pdpEcho is kicking off 2017 with a brief catalogue of interesting recently published research that sets the tone for the new year.
First, Wolfie Christl and Sarah Spiekermann‘s report on “Networks of Control”, published last month, is a must read for anyone that wants to understand how the digital economy functions on the streams of data we all generate, while reflecting on the ethical implications of this economic model and proposing new models that would try keep the surveillance society afar. Second, a new report of the Global Commission of Internet Governance explores global governance gaps created by existing global governance structures developed in the analog age. Third, the American Academy of Sciences recently published a report with concrete proposals on how to reconcile the use of different public and private sources of data for government statistics with privacy and confidentiality. Last, a volume by Angela Daly that was recently published by Hart Publishing explores how EU competition law, sector specific regulation, data protection and human rights law could tackle concentrations of power for the benefit of users.
- “Networks of control. A Report on Corporate Surveillance, Digital Tracking, Big Data & Privacy”, by Wolfie Christl, Sarah Spiekermann [OPEN ACCESS]
“Around the same time as Apple introduced its first smartphone and Facebook reached 30 million users in 2007, online advertisers started to use individual-level data to profile and target users individually (Deighton and Johnson 2013, p. 45). Less than ten years later, ubiquitous and real-time corporate surveillance has become a “convenient byproduct of ordinary daily transactions and interactions” (De Zwart et al 2014, p. 746). We have entered a surveillance society as David Lyon foresaw it already in the early 1990s; a society in which the practices of “social sorting”, the permanent monitoring and classification of the whole population through information technology and software algorithms, have silently become an everyday reality” (p. 118).
One of the realities we need to take into account when assessing this phenomenon is that “Opting out of digital tracking becomes increasingly difficult. Individuals can hardly avoid consenting to data collection without opting out of much of modern life. In addition, persons who don’t participate in data collection, who don’t have social networking accounts or too thin credit reports, could be judged as “suspicious” and “too risky” in advance” (p. 129).
The authors of the report explain that the title “Networks of Control” is justified “by the fact that there is not one single corporate entity that by itself controls today’s data flows. Many companies co-operate at a large scale to complete their profiles about us through various networks they have built up” (p. 7). They also explain that they want to close a gap created by the fact that “the full degree and scale of personal data collection, use and – in particular – abuse has not been scrutinized closely enough”, despite the fact that “media and special interest groups are aware of these developments for a while now” (p. 7).
What I found valuable in the approach of the study is that it also brings forward a topic that is rarely discussed when analysing Big Data, digital tracking and so on: the attempt of such practices to change behaviour at scale. “Data richness is increasingly used to correct us or incentivize us to correct ourselves. It is used to “nudge” us to act differently. As a result of this continued nudging, influencing and incentivation, our autonomy suffers (p. 7)”.
A chapter authored by Professor Sarah Spiekermann explores the ethical implications of the networks of control. She applies three ethical normative theories to personal data markets: “The Utilitarian calculus, which is the original philosophy underlying modern economics (Mill 1863/1987). The Kantian duty perspective, which has been a cornerstone for what we historically call “The Enlightenment” (Kant 1784/2009), and finally Virtue Ethics, an approach to life that originates in Aristotle’s thinking about human flourishing and has seen considerable revival over the past 30 years (MacIntyre 1984)” (p. 131).
Methodologically, the report is based on “a systematic literature review and analysis of hundreds of documents and builds on previous research by scholars in various disciplines such as computer science, information technology, data security, economics, marketing, law, media studies, sociology and surveillance studies” (p. 10).
2. Global Commission on Internet Governance “Corporate Accountability for a Free and Open Internet”, by Rebecca MacKinnon, Nathalie Maréchal and Priya Kumar [OPEN ACCESS]
The report shows that “as of July 2016, more than 3.4 billion people were estimated to have joined the global population of Internet users, a population with fastest one-year growth in India (a stunning 30 percent) followed by strong double digit growth in an assortment of countries across Africa (Internet Live Stats 2016a; 2016b)” (p. 1).
“Yet the world’s newest users have less freedom to speak their minds, gain access to information or organize around civil, political and religious interests than those who first logged on to the Internet five years ago” (p. 1).
Within this framework, the report explores the fact that “ICT sector companies have played a prominent role in Internet governance organizations, mechanisms and processes over the past two decades. Companies in other sectors also play an expanding role in global governance. Multinational companies wield more power than many governments over not only digital information flows but also the global flow of goods, services and labour: onethird of world trade is between corporations, and another third is intra-firm, between subsidiaries of the same multinational enterprise” (p. 5).
The authors also look at the tensions between governments and global companies with regard to requests for access to data, to weaken encryption and facilitate censorship in ways that contravene international human rights standards.
3. “Innovations in Federal Statistics: Combining Data Sources While Protecting Privacy”, by National Academy of Sciences [OPEN ACCESS].
The tension between privacy on one hand and statistical data and censuses on the other hand compelled the German Constitutional Court to create in the ’80s “the right to informational self-determination”. Could statistics bring a significant reform of such sort to the US? Never say never.
According to epic.org, the US National Academy of Sciences recently published a report that examines how disparate federal data sources can be used for policy research while protecting privacy.
The study shows that in the decentralised US statistical system, there are 13 agencies whose mission is primarily the creation and dissemination of statistics and more than 100 agencies who engage in statistical activities. There is a need for stronger coordination and collaboration to enable access to and evaluation of administrative and private-sector data sources for federal statistics. For this purpose, the report advices that “a new entity or an existing entity should be designated to facilitate secure access to data for statistical purposes to enhance the quality of federal statistics. Privacy protections would have to be fundamental to the mission of this entity“. Moreover, “the data for which it has responsibility would need to have legal protections for confidentiality and be protected using the strongest privacy protocols offered to personally identifiable information while permitting statistical use”.
One of the conclusions of the report is that “Federal statistical agencies should adopt modern database, cryptography, privacy-preserving and privacy-enhancing technologies”.
4. Private Power, Online Information Flows and EU Law. Mind The Gap, by Angela Daly, Hart Publishing [50 pounds]
Using a series of illustrative case studies, of Internet provision, search, mobile devices and app stores, and the cloud, the work demonstrates the gaps that currently exist in EU law and regulation. It is argued that these gaps exist due, in part, to current overarching trends guiding the regulation of economic power, namely neoliberalism, by which only the situation of market failure can invite ex ante rules, buoyed by the lobbying of regulators and legislators by those in possession of such economic power to achieve outcomes which favour their businesses.
Given this systemic, and extra-legal, nature of the reasons as to why the gaps exist, solutions from outside the system are proposed at the end of each case study. This study will appeal to EU competition lawyers and media lawyers.”
The problem with the Privacy Shield challenges: do the challengers have legal standing?
by Gabriela Zanfir Fortuna
There are currently two ongoing challenges of the Privacy Shield before the CJEU (one submitted by Digital Rights Ireland and one by a coalition of French NGOs). Before deciding on the merits of these cases, there is a risk that the Court may not consider them admissible based on legal standing rules. The Court is very strict when applying the rules under Article 263(4) TFEU, most of the actions for annulment initiated by natural or legal persons being declared inadmissible due to lack of legal standing.
European Commission’s adequacy decision for transfers of personal data between the EU and the US under the Privacy Shield framework was challenged directly before the Court of Justice of the EU – the Grand Chamber to be more precise, under the procedure for “actions for annulment” enshrined in Article 263 TFEU.
An “action for annulment” under Article 263 TFEU allows the CJEU to “review the legality of legislative acts, of acts of the Council, of the Commission and of the European Central Bank, other than recommendations and opinions, and of acts of the European Parliament and of the European Council intended to produce legal effects vis-à-vis third parties”.
Such actions can be brought by three categories of applicants.
The privileged applicants – any “Member State, the European Parliament, the Council or the Commission on grounds of lack of competence, infringement of an essential procedural requirement, infringement of the Treaties or of any rule of law relating to their application, or misuse of powers”, according to the second paragraph of Article 263.
A second category of challengers is defined in the third paragraph of Article 263: the Court of Auditors, the European Central Bank and the Committee of the Regions. They can bring actions for annulment before the Court only “for the purpose of protecting their prerogatives”.
Finally, a third category of challengers comprises “any natural or legal person”, according to the fourth paragraph of Article 263 TFEU. But for private parties to actually have legal standing for such actions, the conditions to be met are quite strict (this is why they are also known as “non-privileged applicants”). In fact, there are only three instances where such an action is declared admissible:
The third possibility was introduced by the Treaty of Lisbon, in 2009, and was meant to address the critique that individuals did not have a real possibility to challenge EU acts, due to the very strict application of the “direct and individual concern” test by the Court.
As it was explained by scholars, “particularly the requirement that the act be of individual concern proves in practice to be a hurdle that is virtually insurmountable” (1). According to the much criticised Plaumann test, the Court established that “persons other than those to whom a decision is addressed may only claim to be individually concerned if that decision affects them by reason of certain attributes which are peculiar to them or by reason of circumstances in which they are differentiated from all other persons and by virtue of these factors distinguishes them individually just as in the case of the person addressed” (Case 25/62 Plaumann v. Commission, 15 July 1963).
To understand how the Court applies the Plaumann test, a very good example is the Toepfer case (Case 106-107/63).
The Plaumann test survived decades of challenges, including a decision of the Court of First Instance (Case T-177/01 Jégo-Quéré, see particularly paragraph 51) that tried to reform it but that was quashed in appeal by the Court of Justice. The Court of First Instance argued that denying legal standing to the applicants in this case meant they would have no right to an effective remedy, due to their particular circumstance. The Court of Justice, in appeal, did not give merit to this argument.
Some nuances have been added to the Plaumann test for different areas of law, but the essence remained the same. For instance, the Court detailed additional conditions for private parties that could be individually concerned by provisions of regulations imposing anti-dumping duties (see Cases T-112/14 to T-116/14, T-119/14 Molinos Rio de la Palata from 15 September 2016, paras 43 to 45). These conditions, however, apply subsequently to the Plaumann test (see para 40 from the Molinos Rio de la Plata cases).
Therefore, it will be extremely difficult, if not impossible, for the NGOs that initiated the actions for annulment of the Commission’s adequacy decision to meet the Plaumann test. If they will manage to do it, this will come with a change of settled case-law.
However, there is another line of argumentation that the NGOs could use and that would have more chances of success. They could use the third limb of Article 263(4), the one introduced in 2009 by the Treaty of Lisbon that allows challenges by private parties of regulatory acts which are of direct concern to them and which do not entail implementing measures.
This way, the applicants will not have to prove they are individually concerned by the act, so the Plaumann test will not be applicable. However, they will enter a new, almost uncharted field: regulatory acts which do not entail implementing measures.
They will have to prove that:
According to case-law following the entry into force of the Lisbon Treaty and the changes that were brought to Article 263(4), “the meaning of ‘regulatory act’ for the purposes of the fourth paragraph of Article 263 TFEU must be understood as covering all acts of general application apart from legislative acts” (Case T‑18/10 Inuit Tapiriit Kanatami and Others v Parliament and Council, 6 September 2011, para 56; Case T-262/10 Microban 25 October 2011, para 21).
In Microban, the Court found that the Commission Decision at issue was adopted “in the exercise of implementing powers and not in the exercise of legislative powers” (para 22), which confirmed its nature of a “regulatory act”. Further, the Court also took into account that “the contested decision is of general application in that it applies to objectively determined situations and it produces legal effects with respect to categories of persons envisaged in general and in the abstract” (para 23).
As the adequacy decision was adopted by the Commission in the exercise of implementing powers (following Directive 95/46), and as it is of general application, producing legal effects to categories of persons envisaged in general and in the abstract, it will most probably be classified as a “regulatory act” for the purposes of Article 263(4) TFEU.
However, there are two more conditions to be met cumulatively before the actions are declared admissible.
2. Are the applicants directly concerned by the act?
The Court uses several criteria to establish there is a “direct concern”.
The classic test the Court usually uses is the following: “firstly, the contested Community measure must directly affect the legal situation of the individual and, secondly, it must leave no discretion to its addressees, who are entrusted with the task of implementing it, such implementation being purely automatic and resulting from Community rules without the application of other intermediate rules” (Case C‑386/96 P Dreyfus v Commission, para 43, Joined Cases C‑445/07 P and C‑455/07 P Commission v Ente per le Ville vesuviane and Ente per le Ville vesuviane v Commission, para 45; Microban, para 27).
For instance, in Microban this test was met because the contested decision prohibited the marketing of materials containing triclosan. The applicants bought triclosan and used it to manufacture a product, which was further sold on for use in the manufacture of plastic materials. Therefore, the Court considered “the contested decision directly affects their legal position” (para 28).
On another hand, in a very recent case, the Court found that “no provision of the contested act is directly applicable to the applicants, in the sense that it would confer rights or impose obligations on them. Consequently, the contested act does not affect their legal position, and therefore the condition of direct concern, as referred to in the second and third situation referred to in the fourth paragraph of Article 263 TFEU, is not met” (Case T-600/15 Pesticide Action Network Europe, 28 September 2016, para 62).
This case concerned an action brought by an environmental NGO and different associations of beekepeers that challenged an Implementing Regulation approving the use of a substance called sulfoxaflor as pesticide. The Court dismissed all the arguments brought forward by the applicants to prove they were directly concerned by this act: starting with a claim that it touched the right of property and the right to conduct business of the beekeepers – due to the harmful effect of sulfoxaflor on bees, to the claim that the applicants participated in the decision making process for the Implementing Regulation, to the claim that refusing their legal standing breached their right to environmental protection under Article 37 of the Charter and their right to effective judicial remedy under Article 47 of the Charter (see paras 46 to 50).
Thus, it will not be easy to argue that the adequacy decision is of direct concern to the applicants. For instance, it could be argued that the decision primarily impacts the legal situation of controllers (and not that of data subjects) who are allowed to transfer personal data pursuant to this decision.
However, it will neither be impossible to argue the direct concern of data subjects, represented by the applicant NGOs. A first argument, perhaps of a general nature, would be that the purpose of the Decision is to establish that companies adhering to the Privacy Shield ensure an adequate level of protection of personal data with the level of protection afforded in the EU, having the consequence that transfers of personal data to those companies will automatically take place, without any further safeguard and without any additional scrutiny or authorisation. Therefore, it affects the legal situation of individuals in the EU whose data are transferred, as they will not be able to oppose the transfer before it takes place.
An objective argument could be the recognition of the rights of the data subject in Annex II of the Decision (the Privacy Shield Principles) – admitting therefore that the Decision, through its Annex, grants rights to individuals represented by the applicants.
Another argument could also be the finding of the Court in Schrems that legislation allowing mass-surveillance and access to content of communications touches the essence of the fundamental right to private life as enshrined in Article 7 of the Charter (see Schrems C-362/14, paras 93 and 94). Therefore, a regulatory act that has as direct consequence transfers of personal data to a legal system that allows such a fundamental breach of Article 7 of the Charter as directly affecting the legal situation of data subjects represented by the applicant NGOs. But for the Court to take this argument into account would mean to acknowledge the existence of mass-surveillance and access to content of communications in the US, at the time when the decision was adopted.
3. Does the adequacy decision entail implementing measures?
This will be the most difficult criterion to be met. The case-law of the Court regarding what can constitute implementing measures is very strict (from the point of view of granting legal standing), in the sense that the Court applies the concept of “implementing measures” for the purposes of Article 263(4) TFEU lato sensu.
For instance, in a landmark judgment in this area, T & L Sugars (case C-456/13, 28 April 2015), concerning an implementing regulation, “the measures at the Member States’ level consisted of receiving applications from economic operators, checking their admissibility, submitting them to the Commission and then issuing licences on the basis of the allocation coefficients fixed by the Commission” (as summarised here). So, even if AG Cruz Villalón “concluded that such non-substantive, or ‘ancillary’, measures […] by the national authorities […] in the exercise of a circumscribed power” or a “purely administrative activity” are not implementing measures (Opinion in Case C-456/13 P, T & L Sugars, para. 31 and 34)” (2), the Court found that “the decisions of the national authorities granting such certificates, which apply the coefficients fixed by Implementing Regulation No 393/2011 to the operators concerned, and the decisions refusing such certificates in full or in part therefore constitute implementing measures” (para 40).
Article 5 of the Privacy Shield adequacy decision states that “Member States shall take all the measures necessary to comply with this Decision”. Therefore, it allows further administrative measures by the Member States. But what are those measures in practice? Could the Court consider they are ancillary enough so as not to amount to “implementing measures”?
On another hand, it is also clear that before the adequacy decision takes effect, a US company must go through an administrative procedure which could amount to a certification procedure similar to the one in the T&L Sugars case. But in this case, will it matter that the alleged “implementing measures” must be taken by a third country and not by a Member State?
In conclusion, the problem of legal standing of the applicants in the two cases challenging the Privacy Shield decision is not at all an easy one. The odds (based on existing case-law) seem to be leaning more towards an inadmissibility of the actions for annulment. But this is why a “legal precedent” system is exciting: the Court can always nuance and, if necessary, change its case-law depending on the particular elements of each case.
However, if these actions will be declared inadmissible, it does not mean that the NGOs concerned will not be able to challenge the Privacy Shield decision in national courts, bringing the case to the CJEU afterwards via the preliminary ruling procedure based on Article 267 TFEU. In fact, even an inadmissible decision will help their subsequent actions at national level, considering that their request to submit preliminary ruling questions to the CJEU will not be able to be dismissed by the national courts due to the fact that they did not challenge the decision directly following Article 263 TFEU (considering the possibility they could have had legal standing).
Whatever the outcome of these two challenges, the decision of the Court will be very important for the “legal standing of natural and legal persons” doctrine in general, on one hand, and for the application of Article 263(4) TFEU to the different acts of the future European Data Protection Board (see Recital 143 of the GDPR), on the other hand.
(1) Jan H. Jans, On Inuit and Judicial Protection in a Shared Legal Order, European Environmental Law Review, August 2012, p. 189.
(2) Jasper Krommendijk, The seal product cases: the ECJ’s silence on admissibility in Inuit Tapiriit Kanatami II, available here.
Find what you’re reading useful? Consider supporting pdpecho.
Support pdpecho here
Posted in Comments, GDPR
Tagged action against Privacy Shield, action for annulment, Article 263 TFEU, Article 263(4) TFEU, challenge of the Privacy Shield, data protection, Digital Rights Ireland, EU data protection, EU law, Europea Data Protection Board, jego-quere, legal standing, legal standing CJEU, locus standi, plaumann, privacy, privacy shield, regulatory act, schrems