The document discusses the expansive interpretations of EU data protection law adopted by the CJEU and European data protection authorities (DPAs) and their implications for internet actors. It notes that while the formal legal stance is broad, enforcement of data protection against expression has been limited and sporadic. It also discusses how an enforcement focus can lead DPAs to issue guidance that conflicts with their broad interpretative stance, as seen with guidelines on search engines after the Google Spain ruling.

1. Dr. David Erdos
Faculty of Law
University of Cambridge

2. 4 Claims on EU Data Protection & Internet
 CJEU and European DPAs have adopted an expansive
interpretative stance as regards DP and expression
 That paradigm has serious implications for a range of
internet actors beyond search engines.
 Enforcement has been limited and sporadic.
 A focus on enforcement can result in interpretative
guidance in severe tension with interpretative stance.

3. EU Data Protection: Formal Structure
Processing
of Personal
Data
Data Quality
Principles
Sensitive Data
Rules
Transparency
Rules
Control
Regime
Subject to a number of Exemptions and Derogations

4. CJEU Stance: Not Much Is Excluded
 Key terms of the Directive have a broad scope:
 Lindqvist (2003) – “Personal Data”; “Processing”
 Satamedia (2008) – “Personal Data” & public domain
 Exemptions are very limited
 Lindqvist (2003) – general publication covered
 Satamedia (2008) – exemptions narrow & exhaustive
 Ryneš (2013) – other personal purpose activities covered

5. CJEU Stance: Special Purposes not unbounded
 Satamedia (2008)
 Lindqvist (2003)
 Google Spain (2014): search engine not within this.
“The Commission submits that an internet page such as that at issue
in the main proceedings … constitutes … an artistic and literary
creation within the meaning of Article 9 of that Directive.” (at 33)
Special purposes cover “disclosure to the public of information,
opinions or ideas.” (at 62)

6. CJEU Stance: May be need for balance
 Lindqvist (2003)
 Explicitly extended to the interpretation of transposing
law in Promusicae (2008)
“Authorities and courts of the Member States [must] …make sure
they do not rely on an interpretation of it [the Directive] which
would be in conflict with the fundamental rights….or with other
general principles of Community law, such as inter alia the
principle of proportionality.” (at 87)

7. CJEU Stance: DP Norms Often Overriding
 Bavarian Lager (2010)
 IPI (2013)
“any undermining of privacy and the integrity of the individual
must always be examined and assessed in conformity with the
legislation of the Union concerning the protection of personal
data” (at 59)
“Article 13 (1) … Member States have no obligation but have the
option, to transpose into their national law one or more of the
exemptions which it lays down to the obligation to inform data
subjects of the processing of their personal data.”

8. CJEU Stance: Other Expansive Decisions
 Schrems (2015) on data transfer adequacy
 Weltimmo (2014) on local law application within EU
“controller exercises, through stable arrangements in the territory of
that Member State, a real and effective activity – even a minimal one
– in the context of which that processing is carried out.”
“the term ʻadequate level of protectionʼ must be understood as requiring
the third country in fact to ensure … a level of protection … that is
essentially equivalent to that guaranteed within the European Union”

9. DP Laws broadly apply to Online Expression
Online
Media
1. News
Archive
2. Blogger
3. Social
Networker
4. Social
Networking
Site
5. Rating
Website
6. Search
Engine
7. Street
Mapping
Service

10. What is the stance of DPAs here?
 DPAs are even more central than Courts in this space.
 Survey run to explore their views (& enforcement actions)
 ≈80% national EEA DPAs + 6 sub-national answered
• Seven cases involving internet expression specified.
• In each case four standard answers presented:
1. DP does not apply
2. DP special purposes applies
3. General DP applies but need regard for rights
4. General DP applies in full

11. DPA Stance: News Media
4%
67%
26%
4%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Exempt Special
Derogation
Regard for Rights Full Application
News Story
12%
48%
32%
8%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Exempt Special
Derogation
Regard for Rights Full Application
News Archive

12. DPA Stance: Social Media and Blogs
8%
28%
60%
4%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Exempt Special
Derogation
Regard for Rights Full Application
Blog about Celebrity Gossip
16%
4%
32%
48%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Exempt Special
Derogation
Regard for
Rights
Full Application
Social Networker re: photo tag
0%
4%
23%
73%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Exempt Special
Derogation
Regard for Rights Full Application
Social Network re: photo tag
3%
0%
50%
47%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Exempt Special
Derogation
Regard for Rights Full Application
Teacher Rating Website

13. DPA Stance: New Web Information Services
0% 0%
7%
93%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Exempt Special Derogation Regard for Rights Full Application
Street Mapping Service
8%
0%
12%
81%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Exempt Special Derogation Regard for Rights Full Application
Search Engine

14. Self-Reported DPA Enforcement: By Actor
(N.B. Chart excludes German Federal & Spanish Catalan DPAs)
55
48
48
45
41
41
28
0 10 20 30 40 50 60 70 80 90 100
Street Mapping
Individual Blogger
Social Network
Social Networker
News Archive
Rating Website
Search Engine
% of Responding DPAs having taken action under Directive

15. Self-Reported DPA Enforcement: By DPA
0%
5%
10%
15%
20%
25%
30%
Zero One Two Three Four Five Six Seven
Number of specified online media actors against which publication enforcement action taken
(N.B. Chart excludes German Federal & Spanish Catalan DPAs)

16. DPA Interpretative Guidance
 Detailed guidance in this area is somewhat sporadic.
 Nevertheless, it is clear that in some cases this can be also
very stringent (e.g. social networking)
 However, an enforcement focus can lead to the production
of guidance sitting in tension with essential stance.
 A case in point in this regard may be search engines post-
Google Spain.

17. C-131/12 Google Spain: Core Decision
 CJEU confirmed that search engines’ use of data
from web was covered by data protection.
 No acknowledgement of freedom of expression.
“akin to marching into a library and forcing it to pulp books”
Index on Censorship
“one of the most wide-sweeping internet censorship laws I’ve ever seen”
Jimmy Wales of Wikipedia

18. EU DPAs Google Spain Guidelines (2014)
 “Search engine operators …qualify as data controllers” & their
“interest in processing personal data is economic”.
 Despite this, the DPA Working Party suggested that they:
1. “only have to respond to data subjects’ requests for the exercise of
their rights” with specific URLs i.e. specific & post-hoc.
2. “only affects the results obtained from searches made on the basis
of a person’s name” i.e. processing by reference to subject.
3. “a balance of the relevant rights and interests has to be made” i.e.
detailed rules on e.g. sensitive data not applied

19. C-131/12 Google Spain: Obiter
“Inasmuch as the activity of a search engine is … liable to affect
significantly, and additionally compared with that of
publishers of websites … the operator of the search engine …
must ensure, within the framework of its responsibilities,
powers and capabilities, that the activity meets the
requirements of Directive 95/46 in order that the guarantees …
may have full effect and that effective and complete protection
of data subjects … may actually be achieved.” (at [38])

20. Conclusions
 EU (& esp. DPAs) in theory adopts expansive interpretation
of data protection vis-à-vis internet expression.
 But enforcement has been very limited and sporadic.
 A focus on enforcement can also lead to the production of
guidance in severe tension with interpretative stance.
 This confused reality will likely continue essentially
unchanged under the forthcoming Regulation.