Privacy & dataprotection Knowledge questions

Oral exam

1. Why did new concepts of privacy emerge in the 1960s and 70s?

• 1960s–1970s: computers and information society (large-scale collection, storage and use of personal data)

• Benefits (efficiency, productivity, quality of life) + new risks to individuals’ private lives

• Traditional privacy law insufficient (right to respect for private life)

• UDHR 1948 and ECHR 1950 predated modern technology

• No specific rules on personal-data processing

• Emergence of informational privacy (informational self-determination)

• Specialised data-protection legislation

• Data protection became a separate EU fundamental right

2. When did data protection law emerge?

• Emerged in the 1970s

• Response to computerisation and large-scale data processing

• Traditional privacy rules did not regulate data processing specifically

• Based on informational privacy / self-determination

• First national level in Europe around 1970 (for Public authorities and large companies)

• Later: transitioned to international/European instruments in 1981 (Council of Europe Convention 108), and was integrated into EU law via the 1995 Data Protection Directive

• Data protection developed into a distinct fundamental right

3. Explain two similarities and two differences between the right to respect for private life and the right to the protection of personal data

Similarities

1. Protect autonomy and dignity by providing a personal sphere in which they can develop their personality, think freely and form opinions.

2. they therefore enable other freedoms (expression/religion)

Differences

1. Scope

• Private life: only triggered when private life/interests are affected

• Data protection: triggered by any processing of personal data (no privacy impact required)

• Example: recording employees’ names and salaries = data processing, but not necessarily an interference with private life. Disclosure to third parties may trigger private life

2. Formulation

• Private life: classic negative right

• Main focus: prohibition of unjustified interferenc (a legitimate public interests may justify interference)

• Data protection: modern, active right

• Safeguards for every processing operation

Overlap / example

• Digital Rights Ireland —> One measure can interfere with both rights

4. What is the legal framework with regard to privacy and data protection at the level of the United Nations?

• Privacy recognised as a fundamental human right, but no separate right to personal-data protection

• UDHR, Article 12, 1948

• Protection against arbitrary interference with privacy, family, home, correspondence, honour and reputation

• UDHR: not legally binding

• Strong influence on later human-rights law

• The International Covenant on Civil and Political Rights (ICCPR), entered into force 1976

• Legally binding on States Parties

• Protection against arbitrary or unlawful interference with privacy, home, correspondence, honour and reputation

5. What are the main developments with regard to privacy and data protection at the level of the United Nations after 2010?

• Snowden revelations / mass surveillance

• UN resolutions: 2013 and 2014 àPrivacy in a digital age

• Non-binding, but politically important

• Condemnation of mass surveillance

• Appointment of independent expert (special rapporteur) on the right to privacy (monitors national practices and new technologies)

• Later resolutions 2016 and 2017

• Focus expanded: not just state surveillance, also processing of private companies!

• Transparency about collection, use, sharing and retention

6. Can only natural persons of European origin lodge a complaint before the European court on human rights?

• Not limited to natural persons of European origin

• Nationality and citizenship not decisive

• No need to be a national of an ECHR Contracting Party

• Key requirement: violation within a Contracting State’s jurisdiction

• Applicants:

  • Individuals

  • Groups of individuals

  • NGOs

  • Legal persons: companies and associations

• Inter-state applications possible: states may bring cases against other Council of Europe member states

7. There is no right to personal data protection in the ECHR. Does this mean that the ECtHR is not competent?

• No explicit, separate right to data protection in ECHR

• ECtHR is nevertheless competent

• Data protection falls under Article 8 ECHR

• Article 8: private life, family life, home, correspondence

• Broad interpretation of “private life”

• Cases: interception, surveillance, storage of personal data

• Data processing can interfere with Article 8

• Article 8 is not absolute

• Article 8(2) test:

  • Lawfulness

  • Legitimate aim

  • Necessary in a democratic society

• Balancing: privacy versus national security, expression, access to information

• Negative obligations: no unjustified state interference

• Positive obligations: active protection of private life

8. Why and when did Convention 108 see the light? And what are the major innovations?

• Information technology growth: 1960s, new privacy risks (data processing)

• Article 8 ECHR insufficiently detailed

• Opened for signature: 1981 after CoE resolutions in the 1970s

• First legally binding international data-protection treaty

• Applies to public and private bodies

• Includes courts and law-enforcement authorities

Main innovations

• Fair and lawful processing

• Specific and legitimate purpose

• Storage limitation

• Data security

• Special protection for sensitive data

• Right of access: know whether data are stored

• Right to rectification

9. Did the original convention 108 prohibit international data flows?

• Original Convention 108: no prohibition

• Balance: data protection and free flow of data

• Free transfers between Contracting Parties

• Parties could exchange personal data

• Limits for non-Contracting States

• Equivalent / adequate level of protection required

• Aim: prevent transfers to countries with insufficient protection

10. Explain the relation between convention 108 and the European court on human rights. Is the latter formally tasked with judicial supervision of the convention 108?

• Connection through Article 8 ECHR

• Personal-data protection = part of private life

• Convention 108 binding on ratifying states

• ECtHR has no formal judicial supervision of Convention 108

• Court cannot directly rule on a violation of Convention 108 itself

• ECtHR formally supervises the ECHR

• Convention 108 guides interpretation of Article 8

• Relevant for collection, use, storage and transfer of personal data

• Convention 108 principles help assess Article 8 interference

11.

a. Explain the role of the committee of ministers with regard to convention 108

b. How many countries are part of convention 108 and CoE108+?

c. Is the EU member of convention 108? Explain

• it adopted 1970s privacy resolutions referring to Article 8 ECHR before the covention

• and non-binding recommendations after Convention 108 was adopted

• Those further explained/developed the Convention’s principles

• Influenced EU data protection law

• Convention 108: 51 (book) 55 parties (online) and al 47 CoE member states

• Open to non-CoE states

• International data-protection standard

• 108+: 38 ratifications required

• Netherlands: no 108+ ratification

• EU is not a party

• 1999 accession proposal

• Amendments never entered into force

• Member States are parties, not the EU itself

• Member States are bound by the Convention, not the EU itself

12. What was the main idea behind the modernization of convention 108 and how did this operation relate to the reform of data protection at the EU level?

• Digital-age data protection —> main goals 2011 beter online privacy protection + stronger system monitoring whether states follow the convention.

• Convention 108+ protocol

• More rights and duties, (right to know the reason behind the processing + supervisory authorities must have effective powers and real independence)

• Alignment with EU reform (CoE and EU regulators worked together)

13. Explain the relationship of the EU historically with human rights (including the principle of conferral) and situate the need for a charter in this context.

• Originally economic integration (European Communities)

• So no human rights

• Principle of conferral (EU may act only within the powers that Member States have given to it in the EU treaties)

• CJEU case: recognising human rights as general EU principles (based on ECHR)

• Charter of Fundamental Rights (2000): visible al sorts of fundamental rights

14.

a. Why is the adoption of the Lisbon Treaty an important step for data protection law?

b. What is the TFEU and what is the role of Art. 16 TFEU

• Entered into force: 2009

• Charter (and the TEU and TFEU) became legally binding

• Article 8 Charter —> protection of personal data as a fundamental right

• Also introduced Article 16 TFEU

• Another fundamental right and legal basis for personal data protection!

• TFEU: EU powers

• Art. 16 TFEU = Right to data protection (modern and comprehensive)

• data protection in all areas of EU competence, including police and judicial cooperation in criminal matters.

• Independent legal basis

• Independent supervisory authorities

• Legal basis for the 2016 data-protection reform, including the GDPR

15.

a. Explain the following sentence in the Handbook: “The Data Protection Directive established a detailed and comprehensive data protection system in the EU”.

b. What was wrong with the 1995 data protection directive why was a new instrument needed?

• 1995 EU-wide framework

• Personal-data protection

• Free movement of data

• Harmonisation of national laws

• Convention 108 principles expanded —> Article 11 of Convention 108 allowed states to provide additional safeguards, and the Directive used this possibility to develop a more complete system of protection.

• Rights of individuals

• Controller obligations and enforcement

• Independent supervisory authorities

• Directive required national transposition

• Member States had discretion

• Divergent national implementation

• Different interpretations and standards

• Unequal enforcement and sanctions

• Legal uncertainty / fragmented system

• Outdated technology framework

• GDPR: directly applicable, uniform rules

16. Compare the Data protection Directive with the original Convention 108. Discuss respective strength and weaknesses.

• Convention 108: early binding principles, general and flexible initially no independent supervision

• Directive: detailed EU harmonisation framework, high protection + free data movement + independent supervisory authorities

• Transposition caused divergence

• Mainly covered internal-market activities and excluded law-enforcement processing by public authorities, which led to replacement by the GDPR.

17. Compare with regard to data protection law-enforcement, Framework Decision 2008 with the Law Enforcement Directive 2016.

• Framework Decision 2008: first police-data instrument

• Only cross-border data exchanges

• No domestic law-enforcement processing

• LED 2016 replaced Framework Decision

• LED: cross-border and domestic processing

• Covers processing for prevention, investigation, prosecution, penalties

• Security, data protection officer, accountability, breach notification

• Profiling/automated decisions strongly restricted/prohibited

18. Discuss the relationship between the GDPR and the law enforcement directive. Can police forces fall under both instruments?

• GDPR: general data-protection regime

• LED: special regime for police cooperation and criminal justice

• Purpose determines applicable instrument

• Processing for criminal-law purposes → LED

• If they process data for another purpose (administrative for example) → GDPR

• Police can fall under both

• Both: security, supervision, accountability

• But the LED balances rights and public security!

19. Discuss the Directive on privacy and electronic communications in the light of the fundamental rights in the charter. What is it function?

• Applies to electronic communications (internet, landline & phones for example)

• Protects privacy and communications confidentiality

• It is closely linked to: Charter Article 7: private life + Charter Article 8: data protection

• Prohibits interception and surveillance

• Protects communications and metadata

• It also regulates cookies and prohibits unsolicited messages, such as spam, unless the user has given consent.

• It further requires communication-service operators to protect personal data —> storage and access limitation + breach procedures

20. Discuss the process of reform of the directive on privacy and electronic communications.

• Digital communications changed substantially

• Old rules targeted traditional telecom providers

• New services (OTT): WhatsApp, Skype, Messenger

• Commission proposal: January 2017

• Proposed e-Privacy Regulation

• Align rules with the GDPR

• Uniform EU rules; direct applicability (no harmonisation!) —> improve legal certainty

• The legislative process is still ongoing!

Proposed e-Privacy regulation:

• Machine-to-machine communications included

• Internet of Things (IoT) devices covered

• Communications metadata receives stronger protection

• Big-data use of metadata addressed

• Cookie rules revised

• Necessary cookies distinguished from tracking cookies

21. What is the institutional context justifying Regulation No. 45/2001 and what is the EDPS?

• Former Data Protection Directive covered Member States only

• EU institutions needed separate data-protection rules

• Regulation 45/2001 governed EU bodies’ processing

• General EU data-protection principles to protect individuals against EU-institution processing

• Created the independent European Data Protection Supervisor

• EDPS monitors and enforces compliance

• EDPS investigates complaints and advises institutions

22. Does the caselaw on data protection law in the EU before the GDPR remain valid?

• Most pre-GDPR case law remains relevant

• GDPR retained many core concepts of the Directive

• Old rulings help interpret retained GDPR rules

• Repeal does not erase previous case law

• New or changed GDPR rules limit relevance

• But if the GDPR introduced a new rule or changed an earlier rule, the old case law may not fully apply

23

a. Compare schematically the rights-limitation grounds or requirement in the ECHR and in the Charter

b. What is understood with the terms ‘in accordance with the law’ under the European convention on human rights?

c. Compare the legality requirement under ECHR and under the Charter

ECHR (art. 8)	EU Charter (art. 52)
A lawful interference must be in accordance with the law.	A limitation must be provided for by law
It must pursue a legitimate aim.	It must pursue an EU-recognised objective of general interest or the need to protect the rights and freedoms of others.
It must be necessary and proportionate in a democratic society to achieve a legitimate purpose.	It must be necessary and proportionate.
It must respect the essence fundamental rights and freedoms.	It must respect the essence of the right.

A key difference is that the Charter expressly requires every limitation to respect the essence of the right.

Article 8(2) ECHR is a specific limitation clause: it sets out when a public authority may interfere with the right to private and family life, the home and correspondence. By contrast, Article 52(1) of the Charter is a general limitation clause, which determines when any right or freedom guaranteed by the Charter may be limited.

• Legal basis in domestic law

• Law must be accessible

• Law must be foreseeable in it’s effects

• Law must be sufficiently precise

• Individuals must foresee possible interference

• Powers’ scope and use clearly defined

• Safeguards against arbitrary abuse

• Precision depends on subject matter

• ECHR: “in accordance with the law”

• Charter: “provided for by law”

• Requirements are substantially identical

• Legal basis must be accessible

• Legal basis must be foreseeable

• Legal basis must be sufficiently precise

• Powers must be limited and defined

• ECtHR quality-of-law standard guides CJEU

24

a. Article 8 ECHR has to be triggered. When is the article applicable

b How is the right in article 8 Charter triggered? What is required for the right to apply?

• 8 ECHR: applies only applies where the processing of personal data affects an individual’s private life (broad interpretation: private, professional and public life).

• No seperate Data Protection article —> not every processing triggers Article 8 —> there needs to be interference with private life!

• Once Article 8 is triggered, the Court examines whether the interference is justified under Article 8(2) ECHR.

• 8 of the Charter: applies whenever personal data are processed.

• Data protection is a seperate fundamental right in EU law —> Therefore, any processing of personal data is automatically an interference with Article 8 —> no impact on private life or actual harm is required.

• Once Article 8 is engaged, the processing must satisfy the conditions for a lawful limitation in Article 52(1) of the Charter.

25. Does the European convention on human rights allow delegation of police powers to private individuals? What is the relevant case law?

• Delegation of police-like powers (such as secret surveillance is possible

• Vukota-Bojić v Switzerland (2016): State responsibility remains unchanged + private actors cannot evade Convention duties

• In Vukota-Bojić v. Switzerland (2016), a private insurance company secretly monitored the insured person while performing a public function. The ECtHR held that a State remains responsible under Article 8 ECHR even when it delegates public powers to private actors. Because Swiss law did not clearly regulate the surveillance power or provide adequate safeguards against abuse, the Court found a violation of Article 8 ECHR.

Looking at paragraph two of article 8 of the European conventional human rights one finds a long list of legitimate aims that can be involved to limit rights. In the handbook, all these aims are categorized in two categories, and the book follows these structure of two categories What are the two categories of legitimate aims in article 8 paragraph two?

• Two categories of legitimate aims

• Public interests (society as a whole)+ protection of others (private interests)

• Public interest examples: national security and public safety, economic well-being of the country, prevention of disorder or crime and protection of health or morals

• Rights and freedoms of others: freedom of expression/religion/right to life

27. The necessity requirement under article 8 ECHR proves to be a very important requirement in practice. Explain this requirement.

• Necessary in a democratic society —> a key part

• Interference must response to a pressing social need must be proportionate to the legitimate aim pursued

The ECtHR examines whether the measure is relevant and suitable for achieving that aims: may ask whether the problem would harm society if it were not addressed, whether the measure can reduce that harm, and what wider social views exist on the issue

Proportionality —> no less intrusive alternative —> Court considers, for example, how many people are affected, how intrusive the measure is, and whether safeguards limit misuse or harm.

28. What rights limitation-requirement is explicitly provided for in the Charter but not in the ECHR. Illustrate this requirement at least one illustration from case law with the case law discussed in Chapter 1

• Article 52(1) Charter: explicitly requires that every limitation on a fundamental right must respect the essence of that right.

• Core content must remain intact, the right must not become meaningless

• If the essence is violated, there is no need to further examine whether the measure pursues a general interest or is necessary and proportionate.

• CJEU Schrems v. Data Protection Commissioner

• Facts: Facebook Ireland transferred personal data to the United States under the Safe Harbour Decision. US authorities could access electronic communications on a general basis, while individuals lacked effective legal remedies.

  Legal rule: Generalised access by public authorities to the content of electronic communications compromises the essence of Article 7 Charter (private life). A lack of effective remedies may also compromise the essence of Article 47 Charter (effective judicial protection). Therefore, the Safe Harbour Decision was invalid.

29

a. What is understood under necessity and proportionality in the Charter and illustrate with case law

b. What is the EDPS Necessity Toolkit?

• 52(1) Charter —> limitation must be necessary and proportionate.

• Necessary if a measure is needed to achieve the legitimate aim.

• Strict CJEU test —> only where they are strictly necessary.

• Necessary —> there should be no less intrusive measure that can achieve the same goal.

• Proportionality —> the benefits of the measure must outweigh the disadvantages.

• Safeguards are important to reduce harm.

• Digital Rights Ireland: CJEU invalidated the Data Retention Directive. It required the retention of traffic and location data of almost the entire EU population. Therefore, the interference with Articles 7 and 8 of the Charter went beyond what was strictly necessary.

• European Data Protection Supervisor guidance

• For EU policymakers and legislators

• Ex ante assessment of new measures

• Personal-data processing and Charter rights

• Define the objective clearly

• Demonstrate genuine necessity

• Consider less intrusive alternatives

• Prevent unjustified rights interferences

30

a. Is there a legitimate aims-requirement or test in the framework Charter? How does this relate to GDPR?

b. in rights limitations-testing it is said that the requirement of legitimate aims and the requirement of necessity and proportionality are closely linked. Explain

• Article 52(1) Charter

• General interest, recognised by the Union

• Or protection of others’ rights and freedoms

• Article 3 TEU EU’s general objectives: peace, well-being, freedom, security, justice and social justice.

• Article 23(1) GDPR further specifies this requirement for data protections: national security, defence, crime prevention, important economic interests, public health and social security.

• Essence of the right, necessity and proportionality still apply

• Clearly define the legitimate aim

• Necessity is assessed against that aim, it depends on the aim!

• Suitability: can the measure achieve it?

• Necessity: is it really needed?

• Least intrusive equally effective alternative

• Proportionality: fair balance

• CJEU Schwarz v. Stadt Bochum

31. Explain the relationship between the Charter and the ECHR. Will there be fragmentation in human rights case law?

• Separate but closely connected instruments

• Similar rights-limitation frameworks

• Article 52(1) Charter / Article 8(2) ECHR

• Article 52(3): corresponding rights of the ECHR must have the same meaning and scope

• But, EU law may provide broader protection

• Charter Article 8: distinct data-protection right

• CJEU–ECtHR dialogue prevents fragmentation —> refer to each other’s judgments

32

a. What is the core technique to evaluate cases of conflicting rights, such as when the right to data protection often interacts with other rights, such as freedom of expression and the right to receive and impart information.

b. Is there a role for states to reconcile conflicting rights. Illustrate with GDPR

• Balancing exercise (DP versus freedom of expression)

• No automatic priority

• Case-specific assessment

• The court must consider whether limiting one right is necessary to protect the other right, and whether the limitation is proportionate

• Data protection can also support freedom of expression —> For example, professional secrecy protects confidential information and journalistic sources.

• In short, courts try to reconcile both rights and give each right appropriate protection.

• States must reconcile conflicting rights

• Data protection is not absolute —> may be limited

• Legislative balance at national level

• Article 85 GDPR States must reconcile Data protection with freedom expression and information

• Journalistic, academic, artistic, literary purposes

• Therefore, national law may provide exemptions or derogations from certain GDPR rules where these are necessary to protect freedom of expression.

• CJEU Tietosuojavaltuutettu v. Satakunnan Markkinapörssi Oy and Satamedia Oy

33. How is freedom of expression protected in European human rights law and what is commonly understood under this right? Also refer to GDPR

• Article 10 ECHR / Article 11 Charter

• Same meaning and scope

• Protects the right to speak, publish or share information/ideas/opinions, but also the right to receive information.

• No public-authority interference

• Regardless of frontiers

• Important in democratic society access to official documents and transparency on public authorities!

• But, access to official documents may reveal personal data. Transparency is an objective of general interest and can justify an interference with data protection only when the interference is necessary and proportionate.

• Article 85 GDPR: requires Member States to reconcile data protection with freedom of expression and information, including for journalistic, academic, artistic and literary purposes.

34. How did the Court create a right to be forgotten and how is this related to freedom of expression?

• CJEU Google Spain —> under certain conditions, a person can ask a search engine to remove links to personal data from search results based on their name.

• Mario Costeja: old bankruptcy notice

• Outdated and no longer relevant

• Search engine Google = data controller

• Removal when: inaccurate, inadequate, irrelevant or excessive

• Not an absolute right —> balance privacy against public interest in information

35. The right to freedom of expression and the right to personal data protection are not always in conflict. There are instances where the effective protection of personal data guarantees freedom of expression. Illustrate this with case law

• Rights may reinforce each other

• Privacy enables free communication without fear!

• CJEU Tele2 Sverige:

• General and divers data retention of traffic and location data

• Serious interference: Articles 7 and 8

• Constant-surveillance feeling —> discourage them from using electronic communication

• Negatively affect freedom of expression under Article 11 of the Charter

• strict safeguards against data processing protect privacy + help people communicate/express freely.

36. Explain the status of the right to access of documents held by public authorities in the two Europes. Illustrate also with the GDPR.

• EU + CoE recognise access to public documents as a transparency right.

• EU Regulation 1049/2001 gives access to documents held by the Parliament, Council and Commission.

• Article 42 Charter and Article 15(3) TFEU extend access to EU institutions, bodies, offices and agencies.

• CoE standards include Recommendation on Access to Official Documents and Convention 205.

• Access may conflict with privacy when documents contain personal data.

• Article 86 GDPR allows disclosure where EU or national law permits it.

• Article 86 GDPR aims to reconcile transparency with data protection.

• Authorities must balance access against the privacy interests of the people concerned.

37. The balancing between data protection and access to documents requires a detailed case by case analysis, says the handbook. Explain how the Bavarian case nicely illustrates how even within one case judges can have conflicting views.

• CJEU Bavarian Lager shows that access requests involving personal data require a case-by-case assessment.

• The company requested full minutes of a meeting involving the Commission and British authorities.

• The Commission disclosed the minutes but removed five participants’ names. Two participants objected, while the Commission could not contact the other three.

• The Court of First Instance said that naming attendees did not seriously affect private life.

• The CJEU overturned this judgment on appeal.

• It held that Bavarian Lager had to show that disclosure of the names was necessary.

• The case shows that judges can disagree on privacy interference and necessity.

38

a. The right to access to document cannot, says CJEU case law, automatically overrule the right to data protection says the handbook. What does this mean in practice?

b. How can additional criteria be found in the case law of the European court on human rights? What is the central case here?

• Access to documents does not automatically override data protection.

• Data protection does not automatically defeat a request for access either.

• Authorities must balance the competing rights in the specific circumstances.

• The applicant must give a concrete and legitimate reason for disclosure.A general wish for transparency may not be sufficient (CJEU Bavarian Lager)

• CJEU ClientEarth —> experts’ names were needed to assess their impartiality.

• Less intrusive alternatives, such as redaction/limited access, must also be considered.

• ECtHR Magyar Helsinki Bizottság v. Hungary —> Article 10 ECHR does not generally create a right to receive public information.

• However, access may be protected when it is necessary for freedom of expression.

The Court considers the purpose of the request (1), the nature and public-interest value of the information (2), the applicant’s role, for example as a journalist or NGO (3) & whether the information is ready and available (4).

In this case, an NGO needed available data for a public debate on criminal justice, so refusal violated Article 10.

39. Why is the interaction between professional secrecy and data protection often ambivalent? Discuss two features of the GDPR in this context.

• Data protection can protect professional secrecy, while professional secrecy can limit data protection.

• The GDPR protects secrecy through security obligations for controllers and processors (safeguards).

• These obligations help prevent unauthorised access, loss and disclosure.

• Professional secrecy can also limit data subjects’ right to receive information —> the duty to inform does not apply where confidentiality is legally required.

• Thus, the GDPR protects confidentiality but may restrict access to information.

• Member States may adopt specific rules reconciling GDPR rights with professional secrecy (art. 90 GDPR).

• Supervisory authorities and their staff must respect professional secrecy, including after leaving office.

40. What is the importance of the right and duty of professional secrecy? Is it a human right? Illustrate your answer with European court of human right cases.

• Professional secrecy protects trust between a client and a professional, especially a lawyer. Clients must be able to speak openly about sensitive matters.

• Confidentiality is closely linked to private life under Article 8 ECHR/Article 7 Charter EU.

• Lawyer-client confidentiality also helps people obtain legal advice and prepare their cases.

• ECtHR Pruteanu v. Romania —> concerned the protection of lawyer-client conversations.

• Brito Ferrinho Bexiga Villa-Nova v. Portugal also concerned confidential lawyer communications —> professional secrecy is not a separate ECHR right, but Article 8 strongly protects it, especially as part of the protection of private life and confidential correspondence.

41

a. Explain relation freedom of religion and belief and GDPR

b. How are freedom of the arts and sciences protected in fundamental law and in the GDPR

• Freedom of religion and belief is protected by Article 9 ECHR and Article 10 Charter —> the freedom to manifest a belief and the freedom not to reveal one.

• Religious or philosophical beliefs are special-category data under Article 9 GDPR. They receive stronger protection because disclosure can harm private life and religious freedom.

• Churches may process members’ data under Article 91 GDPR, subject to GDPR-compatible rules and independent supervision.

• Article 13 Charter protects freedom of the arts and sciences.

• Artistic freedom is also protected by Article 10 ECHR.

• These freedoms must respect human dignity under Article 1 Charter.

• Limitation art. 52(1) Charter —> must be lawful, necessary and proportionate.

• The GDPR gives special recognition to scientific and historical research. Research data may be stored longer when appropriate safeguards are used. Further processing for research is not automatically incompatible with the original purpose.

• EU or national law may limit certain data-subject rights for research, but only with safeguards.

42. Can an artist shock, create sexual images and claim human rights protection?

• Artists can rely on Article 10 ECHR, even when their work shocks or offends. Freedom of expression protects ideas that offend, shock or disturb.

• ECtHR Vereinigung bildender Künstler v. Austria —> an artistic association displayed a sexualised and exaggerated painting of public figures. A politician obtained an injunction banning any further exhibition.

• The ECtHR held that the unlimited ban was disproportionate. The painting was clearly unrealistic and was not presented as factual reality. Politicians must tolerate more criticism because the work concerned their public role.

43

a. How is property and intellectual property protected in Europe at the fundamental rights level.

b. How has the CJEU paved the way for intellectual property rights organizations to obtain data from Internet providers about illegally downloading people

• Article 1 Protocol No. 1 ECHR protects property + Article 17(1) Charter also protects the right to property.

• Article 17(2) Charter specifically protects intellectual property: includes copyright, patents, trademarks and artistic works.

• Intellectual-property rights are not absolute —> must be balanced against privacy and data-protection rights.

• This happens when copyright owners want to know who may have downloaded music, films or other files illegally. Courts must ensure a fair and proportionate balance in each individual case.

• The CJEU allows intellectual-property organisations to seek data from internet providers. However, there is no automatic right to receive users’ personal data.

• National law must allow a fair balance between all conflicting rights.

• CJEU Promusicae —> a music organisation sought the identities of alleged file sharers. The CJEU said that EU law can permit disclosure in civil copyright proceedings. Member States must balance copyright, privacy, data protection and effective remedies.

• CJEU Bonnier Audio —> copyright holders requested the name and address linked to an IP address. Disclosure is possible only where the national court applies proportionality.

44. How can the general idea that conflicting rights needs balancing be combined with Google Spain? Is there other caselaw that might suggest that there is no principal prioritization of one right above others?

• Fundamental-rights conflicts normally require a case-by-case balancing exercise.

• CJEU Google Spain gives strong protection to privacy and data protection in search-engine cases. Search engines can make information easily searchable, linked and widely accessible.

• This can seriously interfere with Articles 7 and 8 Charter. As a rule, privacy and data protection override the search engine’s economic interests. They may also override the public’s interest in finding information through a name search.

• However, ‘as a rule’ means that this is not an absolute priority.

• CJEU Manni —> . Mr Manni wanted personal information about his past role in a bankrupt company removed from a public register. confirms. Public access to company-register information could outweigh the individual’s request for erasure.

45. How are the four rights in Article 8 interpreted by the ECtHR? What are the limits to the interpretative power of the ECtHR

Article 8 protects private life, family life, home and correspondence.

• The ECtHR interprets all four concepts broadly and dynamically.

• The ECHR is a “living instrument” that develops with society and technology.

• Private life covers identity, integrity, sexuality, personal development and social relations.

• Family life depends mainly on real close ties, not only on marriage or biology.

• Home requires a real personal connection with a place.

• Correspondence includes modern communication and metadata.

• The Court is limited by Article 8’s material scope, State reservations art. 57 ECHR and the margin of appreciation.

46

a. Explain how the ECtHR protects physical, psychological or moral integrity under the different applicable provisions of the ECHR

b. Do states have positive obligations to protect physical, psychological or moral integrity. If yes, explain and give examples

• Physical, psychological and moral integrity are protected by Articles 2, 3, 4 and 8 ECHR.

• Articles 2, 3 and 4 cover the most serious violations. They protect life and prohibit torture, degrading treatment, slavery and forced labour.

• Article 8 protects integrity as part of private life. It covers less extreme issues, such as mental health and medical decisions. Examples include abortion, home birth, artificial insemination and genetic testing.

• Article 8 is more flexible because Article 8(2) allows justification of interferences. Therefore, Article 8 is often used for ordinary interferences with personal integrity.

• Article 8 can impose positive obligations on States. States must sometimes actively protect people from harm. Protection may be needed against private actors, dangerous animals or environmental risks.

• States may have to provide information about medical procedures and health risks.

• They may have to protect people against violence, sexual abuse or serious school bullying.

• The exact obligation depends on the facts of the case.

• Article 8 therefore protects people against both State interference and serious private threats.

• ECtHR K.U. v. Finland

47. What does the protection of professional identities imply for our understanding of the scope of the right to privacy?

• Professional identity shows that private life is broader than secrecy or life at home.

• Article 8 protects identity, autonomy, personal development and human flourishing.

• Work can be an important part of someone’s identity.

• Professional activities can therefore fall within private life.

• The right to develop oneself at work may be protected by Article 8.

• Dismissal may affect private life if it prevents professional flourishing.

• Article 8 can cover public, social and economic matters.

• The key question is whether the issue affects identity or personal development.

48. How does the ECtHR interpret the right family life. Give at least four examples

• The ECtHR interprets family life broadly.

• Family life mainly depends on real and close personal ties.

• Marriage or a biological relationship is not always necessary.

• Adoptive parents and adopted children can have family life.

• A father and child may have family life, even if they have never met.

• Same-sex couples and children born outside marriage can have family life.

• Close ties with grandparents or other relatives may also be protected.

• Article 8 can protect both existing family life and the wish to establish family life.

49

a. How does the ECtHR interpret the right to protection of the home. Give at least 7 examples

b. How does the ECtHR interpret the right to protection of correspondence and what is the role of positive obligations in this sphere

• The ECtHR interprets “home” broadly and autonomously: main question is whether someone has a factual and lasting connection with a place.

1. A house, rented apartment or long-term flat can be a home.

2. A caravan, mobile home, cabin or bungalow can also be a home.

3. A holiday home or second home may be protected.

4. A car where a homeless person regularly sleeps can be a home.

5. Even an office, business building or land intended for a future home may fall under Article 8.

• The ECtHR interprets correspondence very broadly.

• It covers letters, packages, telephone calls, emails and internet communications.

• It protects both the content of communication and certain metadata.

• A conversation can be protected even when it takes place in public.

• The important question is whether the communication was meant to remain private.

• States have positive obligations to enable communication with the outside world.This is especially important for prisoners communicating confidentially with lawyers.

50. Van der Sloot goes quite at length to show that Article 8 ECHR overshadowed other rights in the ECHR. He reaches four conclusions. Explain his first conclusion

• Article 8 has overshadowed Articles 2, 3 and 4 in integrity cases.

• Articles 2, 3 and 4 mainly apply to the most serious violations.

• They protect life and prohibit torture, degrading treatment, slavery and forced labour.

• Article 3 is absolute and does not allow justification.

• Article 8 has a broad scope and a flexible limitation clause.

• Many medical and end-of-life issues are therefore examined under Article 8.

• Article 8 covers less extreme physical and psychological interferences.

• The Court can then assess whether the interference is justified under Article 8(2).

51. Van der Sloot goes quite at length to show that Article 8 ECHR overshadowed other rights in the ECHR. He reaches four conclusions. Explain his second conclusion

• Article 8 has overshadowed Article 12, the right to marry and found a family.

• Article 12 was intended to protect marriage and biological procreation.

• The ECtHR interprets Article 12 relatively narrowly.

• Article 8 was originally meant to protect existing family life against State interference.

• The Court now interprets Article 8 much more broadly.

• Article 8 covers same-sex relationships and non-traditional family forms.

• It also covers adoption, artificial insemination and other reproductive techniques.

• Article 8 can even protect the intention to establish family life.

52. Van der Sloot goes quite at length to show that Article 8 ECHR overshadowed other rights in the ECHR. He reaches four conclusions. Explain his third conclusion

• Article 8 has absorbed procedural safeguards from Articles 5, 6 and 13 ECHR.

• Normally, Article 6 protects fair-trial rights and procedural questions —> the ECtHR may examine the fairness of a decision-making process under Article 8.

• The procedure must consider relevant facts and must not be arbitrary or one-sided.

• Individuals must be able to explain their views and interests to the authorities.

• Authorities must seriously consider these interests.

• Individuals must be able to use effective remedies in time.

• In child-placement cases, parents should receive information and participate in decisions.

• Article 8 also protects confidential communication between prisoners and lawyers.

53. Van der Sloot goes quite at length to show that Article 8 ECHR overshadowed other rights in the ECHR. He reaches four conclusions. Explain his fourth conclusion.

• The ECtHR has brought honour and reputation within Article 8.

• The ECHR drafters originally excluded reputation from Article 8.

• They considered reputation vague and mainly relevant in conflicts between private persons.

• Reputation was instead included in Article 10(2) as a reason for the state to limit freedom expression.

• Around 2007–2009, the Court changed its approach.

• Serious attacks on reputation can harm a person’s identity, personality and integrity.

• Reputation can therefore be part of private life under Article 8.

• A person can now invoke Article 8 to protect their reputation.

54. Explain the four generations of rights

• First-generation rights protect people against State interference: include privacy, freedom of expression and the right to life.

• Second-generation rights require positive State action: include education, free elections, employment and remuneration.

• Third-generation rights protect collective interests and are based on solidarity: include minority rights, cultural rights and environmental protection.

• Fourth-generation rights arise from digital technology and biotechnology: aim to protect individual control and create duties for organisations.

55. Some rights were excluded from the ECHR in 1950 but the ECtHR has primarily through Article 8-interpretation brought them back. Van der Sloot’s first example is about rights for the individual to develop his or her personality

• The ECHR drafters excluded broad rights to dignity and personality development.

• They considered these rights (did exist in the UDHR) too vague for judicial enforcement.

• The ECtHR later brought these interests under Article 8.

• Private life became a broad personality right, not only a right to be left alone.

• Article 8 can protect identity and personal development.

• It can also protect sexuality, cultural interests and social life.

• Professional activities may be protected when they are important for personal development.

• Article 8 helps people shape their identity and flourish in society.

56. Some rights were excluded from the ECHR in 1950 but the ECtHR has primarily through Article 8-interpretation brought them back. Van der Sloot’s second example is about protection of property

• Property was excluded from the original text of the ECHR.

• It was later protected by Article 1 of Protocol No. 1.

• Been discussion about adding private property to Article 8, but rejected because property rights were seen as politically contested rather than universally accepted human rights.

• But the ECtHR can protect some economic interests under Article 8!

• This is possible when those interests seriously affect private or family life. Examples include inheritance and the right to work.

• Dismissal from office may affect a person’s private life.

• Eviction or destruction of a home may affect private and family life.

• Article 8 therefore protects property-related interests when they affect personality or home.

57. Some rights were excluded from the ECHR in 1950 but the ECtHR has primarily through Article 8-interpretation brought them back. Van der Sloot’s third example is about protection of rights of immigrants

• The ECHR drafters excluded asylum, nationality and immigration rights.

• They considered immigration control part of State sovereignty.

• Article 8 does not create a general right to enter or remain in a country.

• However, deportation can interfere with family life.

• This may happen when deportation separates someone from close relatives.

• Article 8 can also be relevant in family-reunification cases.

• Private life may be affected when an immigrant has strong social or professional ties in a country.

• The ECtHR then balances the immigration measure against Article 8 interests.

58. Some rights were excluded from the ECHR in 1950 but the ECtHR has primarily through Article 8-interpretation brought them back. Van der Sloot’s fourth example is about protection of right to education in art. 2 Protocol 1 ECHR

• Education was excluded from the main ECHR text.

• It is now protected by Article 2 of Protocol No. 1.

• Education can also fall within Article 8 because it is important for personal development.

• It can affect family life, especially when language is involved.

• The Belgian Linguistic Case concerned French-speaking parents in Dutch-speaking Belgium.

• Their children could not receive education in French.

• Education in a different language may distance children from their parents.

• Article 8 can therefore protect family-life and development interests affected by education policy.

59. The material part of the 1950 ECHR (the rights listed in Article 1 to 18) was never changed. (material part of the ECHR) were never changed or amended, apart from adding rights via protocols. Bart van der Sloot. Article 8 ECHR was used primarily to bring new rights brought under human rights framework. Discuss at least 3 examples taken from the third and fourth generation of rights given in the lecture (out of 5)

• Article 8 is interpreted as a living instrument, so it can protect modern interests not listed in the 1950 ECHR:

  • Environment: noise, pollution, smog and radiation affecting quality of life or home.

  • Minority identity: mobile homes, minority languages and translated documents.

  • Digital rights: data protection, digital privacy and future biotechnology rights.