构建国际数据隐私法

Int’lDataPrivacyLaw21

StructuringInternationalDataPrivacyLaw

ByPaulM.Schwartz*&Karl-NikolausPeifer**

Introduction

Duetothesignificanceofinternationalflowsofpersonalinformation,thestakesarehightodayfortheEuropeanUnionandtheUnitedStateswhenitcomestodataprivacylaw.Accordingtooneestimate,theU.S.-EUeconomicrelationshipinvolves$260billioninannualdigitalservicestrade.1Cross-borderinformationflowsrepresentthefastestgrowingcomponentofU.S.aswellasEUtrade.2Intoday’sinformationeconomy,moreover,muchofthisU.S.-EUtradeinvolvespersonaldata.Asonereporteronthetechbeatnoted,“Internationaldatatransfersarethelifebloodofthedigitaleconomy.”3

Thesharinganduseofpersonalinformationnowdrivemanydailyactivities,includingfinances,healthcare,shopping,telecommunications,andtransportation.LeadingU.S.technologycompaniesdependonaccesstoanduseofthepersonalinformationofEUcitizenstoprovidedata-drivenservicesonthecontinent.Cloudproviders,whichofferdecentralizedmobileaccesstocomputingpowerthroughouttheworld,similarlyaccessandusethepersonaldataofEUcitizens.Differencesintransatlanticregulationspotentiallyimperilthesecriticalinternationaldataflows.

TheresultingEU-U.S.disputehasbeentermedthe“transatlanticdatawar.”4Therootsofthis“war”arefoundinthedifferinglegalapproachestoinformationprivacyinthetwojurisdictions.TherehasalsobeenalongstandingdebateintheEUaboutwhetherU.S.lawprovidessufficientprotectionsforthepersonalinformationofEUcitizenswhenU.Scompaniesandpublicauthoritiescollectandprocessit.5ThispolicydebatehasbeenaccompaniedbytheEUsettingstrictlimits

*JeffersonE.PeyserProfessorofLawatUCBerkeleySchoolofLaw;Director,BerkeleyCenterforLaw&Technology.TheauthorswouldliketothanktheThyssenFoundationfortheirsupportofthisArticle.

**ProfessorofLaw,UniversityofCologne,Cologne,Germany;Director,InstituteforMediaLawandCommunicationsLaw.

1PennyPritzker&AndrusAnsip,MakingaDifferencetotheWorld’sDigitalEconomy,U.S.DEP’TOFCOM.(Mar.11,2016),https://

/news/blog/2016/03/making-difference-worlds-

digital-economy-transatlantic-partnership.

2CommissionStaffWorkingDocumentontheFreeFlowofDataandEmergingIssuesoftheEuropeanDataEconomy,SWD(2017)2final(Jan.10,2017).

3RobertLevine,BehindtheEuropeanPrivacyRulingThat’sConfoundingSiliconValley,N.Y.TIMES(Oct.9,2015),https://

/2015/10/11/business/international/behind-the-european-privacy-

ruling-thats-confounding-silicon-valley.html?_r=0.

4HenryFarrell&AbrahamNewman,TheTransatlanticDataWar,FOREIGNAFFAIRS(Feb.2016),https://

/articles/united-states/2015-12-14/transatlantic-data-war.

5PaulM.Schwartz,EuropeanDataProtectionLawandRestrictionsonInternationalDataFlows,80IOWAL.REV.471(1995).

PAGE

10

ontransfersofpersonaldatatoanynon-EUcountrythatlackssignificantprivacyprotections.

TherestrictionsaresetbytwoEUlegalmandates.TheEuropeanDirectiveonDataProtection(1995)permitsdatatransfersfromtheEUtoathirdpartynationonlywhenithas“adequate”privacyprotections.6OnMay25,2018,theGeneralDataProtectionRegulation(GDPR)(2016)willtaketheplaceoftheDirective.7UndertheGDPR,theadequacyrequirementfordatatransferscontinuestobethelegaltouchstone.TheEUhasneverconsideredU.S.dataprivacylawtohaveanadequatelevelofprotection.8

InresponsetotheEU’sjudgmentthattheprivacyprotectionsofU.S.lawwereinsufficient,theEUandU.S.developedasetoffirst-generationsolutionsfortransatlanticexchanges.DuetoEUdispleasurewiththesurveillanceoftheNationalSecurityAgency(NSA),however,theseinnovativemechanismsarenoweitherinvalidorimperiled.9Aninitialsecond-generationsolution,theEU-USPrivacyShield,wasfinalizedinJune2016.10TherearealreadylegalchallengestoitinprogressintheEU.11

Bridgingthetransatlanticdatadivideis,therefore,amatterofthegreatestsignificance.Onthehorizonisapossibleinternationalpolicysolutionaround“interoperable,”orsharedlegalconcepts.TheWhiteHouseandFederalTradeCommissionhavepromotedthisapproach.FortheWhiteHouse,thereisaneedfora“multistakeholderprocess”withtheinternationalpartnersoftheU.S.to“facilitateinteroperableprivacyregimes.”12Theseregimesaretobebasedonthestartingpointof“mutualrecognition,”whichentailsan“embraceofcommonvaluessurroundingprivacyandpersonaldataprotection.”13

6CouncilDirective95/46,art.25,1995O.J.(L281)31,45–46(EC)[hereinafterDPDirective].

7CommissionRegulation2016/679,2016O.J.(L119)1,60-62(EU)[hereinafterGDPR].

8See,e.g.,WorkingPartyontheProtectionofIndividualswithregardtotheProcessingofPersonalData,Opinion1/99,2DGMARKTDoc.5092/98,WP15(Jan.26,1999)(statingregardingU.S.privacylawthat“thecurrentpatchworkofnarrowly-focusedsectorallawsandvoluntaryself-regulationcannotbereliedupontoprovideadequateprotection”fordatatransferredfromEU).

9Thedecisivemovewasmadein2015bytheEuropeanCourtofJustice’sSchremsdecisions,whichinvalidatedtheSafeHarborAgreementbetweentheEUandU.S.CaseC-362/14,Schremsv.DataProt.Comm’r2015E.C.R.650(Oct.6,2015).

10CommissionImplementingDecisionof12.7.2016pursuanttoDirective95/46/ECoftheEuropeanParliamentandoftheCouncilontheadequacyoftheprotectionbytheEU-U.S.PrivacyShield,C(2016)4176final[hereinafterPrivacyShield,ImplementingDecision],

http://ec.europa.eu/justice/data-protection/files/privacy-shield-adequacy-decision_en.pdf.

11PeterSayer,ASecondPrivacyShieldLegalChallengeIncreasesThreattoEU-USDataFlows,PCWORLD(Nov.3,2016),

/article/3138196/cloud-computing/a-second-privacy-

shield-legal-challenge-increases-threat-to-eu-us-data-flows.html.

12WHITEHOUSE,CONSUMERDATAPRIVACYINANETWORKEDWORLD31-32(Feb.2012),

https://

/sites/default/files/privacy-final.pdf

[hereinafterCONSUMERDATAPRIVACY].

13Id.at31.Insimilartones,theFTChasnoted,“Effortsunderwayaroundtheworld…indicateaninterestinconvergenceonoverarchingprinciplesandadesiretodevelopgreaterinteroperability.”FTC,PROTECTINGCONSUMERPRIVACYINANERAOFRAPIDCHANGE10(Mar.2012),

https://

/sites/default/files/documents/reports/federal-trade-commission-report-

protecting-consumer-privacy-era-rapid-change-recommendations/120326privacyreport.pdf.

TheextentofEU-U.S.dataprivacyinteroperability,however,remainstobeseen.Inexploringthisissue,thisArticleanalyzestherespectivelegalidentitiesconstructedarounddataprivacyintheEUandU.S.Itidentifiesprofounddifferencesinthetwosystem’simageoftheindividualasbeareroflegalinterests.TheEUhascreatedaprivacyculturearound“rightstalks”thatservestoprotect“datasubjects.”14IntheU.S.incontrast,thefocusison“marketplacediscourse”aboutpersonalinformationandthesafeguardingof“privacyconsumers.”15IntheEU,moreover,“rightstalk”formsacriticalpartofthepost-warEuropeanprojectofcreatingtheidentityofaEuropeancitizen.AsJürgenHabermasargues,thistaskisaconstitutionalonethatiscentraltotheEU’ssurvival.16IntheU.S.,incontrast,dataprivacylawisbasedontheideaofconsumerswhoseinterestsmeritgovernmentalprotectioninamarketplacemarkedbydeceptionandunfairness.

ThisArticleusesitsmodelsof“rightstalk”and“marketplacediscourse”toanalyzehowtheEUandtheU.S.protecttheirrespectivedatasubjectsandprivacyconsumers.Aparticularfocusisontherespectivedoctrinesofconsentandcontractinthetwolegalsystems,whichreflectprofoundlydifferentperspectives.Evenifthedifferencesaregreat,thereisstillapathforward.Anewsetofinstitutionsandprocessescanplayacentralroleindevelopingmutuallyacceptablestandardsofdataprivacy.ThisArticlearguesthatthefutureofinternationaldataprivacyrestsnotinunilateralism,whetherfromtheEUorU.S.,butinthesemyriadnewvenuesforcollaboration.BoththeGDPRandPrivacyShieldrequireregularinteractionsbetweentheEUandU.S.tocreatepointsforharmonization,coordination,andcooperation.Thefutureoftransatlanticdatatradeturnsondevelopingsharedunderstandingsofprivacywithinthesenewstructures.

DifferentVisionsofDataPrivacy

ThisPartconsidershowthetwosystemsofdataprivacylaw,EUandU.S.,envisiontheindividual.Fromtheperspectiveofananthropologist,lawis“aspeciesofsocialimagination.”17AsCliffordGeertzobserves,“legalthoughtisconstructiveofsocialrealities”andnotmerely“reflectiveofthem.”18Inhis1921Storrslecture,BenjaminCardozosimilarlyobserved,“Thereisineachofusastreamoftendency,whetheryouchoosetocallitphilosophy,ornot,whichgivescoherenceanddirectiontothoughtandaction.”19Thissharedculturalbackgroundformsakeypartofjuridicaldecision-making.Henotes,“Inthismentalbackgroundeveryproblemfindsitssetting.”20

14SeeinfraSectionII.B.

15SeeinfraSectionII.C.

16JÜRGENHABERMAS,ZURVERFASSUNGEUROPAS66(2011).

17CLIFFORDGEERTZ,LOCALKNOWLEDGE:FURTHERESSAYSININTERPRETIVEANTHROPOLOGY

232(1983).

18Id.

19BENJAMINN.CARDOZO,THENATUREOFTHEJUDICIALPROCESS12(1921).

20Id.at13.

ThisPartexamineshowtwolegalordersconstructcontrasting“legalidentities”forindividualsasbearerofdataprivacyinterests.21Tosketchouroverallargumentregardingthe“mentalbackground”oftheseareasoflaw,wefindthattheEUsystemprotectstheindividualbygrantingherfundamentalrightspertainingtodataprotection.Thislanguageofrightscreatesaconnectionbetween“datasubjects”andtheEUinstitutionsthatsafeguardtheseinterests.IntheU.S.,incontrast,thelawprotectstheindividualasa“privacyconsumer.”Theviewisofapersonasaparticipantinmarketrelations.Inthismarket-drivendiscourse,theindividualisatraderofacommodity,namely,herpersonaldata.Asaconsequenceofthesetwoversionsoflegalidentity,thestatusoftheindividualwithintherespectivelegalsystemsisdifferent.Toillustratethispoint,thisArticlecomparestheEU’sdatasubjectandtheU.S.’sprivacyconsumeracrossthreedimensions:(1)herconstitutionalprotections;(2)herstatutoryprotections;and(3)andherrelativelegalstatuscomparedtotheentitiesthatcollectandprocessherpersonaldata.PartII.AandPartII.BinfraexaminetherespectivevisionsintheEUandU.S.fortheindividualasrights-bearer.

Beforewebegin,somebriefpointsaboutterminologyandscopewouldbehelpful.ThisArticleadoptstherespectiveterminologyofeachlegalsysteminidentifyingtheirsimilarzonesofactivity.Hence,whenweaddressEUprivacylaw,wespeakof“dataprotection”andrefertothesimilarareaofU.S.lawas“informationprivacylaw.”22Whenwedesireaneutralterm,thisArticlerefersto“dataprivacylaw.”23Wenowturntothedifferentmodelsoftheindividualasrights-bearerinthetwosystems.

“RightsTalk”intheEU

ThisArticleusestheterm“datasubject”torefertotherights-bearerintheEU’sdataprotectionlaw.AfeatureoftheEUisits“multi-linguism.”Allitsofficialdocumentsaretranslatedintothetwenty-fourlanguagesoftheMemberStates,andallversionsareofequallegitimacy.24InEnglishEuro-speak,EUdataprotectionlawuniformlycallstheindividualwhosedataareprocessedthe“datasubject,”andwethereforeadoptthisterm.25Linguisticsalsoteachesusthatthesubjectisthemostprominentactiveagentofasentence.Inasimilarfashion,theEUprivilegestheprominenceoftheindividualwhosepersonalinformationisprocessed.Itengagesinarights-focusedlegaldiscoursecenteredonthedatasubjects.

21Onthequestionofhowlawconstructsa“legalidentity,”seeJamesQ.Whitman,ConsumerismVersusProducerism,117YALEL.J.340,394(2007)

22Asexamplesofthisterminology,seeDANIELSOLOVE&PAULSCHWARTZ,INFORMATIONPRIVACYLAW(5thed.2015).Foracontinentalexample,seeAXELVONDEMBUSSCHE&MARKUSSTAMM,DATAPROTECTIONINGERMANY(2013).

23ForanearlyadoptionofthisterminareportcommissionedbytheEuropeanfortheCommissionoftheEuropeanCommunities,seePAULM.SCHWARTZ&JOELR.REIDENBERG,DATAPRIVACYLAW(1996).

24Foradiscussionofmulti-lingualismindataprotectionlaw,seeGLORIAGONZÁLEZFUSTER,THEEMERGENCEOFPERSONALDATAPROTECTIONASAFUNDAMENTALRIGHTOFTHEEU9(2014).

25See,e.g.,DPDirective,supranote6,at33;GDPR,supranote7,at2.

ConstitutionalProtectionsand“RightsTalk.”IntheEU,dataprotectionisafundamentalrightanchoredininterestsofdignity,personality,andself-determination.ThepathtocreationofthisrightbeganbeforeWorldWarII,asdifferentnationallegalsystemsrecognizedrightsofdignityandpersonalitywithintheirconstitutionallaw.Thepost-warconstitutionsofItaly(1947)andGermany(1949)wereinthefrontranksofthisdevelopment.26FromtheirdevastatingexperiencewithfascismandNazism,thesecountriesdrewthelessonofsafeguardinghumandignity.AtthetransnationallevelafterWorldWarIIandasanessentialpartofthecreationofapost-waridentity,Europeansalsodevelopedasupranationalsystemoffundamentalrights.TheseinterestsarenowprotectedbyinstitutionsbothwithintheEuropeanUnion,suchastheEuropeanCourtofJustice,andoutsideofit,suchastheEuropeanCourtofHumanRights.

Thetrendofsupra-nationalrightsinthepost-warEuropeanorderextendsthealreadysignificantroleof“constitutionalpolitics”withinEuropeannations.InthedescriptionofAlecStoneSweet,thisprocessinvolvedtheenactmentofextensivepostwarconstitutionalrightsinEuropeaswellasasubsequentprivilegingofthejudicialroleinthepolicy-makingenvironment.27TheEuropeanConventionofHumanRightsandtheCharterofFundamentalRightsfunctionasthetwopillarsoffundamentalrightsinEurope.AsFredericoFabbrinisummarizes,thereisa“pluralityofconstitutionalsourcesenshriningconstitutionalrights”anda“pluralityofconstitutionalviewsonhumanrights.”28Thereisalsoapluralityofjudicialbodies,nationalandtransnational,involvedininterpreting,enhancingandextendedthesedifferentsources.Overtime,theEuropeanrightsregimecametoincludenotonlyprivacy,butanexplicitrighttodataprotection.BothinterestsnowhavethestatusofafundamentalrightinEurope.

TheEuropeanConventionofHumanRights(1950)isaninternationaltreatydraftedbytheCouncilofEurope.InArticle8,itgrantstheindividuala“righttorespectforhisprivateandfamilylife.”29TheConventionestablishedtheEuropeanCourtofHumanRights,whichhasbuiltonArticle8toidentifyspecificrightsregardingdataprotection.

WithintheEU,thekeyconstitutionaldocumentistheCharterofFundamentalRights(2000).WiththesigningoftheLisbontreatybyEUMemberStates,theCharterbecamebindingconstitutionallawfortheEUin2009.30ItmakesexplicittheprotectionsofCommunitylawforhumanrightsandbuildsontherequirement,asexpressedbytheEuropeanCourtofJusticeasearlyas1969,that,“respectforhumanrights...isaconditionofthelawfulnessofCommunityacts.”31TheCharterprotectsprivacy,liketheConvention,andalsocontainsanexplicitright

26 GRUNDGESETZ [GG] [Basic Law], Art. 1–2, translation at https://www.gesetze-im-internet.de/englisch_gg/;Art.2–3Constituzione[Const.](It.).

27ALECSTONESWEET,GOVERNINGWITHJUDGES3(2000).

28FEDERICOFABBRINI,FUNDAMENTALRIGHTSINEUROPE26(2014).

29THEEUROPEANCONVENTIONONHUMANRIGHTSart.8(1950).

30JEAN-CLAUDEPIRIS,THELISBONTREATY146(2010).

31Id.

todataprotection.32Article8(1)provides:“Everyonehastherighttotheprotectionofpersonaldata.”33TheEuropeanCourtofJusticereachesdecisionsundertheCharter,theTreaty,andtheHumanRightsConvention;theEuropeanCourtofHumanRightsdecidescasesfallingundertheHumanRightsConvention.InFabbrini’sassessment,thisoverlapofjudicialinstitutionsandgovernancelayersforprotectinghumanrightscreates“anincentiveforexpansionofthenormsandinstitutionsfortheprotectionoffundamentalrights.”34

ThesetransnationaldevelopmentshavebeenaccompaniedbyrecognitionofaconstitutionalrighttodataprotectioninseveralEUMemberStates.TheseincludeGermany’spath-breaking“righttoinformationalself-determination”of1983andits“rightoftrustandintegrityininformationsystems”of2008.35OtherEUstateswithconstitutionalprotectionsfordataprotection,whetherexplicitlyintheirnationalconstitutionorthroughjudicialinterpretation,includetheCzechRepublic,Greece,Hungary,Lithuania,Poland,theSlovakRepublic,andSpain.36HereisfurtherevidenceofFabbrini’s“pluralityofconstitutionalsourcesenshriningconstitutionalrights.”37

AsiscommoninEuropeforconstitutionalrights,moreover,theEU’srightstoprivacyanddataprotectiondonotmerelyconstrainthegovernment.Whiletheseinterestsrequirepositivegovernmentactiontoprotectindividuals,theyalsoreachprivateparties.IntheterminologyofEuropeanlaw,theserightshave“horizontal”effects,thatis,theseinterestsreachwithin“private-on-private”relationsascontrastedwithmerely“vertical”applicationsthatconcern“government-on-private”matters.38U.S.constitutionalrightsaregenerallylimitedtoonlythelatter;inAmericanterminology,thethresholdrequirementisfor“stateaction.”

TheresultingEuropeandataprotectionsystemcentersitselfaroundthedatasubjectasabearerofrights.Itdoessotorespondtothedangersoftheprocessing

32CharterofFundamentalRightsoftheEuropeanUnion,18Dec.2000,art.8(1),2000O.J(C364)

10[hereinafterCharter].

33Id.ArighttodataprotectionisalsoprotectedbyArticle16oftheTreatyontheFunctioningoftheEU(2008).TreatyontheFunctioningoftheEuropeanUnion,9May2008,art.16,2008O.J(C115)49[hereinafterFunctioningTreaty].

34FABBRINI,supranote28,at13–14.Thereissomedebateabouttherelationshipoftherighttoprivacy,asfoundinArticle7oftheCharterandArticle8oftheConvention,withtheexplicitrightofdataprotectionofArticle8oftheCharter.TheEuropeanCourtofJusticehascombinedbothconceptsattimesinfindingthatEUlawprotectsa“righttorespectforprivatelifewithregardtotheprocessingofpersonaldata.”CasesC-92/09ScheckeandC-93/09Eifertv.LandHessen2010E.C.R.662(Nov.9,2010)(establishingthiscriticalcombination).Throughthislanguage,theLuxembourgCourtformallyconstitutionalizesdataprotectionwhilealsofailingtoconceptualizetherelationshipbetweentheCharter’sprotectionsforprivacyanddataprotection.

35Bundesverfassungsgericht[BVerfG][FederalConstitutionalCourt],DecisionofDec.15,1983,1BvR209/83,1BvR484/83,1BvR440/83,1BvR420/83,1BvR362/83,1BvR269/83

(Volkszählungsurteil)(CensusCase);Bundesverfassungsgericht[BVerfG][FederalConstitutionalCourt],DecisionofFeb.27,2008,1BvR370/07,1BvR595/07,translationat:

http://www.bundesverfassungsgericht.de/SharedDocs/Entscheidungen/EN/2008/02/rs20080227_

1bvr037007en.html.

36FUSTER,supranote24,at66–70.

37FABBRINI,supranote28,at26.

38CaseC-144/04,Mangoldv.Helm2005Eur.Ct.H.R.709(Nov.22,2005).

ofpersonaldata.AstheFrenchnationaldataprotectionlawof1978warns,“informatics”posesadangerto“humanidentity,humanrights,privacy,[and]individualorpublicliberties.”39Anotherearlycontinentaldataprotectionstatute,theGermanFederalDataProtectionLawof1977,beganinafarlessdramaticfashion.Itdrylynotedtherisksthatdataprocessingraisestothe“legitimateinterestsoftheaffectedparty.”40Theacademicliteratureofthatdaymakesclear,however,thattheBundestag,inenactingthisstatute,wasactinginresponsetothethreatthatpersonaldataprocessingraisesto“personalintegrity.”41InthewordsoftheGermanFederalConstitutionalCourtinitscelebratedCensuscase,dataprocessingthreatensthedecisionalauthorityoftheindividualaswellastheexistenceof“afreedemocraticcommunitybasedonitscitizens’capacitytoactandparticipate.”42

Insum,Europeandataprotectionlawisstronglyanchoredattheconstitutionallevel.Itsgoalistoprotectindividualsfromriskstopersonhoodcausedbytheprocessingofpersonaldata,anditsfavoredmodeofdiscourseis“rightstalk.”Whenitdiscussesprivacy,itusesthelanguageofhumanrightstodevelopprotectionsforitsdatasubjects.

StatutoryProtections.Aspartoftheobligationtoprotectthedatasubject,EUconstitutionallawmandatestheenactmentofstatutorylawsthatregulatedatause.Thebasicrule:allpersonaldataprocessingrequiresalegalbasis.43Article8(2)oftheEUCharterrequiresthatdatabeprocessedonlybasedona“legitimatebasislaiddownbylaw.”44Aprocessingofpersonaldatawithoutanadequatejustificationinlawisitselfaviolationoflegalrights.

Moreover,thefundamentalrightsoftheindividualmustbeprotectedevenintheabsenceofsensitivedataorharmtotheindividual.InitsdecisioninSchrems,theEuropeanCourtofJusticestated:“Toestablishtheexistenceofaninterferencewiththefundamentalrighttorespectforprivatelife,itdoesnotmatterwhethertheinformationinquestion...issensitiveorwhetherthepersonsconcernedhavesufferedanyadverseconsequencesonaccountofthatinterferences.”45ThesamepointwasmadeinGoogleSpain,wheretheEuropeanCourtofJusticeobservedthat

39 French Data Protection Law, art. 1, translation at

https://

il.fr/sites/default/files/typo/document/Act78-17VA.pdf.

40GesetzzumSchutzvorMißbrauchpersonenbezogenerDatenbeiderDatenverarbeitung(Bundesdatenschutzgesetz),Jan.27,1977,BGBl.Iat201,lastamendedbyGesetz,Feb.25,2015,BGBl.Iat162.

41SpirosSimitis,EinleitunginKOMMENTARZUMBUNDESDATENSCHUTZGESETZ63(SpirosSimitisetal.eds.,2ded.1979).

42Bundesverfassungsgericht[BVerfG][FederalConstitutionalCourt],DecisionofDec.15,1983,1BvR209/83,1BvR484/83,1BvR440/83,1BvR420/83,1BvR362/83,1BvR269/83

(Volkszählungsurteil)(Censuscase).

43NIKOHÄRTING,DATENSCHUTZ-GRUNDVERORDNUNG80(2016).

442012O.J.(C326)art.8.InitsdecisioninSchrems,theEuropeanCourtofJusticefoundthatanyEUlegislationinvolving“interferencewiththefundamentalrights”ofprivacymust“laydownclearandpreciserulesgoverningthescopeandapplicationofameasureandimposingminimumsafeguards,sothatthepersonswhosepersonaldataisconcernedhavesufficientguaranteesenablingtheirdatatobeeffectivelyprotectedagainsttheriskofabuseandagainstanyunlawfulaccessanduseofthatdata.”CaseC-362/14,Schremsv.DataProt.Comm’r2015E.C.R.650,¶91(Oct.6,2015).

45Schrems,supranote9,at¶87.

thedatasubject’sfundamentalinterestsdonotturnonwhether“theinclusionoftheinformationinquestion...causesprejudicetothedatasubject.”46Rather,aprocessingofpersonaldataposesaninherentthreattotherightsofthedatasubjectand,duetothisrisk,mayonlybecarriedoutifthelawpermitsitandshapeshowtheinformationwillbeused.

Aspartofthisapproach,EUlawproceedsbyfirstenacting“omnibuslaws.”47Suchlawsseektocoverallpersonaldataprocessing,whetherinthepublicorprivatesector,andregardlessoftheareaoftheeconomy.Theselawsarethenbolsteredbysectorallawsthatsingleoutspecifickindsofdataprocessingandincreasethespecificityofregulatorynorms.48

ThekeyregulatorynormsarecenteredaroundtheenactmentofFairInformationPractices(FIPs).TheseprinciplesarefoundintheEUattheconstitutionallevelaswellasinstatutorylaw.AsexpressedintheCharter’sArticle8,thesystemofFIPshassixkeyelements:(1)arequirementoffairprocessing;(2)arequirementofprocessingforspecifiedpurposes;(3)arequirementofconsentorotherlegitimatebasisforprocessing;(4)arightofaccesstodata;(5)arighttohavedatarectified;and(6)arequirementofindependentdataprotectionauthoritiescheckingcompliancewiththeserules.49

EuropeanLawalsosuppliesadefinitepathtolegalprotectionfollowingharmstothedatasubject.Thereisnoneedforharmtoamonetaryorpropertyinterestwhenpersonalinformationismisused.50Boththedatasubjectandadataprotectionauthoritycanrequestaninjunctiontostopapracticethatharmsaprivacyinterestandreceivedamagesbasedonanon-materialinjuryincasesofaseriousinvasionofone’sprotectedsphereofprivacy.51Continuingthisapproach,theGDPRexplicitlyallowsforcompensationforboth“materialornon-materialdamage”followingafailuretofulfillitsrequirements.52

DataSubjectversusDataProcessor.LikeotherrightsintheEUsystem,dataprotectionisnotboundless.Nonetheless,datasubjectsaregrantedaprivilegedpositionbyEUlaw,includinginitsfoundationaldocuments.Article52(1)oftheEuropeanCharterpermitslimitationof“rightsandfreedoms,”butrequiresthatsuchrestrictions“beprovidedforbylawandrespecttheessenceofthoserightsandfreedom.”53InthefirstpartofArticle52(1),moreover,theCharterrequiresalegalbasis,suchasastatutoryprovision,forlimitingaright.ThesecondpartofArticle52(1)thencreatesaguaranteeofprotectionfor“theessence,”orcore,ofrightsandfreedoms.54Thislanguagemeansthatthecorepartofeachrightmust

46CaseC-131/12,GoogleSpainv.AEDP2014E.C.R.317,¶91(May13,2014)[hereinafterGoogleSpain].

47Foradiscussion,seeSOLOVE&SCHWARTZ,Casebook,supranote23,at1096.

48Id.

49PaulM.Schwartz,TheEU-U.S.PrivacyCollision,126HARV.L.REV.1966,1976-77(2013).

50JANPHILIPPALBRECHT&FLORIANJOTZO,DASNEUEDATENSCHUTZRECHTDEREU126–29(2017).

51BGHZ128,1,15-CarolinevonMonaco(1995).

52GDPR,supranote7,atart.82(1).

53Charter,supranote32atart.52(1).

54Id.

befreefromalterationorintrusion,whetherthroughlegislationorothermeans.Inturn