by the Court.162

This leads to a further starting point for the examination of internet jurisdiction.

The EU legislator has a wide margin of discretion in laying down provisions with

extraterritorial effect. However, these provisions cannot by themselves enlarge the

powers of the European Union under public international law. Legitimate claims by

third countries and international organisations should be respected. A prima facie –

in line with Air Transport Association of America and Others163 – the Court of

Justice interprets this limitation strictly. It is in this context that the active role

entrusted to the European Union for the protection of the fundamental rights of

privacy and data protection must be reconciled with public international law.



9.10  J urisdiction Should Be Based on a Meaningful Link

with the Protection of Individuals in the EU: The Effect

of an Act on the Internet on Individuals Residing

in a Jurisdiction

The case law on internet jurisdiction is still limited and there are no clear international rules under public international law. The international instruments on private

international law, such as the United Nations Convention on the Use of Electronic

Communications in International Contracts, do not give a clear indication on internet jurisdiction either.164

160



 Illustrations of extraterritorial State practices on Internet are found in Eric Schmidt, Jared

Cohen, The New Digital Age, 2014.

161

 Case C-366/10, Air Transport Association of America and Others, EU:C:2011:864.

162

 Violeta Moreno-Lax and Cathryn Costello in: The EU Charter of Fundamental Rights, A

Commentary, Edited by Steve Peers, Tamara Hervey, Jeff Kenner and Angela Ward, Hart Publishing

2014, at 1663. B. Mayer (note on Case C-366/10 - Air Transport Association of America and

Others, EU:C:2011:864, CMLR 49 (2012), 1113–1140) criticised the CJEU for another reason: not

following the line of Kadi and taking into account environmental protection as a fundamental right

(which would have led to similar outcome in the case, but for different reasons).

163

 Case C-366/10, Air Transport Association of America and Others, EU:C:2011:864.

164

 Faye Fangfei Wang, Obstacles and solutions to internet jurisdiction: a comparative analysis of the

EU and US Laws, Journal of International Commercial Law and Technology, 2008, at 233–241.



9.10 Jurisdiction Should Be Based on a Meaningful Link with the Protection…



479



This means that a solution is required for a problem that the Court of Justice

already recognised in Lindqvist.165 In principle, every publication on a website by a

public or private actor based in a third country containing personal data that can be

accessed within the European Union has an effect in the Union and could thus trigger the applicability of EU data protection law.

In theory, the European Union could, therefore, claim jurisdiction over the entire

internet. Kuner mentions the example of the publication by a company in China of

the payroll data of its employees, who are all residing in China.166 This publication

is accessible from the Union, but the link with the Union is very weak and claiming

jurisdiction would be difficult to justify, whereas there is a legitimate claim of jurisdiction by a third country that should be respected.

This example shows that any – theoretical – effect would not be enough to claim

EU jurisdiction, but that a stronger effect on the privacy and data protection of individuals within the European Union is needed to establish jurisdiction for EU law.

Above, we explained that public international law, as interpreted in Lotus,167 does

not limit the prescriptive jurisdiction of a state (nor of the Union) and allows the

simultaneous exercise of a multiplicity of jurisdictions. An alternative presented by

Ryngaert is the conferral of jurisdiction on the state with a strong link, or even the

strongest link, with the matter to be regulated. In privacy and data protection, this

strong link could be based on the need for effective protection of individuals in the

Union. Reformulated, a legitimate claim of external EU jurisdiction in this area

should be based on a meaningful link with the effective protection of the individual

in the European Union.

A meaningful link with the protection in the European Union could be established by alternatives for territorial jurisdiction, such as jurisdiction based on nationality, effect, protection and universality.168 In the literature on internet jurisdiction

the emphasis is on personal jurisdiction, based on the need to protect individuals in

view of the effect an act on the internet has on individuals residing in a jurisdiction.

Reidenberg a.o. analyse personal jurisdiction, based on a test of effects. This test has

similarities with a test based on the need for protection of the persons falling within

the jurisdiction.169 The test combines components of nationality, effect and protec-



 Case C-101/01, Lindqvist, EU:C:2003:596, at 56–71. In Lindqvist the CJEU ruled on a situation

of uploading of personal data on the internet, by a European resident. The CJEU dealt with the

question arose this simple uploading automatically means a transfer of personal data to third

countries.

166

 Kuner in: Data protection anno 2014: how to restore trust? Contributions in honour of Peter

Hustinx, European Data Protection Supervisor (2004–2014), Hielke Hijmans and Herke

Kranenborg (eds), Intersentia 2014, at 216.

167

 P.C.I.J., S.S. Lotus, P.C.I.J. Reports, Series A, No. 10 (1927).

168

 See Sect. 9.9 above.

169

 Joel R. Reidenberg a.o., Internet Jurisdiction, Survey of Legal Scholarship Published in English

and United States Case Law (Fordham Center on Law and Information Policy, 2013). This survey

gives an overview of case law, with a focus on the US. The angle is mainly private international

law.

165



Tài liệu bạn tìm kiếm đã sẵn sàng tải về

9 Jurisdictional Issues: Public International Law and the Internet

Tải bản đầy đủ ngay(0 tr)

×