Now the immediate dust has settled on last weeks’ judgments of the CJEU in Bara and in Weltimmo it is perhaps briefly revisiting both to note some of the real issues and questions which arise. Answers are harder to come by, but the theme is of a rigid approach by the Court to Directive 95/46/EC which squeezes data controllers until the regulatory pips squeak. The impact of both judgments, not to mention the forthcoming Schrems, could be really significant and, frankly, counter-productive in terms of encouraging the free movement of goods and services. Free movement of data is not a Treaty right, and there are obvious needs to place limits and protections on personal data, but whether the CJEU is adopting an approach which gives businesses sufficient room for practical manoeuvre is another matter.
Some thoughts then on a re-reading of both judgments:
- Although the context was transfers between public authorities, the principle is not so limited. Any transfer of data to a third party which does not already have express consent will be at risk of unfair processing.
- Just because the two parties to the transfer agree it, and may be obliged to do it (contractually, say), that does not mean the data subject has approved it. Because both making and taking the transfer are acts of processing both data controllers need to have notified the data subject. That is onerous and easy to overlook.
- Not only does the data subject need to have agreed the transfer, they need to know why the transfer is happening (i.e. the purpose). This is much more information being provided to the data subject than one usually sees.
- None of this is any different from the principle adopted in Optical Express; if someone fills in a travel survey with Thomas Cook and aren’t told that their data will be sold to another company who will send them laser eye surgery texts, how can they make an informed choice about what they want to object to? This is essentially the point Bara makes.
- But does anyone actually send DP notices to data subjects? Not, one suspects, very many. Certainly not as many as should do so.
- That also plays into compliance with the third and fourth data protection principles. If your data isn’t up to date, you cannot properly notify the data subjects (DPP4). If you have harvested and kept excessive amounts of data, you have to spend an unnecessary amount of time and money on notifications (DPP3).
- Weltimmo has a more obvious immediate impact. You don’t get to situate yourself in one (doubtless the most regulatorily convenient) jurisdiction and ignore the regulators in all other Member States if you are targeting your online business to those other States. They can all come after you, and even if they can’t, they can get your home regulator to do so.
- This is a major move away from a one-stop shop system of DP regulation, whilst implying a pan-European consistency that isn’t really there on the ground. The variations in the application of Google Spain is a good example of just how far apart the national regulators can be.
- On any interpretation of the judgment, the outcome is not one which multi-national companies will have expected or wanted. Major online businesses face the prospect of being subject in every detail to regulators of every Member State. Nor can they ignore judgments in cases against them in more tangential parts of the business empire because under the Brussels I regime a civil judgment in one Member State is enforceable in any other.
- How one gets around Weltimmo is going to be tricky to work out. Will it be enough to have a website in English targeting English customers, but not to have any physical presence in England? What about no employees but an English bank account? Essentially, are the factors listed by the CJEU cumulative or distinct (given the need for only a “minimal” activity)?
- Private international lawyers will struggle to classify Article 4 slightly. Is it a jurisdiction issue or a choice of law issue? The CJEU states a conclusion in terms of an applicable law, whilst considering factors which are classically jurisdictional. In reality, it is probably both. The question of where an establishment is to be located is a jurisdictional one, although which law applies to that issue is probably an odd combination of the lex fori and sui generis European concepts as set out in Weltimmo. But once establishment has been, well, established, then that determines the choice of law: it is the law of the place of the establishment. It is just that there may be more than one establishment (i.e. at least Slovakia and Hungary) and therefore more than one applicable law. This is not very doctrinally coherent, particularly when one moves to trying to work out the jurisdictional competence of a court, and then the applicable law, of a private claim for breach of the implementing legislation. How are they meant to match up? Indeed, are they? Is Article 4 entirely divorced from Brussels I? (It might be for the actions of regulators, which would be engaging in administrative activities and outside the scope of Brussels I, but Article 4 applies to actions taken by the data subject too. Is it meant to be a self-contained code? Unclear.)
The fact that answers do not readily appear to all of these issues may itself be a troubling indicator of a lack of wider and/or deeper thought by the CJEU as to how its judgments will actually work in practice. Doubtless some will be worked through in time. But much of this is far too important to real people doing real things to be left to iron itself out over the next five years. Still waters may run deep, but it is the murky ones you drown in.
Christopher Knight