The ECtHR’s case law on data protection Bart van der Sloot Researcher at the Institute for Information Law, University of Amsterdam Researcher at the Netherlands Scientific Council for Government policy (Wetenschappelijke Raad voor Regeringsbeleid) Coordinator of the Amsterdam Platform for Privacy Research Amsterdam Privacy Conference 2015: www.apc2015.net Minor Privacy Studies: www.iis.uva.nl/minor-privacy

Overview (1) Overview of the ECtHR’s case law on Article 8 ECHR Break (2) Interactive discussion (3) The ECtHR’s case law on data protection, especially in the age of Big Data

(1) Overview of the ECtHR’s case law on Article 8 ECHR

ECHR European Convention on Human Rights of the Council of Europe (1950) ARTICLE 8 - Right to respect for private and family life 1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

Charter Charter of Fundamental Rights of the European Union (2000) Article 7 Respect for private and family life Everyone has the right to respect for his or her private and family life, home and communications. Article 8 Protection of personal data 1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 3. Compliance with these rules shall be subject to control by an independent authority.

Privacy and data protection Domain Relations Background Character Privacy Primarily regards the private sphere Primarily regards vertical relationships (citizen – state) Rise of nation states Control on the use of power & duties of care Or….. Data Protection Regards both the private and the public sphere Regards both vertical and horizontal realtionships Technological developments

Cases under the ECtHR (1) Interference (2) Prescribed by law (3) Aimed at a legitimate interests (4) Necessary in a democratic society

Interference Formalities Ratione Temporis Ratione Loci Ratione Personae Ratione Materiae

Formalities ARTICLE 35 - Admissibility criteria 1. The Court may only deal with the matter after all domestic remedies have been exhausted, according to the generally recognised rules of international law, and within a period of six months from the date on which the final decision was taken. 2. The Court shall not deal with any application submitted under Article 34 that (a) is anonymous; or (b) is substantially the same as a matter that has already been examined by the Court or has already been submitted to another procedure of international investigation or settlement and contains no relevant new information. 3. The Court shall declare inadmissible any individual application submitted under Article 34 if it considers that: (a) the application is incompatible with the provisions of the Convention or the Protocols thereto, manifestly illfounded, or an abuse of the right of individual application; or (b) the applicant has not suffered a significant disadvantage, unless respect for human rights as defined in the Convention and the Protocols thereto requires an examination of the application on the merits and provided that no case may be rejected on this ground which has not been duly considered by a domestic tribunal. 4. The Court shall reject any application which it considers inadmissible under this Article. It may do so at any stage of the proceedings.

Ratione Temporis ARTICLE 32 - Jurisdiction of the Court 1. The jurisdiction of the Court shall extend to all matters concerning the interpretation and application of the Convention and the Protocols thereto which are referred to it as provided in Articles 33, 34, 46 and 47. 2. In the event of dispute as to whether the Court has jurisdiction, the Court shall decide. Before entering into force of Convention Before acceding to Convention by state

Ratione Loci ARTICLE 32 - Jurisdiction of the Court 1. The jurisdiction of the Court shall extend to all matters concerning the interpretation and application of the Convention and the Protocols thereto which are referred to it as provided in Articles 33, 34, 46 and 47. 2. In the event of dispute as to whether the Court has jurisdiction, the Court shall decide. Colonies Ambasees Extra-territorial application

Ratione Personae ARTICLE 33 - Inter-State cases Any High Contracting Party may refer to the Court any alleged breach of the provisions of the Convention and the Protocols thereto by another High Contracting Party. ARTICLE 34 - Individual applications The Court may receive applications from any person, nongovernmental organisation or group of individuals claiming to be the victim of a violation by one of the High Contracting Parties of the rights set forth in the Convention or the Protocols thereto. The High Contracting Parties undertake not to hinder in any way the effective exercise of this right.

Ratione Personae Travaux préparatoires - Discussion about individual complaints - Discussion about compulsary representation - Discussion about one or two levels - Discussion about who can file a complaint to the court - Discussion about penalties or reputation Inter-state complaint 2. Individual Complaint Nongovernmental organisation Groups - Background WO II - Court requires individual harm Natural persons

Ratione Personae Originally, a large emphasis on inter-state complaints In practice, almost of no relavance

Ratione Personae Nongovernmental organisation - Background general duties of care - Special status of 8 ECHR - From 2002 onward, slight relaxation - Exception for cases revolving around Big Data/mass surveillance

Ratione personae Scientology: It is true that under Article 9 of the Convention a church is capable of possessing and exercising the right to freedom of religion in its own capacity as a representative of its members and the entire functioning of churches depends on respect for this right. However, unlike Article 9, Article 8 of the Convention has more an individual than a collective character, the essential object of Article 8 of the Convention being to protect the individual against arbitrary action by the public authorities. The Commission has held in the case of Open Door and Dublin Well Woman against Ireland that a company, namely the Open Door Counselling Ltd., could not complain on behalf of their clients, or women in general and, thus, had no personal right to respect for private life within the meaning of Article 8 of the Convention. On the other hand, where a search was directed solely against business activities, the Court did not invoke such a consideration as a ground for excluding the applicability of Article 8 under the heading of "private life". The Commission does not find it necessary in the present case to examine exhaustively to what extent a legal person may invoke the right to respect for private life within the meaning of Article 8 of the Convention.

Ratione personae Herbecq: In this connection the Commission recalls its case-law to the effect that someone who is unable to demonstrate that he is personally affected by the application of the law which he criticizes cannot claim to be a victim of a violation of the Convention m that regard. The applicant association itself cannot be the subject of any surveillance measure using photographic equipment Its arguments cannot change this fact. However, the Commission points out that there is nothing to prevent an association from acting on behalf of a certain number of individuals, on condition that it identifies them and shows that it has received specific instructions from each of them. It follows that the applicant association cannot claim to be a victim, as such, of the alleged violations of Articles 8 and 13 of the Convention

Ratione personae Enlarged scope of ‘home’ and ‘private life’ Stes Colas (2002): The Court reiterates that the Convention is a living instrument which must be interpreted in the light of present-day conditions. [] Building on its dynamic interpretation of the Convention, the Court considers that the time has come to hold that in certain circumstances the rights guaranteed by Article 8 of the Convention may be construed as including the right to respect for a company's registered office, branches or other business premises.

Ratione Peronae Groups Ratio WO II Court requires individual harm Slight relexation in latest case-law – individuals can be inidividually harmed by harming the group as such (minority rights)

Ratione personae Natural persons Direct complaint to court Locus Standi Indivdiual Harm In abstracto Hypothetical Actio Popularis De minimis rule

Ratione materiae UN Declaration Human Rights - Article 12: No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks. European Convention on Human Rights - ARTICLE 8 Right to respect for private and family life 1. Everyone has the right to respect for his private and family life, his home and his correspondence.

Ratione materiae Terms Family life Private life Home Communication

Ratione materiae X/ICELAND: The right to respect for private life does not end there. It comprises also, to a certain degree, the right to establish and to develop relationships with other human beings, especially in the emotional field for the development and fulfillment of one's own personality.

Ratione materiae Article 8 includes freedoms contained in other provisions of the Convention Bodily integrity Marry and found a family Honour and reputation Fair trial Incorporates freedoms explicitly left out of the Convention Right to property Right to education Right to residence permit Personality right Includes newly developed rights and freedoms: Right to a name Minority rights Environmental rights Data protection

Bodily integrity ARTICLE 2 Right to life 1. Everyone’s right to life shall be protected by law. No one shall be deprived of his life intentionally save in the execution of a sentence of a court following his conviction of a crime for which this penalty is provided by law. 2. Deprivation of life shall not be regarded as inflicted in contravention of this Article when it results from the use of force which is no more than absolutely necessary: (a) in defence of any person from unlawful violence; (b) in order to effect a lawful arrest or to prevent the escape of a person lawfully detained; (c) in action lawfully taken for the purpose of quelling a riot or insurrection. ARTICLE 3 Prohibition of torture No one shall be subjected to torture or to inhuman or degrading treatment or punishment. ARTICLE 4 Prohibition of slavery and forced labour 1. No one shall be held in slavery or servitude. 2. No one shall be required to perform forced or compulsory labour. 3. For the purpose of this Article the term “forced or compulsory labour” shall not include: (a) any work required to be done in the ordinary course of detention imposed according to the provisions of Article 5 of this Convention or during conditional release from such detention; (b) any service of a military character or, in case of conscientious objectors in countries where they are recognised, service exacted instead of compulsory military service; (c) any service exacted in case of an emergency or calamity threatening the life or well-being of the com-munity; (d) any work or service which forms part of normal civic obligations.

Right to marry and found a family ARTICLE 12 Right to marry Men and women of marriageable age have the right to marry and to found a family, according to the national laws governing the exercise of this right.

Right to honour and reputation ARTICLE 10 Freedom of expression 1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This Article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises. 2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.

Right to a fair trial ARTICLE 6 Right to a fair trial 1. In the determination of his civil rights and obligations or of any criminal charge against him, everyone is entitled to a fair and public hearing within a reasonable time by an independent and impartial tribunal established by law. Judgment shall be pronounced publicly but the press and public may be excluded from all or part of the trial in the interests of morals, public order or national security in a democratic society, where the interests of juveniles or the protection of the private life of the parties so require, or to the extent strictly necessary in the opinion of the court in special circumstances where publicity would prejudice the interests of justice. 2. Everyone charged with a criminal offence shall be presumed innocent until proved guilty according to law. 3. Everyone charged with a criminal offence has the following minimum rights: (a) to be informed promptly, in a language which he understands and in detail, of the nature and cause of the accusation against him; (b) to have adequate time and facilities for the preparation of his defence; (c) to defend himself in person or through legal assistance of his own choosing or, if he has not sufficient means to pay for legal assistance, to be given it free when the interests of justice so require; (d) to examine or have examined witnesses against him and to obtain the attendance and examination of witnesses on his behalf under the same conditions as witnesses against him; (e) to have the free assistance of an interpreter if he cannot understand or speak the language used in court.

Right to property ARTICLE 1 First Protocol Protection of property Every natural or legal person is entitled to the peaceful enjoyment of his possessions. No one shall be deprived of his possessions except in the public interest and subject to the conditions provided for by law and by the general principles of international law. The preceding provisions shall not, however, in any way impair the right of a State to enforce such laws as it deems necessary to control the use of property in accordance with the general interest or to secure the payment of taxes or other contributions or penalties.

Right to Education ARTICLE 2 First Protocol Right to education No person shall be denied the right to education. In the exercise of any functions which it assumes in relation to education and to teaching, the State shall respect the right of parents to ensure such education and teaching in conformity with their own religious and philosophical convictions.

Right to nationality Article 15 UDHR (1) Everyone has the right to a nationality. (2) No one shall be arbitrarily deprived of his nationality nor denied the right to change his nationality.

Right to personality Article 22 UDHR Everyone, as a member of society, has the right to social security and is entitled to realization, through national effort and international co-operation and in accordance with the organization and resources of each State, of the economic, social and cultural rights indispensable for his dignity and the free development of his personality. Article 26 UDHR (1) Everyone has the right to education. Education shall be free, at least in the elementary and fundamental stages. Elementary education shall be compulsory. Technical and professional education shall be made generally available and higher education shall be equally accessible to all on the basis of merit. (2) Education shall be directed to the full development of the human personality and to the strengthening of respect for human rights and fundamental freedoms. It shall promote understanding, tolerance and friendship among all nations, racial or religious groups, and shall further the activities of the United Nations for the maintenance of peace. (3) Parents have a prior right to choose the kind of education that shall be given to their children. Article 29 UDHR (1) Everyone has duties to the community in which alone the free and full development of his personality is possible. (2) In the exercise of his rights and freedoms, everyone shall be subject only to such limitations as are determined by law solely for the purpose of securing due recognition and respect for the rights and freedoms of others and of meeting the just requirements of morality, public order and the general welfare in a democratic society. (3) These rights and freedoms may in no case be exercised contrary to the purposes and principles of the United Nations.

Minority rights In the early jurisprudence of the former Commission and the Court, it was held that a second home, a building site, a professional working place, a temporary shelter or other unconventional houses did not fall under the scope of ‘home’. For example, with regard to the search of a person’s car, which functioned as his home, the Commission held: ‘[] la Commission estime que le domicile – “home” – dans le texte anglais de l’article 8 (art. 8)- est une notion précise qui ne pourrait être étendue arbitrairement et que, par conséquent, la fouille de la voiture en stationnement dans les circonstances de la présente affaire, ne saurait être assimilée à une fouille dimiciliaire qui entre dans le domaine d’application de l’article 8 (art. 8).’ However, like the Declaration, the Convention is drafted in two official languages, English and French, and like the Universal Declaration on Human Rights, the French version of the European Convention does not refer to ‘maison’, ‘chez’ or ‘residance’ but rather to the concept ‘domicile’. Domicile has a broader scope than the concept of ‘home’ and might, for example, be used to refer to professional dwellings. In its more recent case law, it is the concept of ‘domicile’, rather than ‘home’, that is increasingly referred to by the Court.

Minority rights This line has had specific consequences for Romas and Gypsies, which the Court regards as vulnerable groups in need of special protection. For example, the Court has stressed in reference to an applicant that the ‘[] occupation of her caravan is an integral part of her ethnic identity as a Gypsy, reflecting the long tradition of that minority of following a travelling lifestyle. This is the case even though, under the pressure of development and diverse policies or by their own choice, many Gypsies no longer live a wholly nomadic existence and increasingly settle for long periods in one place in order to facilitate, for example, the education of their children. Measures affecting the applicant’s stationing of her caravans therefore have an impact going beyond the right to respect for her home. They also affect her ability to maintain her identity as a Gypsy and to lead her private and family life in accordance with that tradition.’

Right to a clean environment In an early case from 1986, regarding the level of noise caused by airports in the vicinity of an individual’s house, the Commission has previously held that Article 8 ECHR ‘cannot be interpreted so as to apply only with regard to direct measures taken by the authorities against the privacy and/or home of an individual. It may also cover indirect intrusions which are unavoidable consequences of measures not at all directed against private individuals. In this context it has to be noted that a State has not only to respect but also to protect the rights guaranteed by Article 8 para. 1. Considerable noise nuisance can undoubtedly affect the physical well-being of a person and thus interfere with his private life. It may also deprive a person of the possibility of enjoying the amenities of his home. In subsequent case law, it was accepted that similarly, noise nuisance may be produced by nuclear power plants working day and night in a rural area and by nightclubs near someone’s home.

Right to a clean environment Although the Court has not yet been willing to guarantee the right to preservation of the natural environment as such under the scope of Article 8 ECHR, gradually building on the notion of protection against noise pollution, the former Commission and the Court have been willing to discuss more and broader effects on the general living environment, such as radiation and vibrations emitted by a transformer, electro smog and air pollution, smog and fumes. Although the Court has accepted that environmental pollution must reach a minimum level of severity, it has also specified that this is a relative concept which depends on all circumstances of the case, such as the intensity and duration of the nuisance and its physical or mental effects on the individual’s health or quality of life.

Data Protection Data Protection Not contained in convention Slowly accepted under the procedural provisions Now primarily discussed under Article 8 ECHR Although accepted to a large extent, there remains a difference in protection between: Private data/privacy sensitive data and personal data Personal data and meta data

Prescribed by law Legal basis Foreseable Accessible Quality of the law

Legitimate aim There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

Necessary in a democratic society Necessity test Balancing test: ‘Establishing that the measure is necessary in a democratic society involves showing that the action taken is in response to a pressing social need, and that the interference with the rights protected is no greater than is necessary to address that pressing social need. The latter requirement is referred to as the test of proportionality. This test requires the Court to balance the severity of the restriction placed on the individual against the importance of the public interest.’

(2) Interactive discussion

(3) The ECtHR’s case law on data protection, especially in the age of Big Data

Data protection under Article 8 ECHR Moreover, following the line that private life also protects one’s public and professional life, the Court has been willing to apply Article 8 ECHR on public data and on professional communications, which has allowed it to find that the systematic collection and storing of data by security services on particular individuals constituted an interference with these persons’ private lives, even if that data was collected in a public place or concerned exclusively the person’s professional or public activities. Likewise, a GPS device attached to a person’s car, collecting and storing data concerning that person’s whereabouts and movements in the public sphere, was also found to interference with Article 8 ECHR. As a final example, large surveillance systems, collecting the personal data of potentially all citizens of the state, is accepted as an issue falling under the right to privacy. Consequently, though not all principles embodied under the European Data Protection Directive are accepted under the Convention, a number of principles of the right to data protection are guaranteed under the scope of Article 8 ECHR. The protection of personal data is yet another classic difference between the right to privacy and personality rights.

Principles Personal data, if de minimis rule is met (art 2a DPD) > hang ups are ‘private life’ and ‘correspondence’ Special category for sensitive data (art. 8 DPD) > Privacy sensitive (8 ECHR), religion (9 ECHR), medical data (8 ECHR) Legitimate grounds (arts 6 and 7 DPD) > Paragraph 2 of 8, 9, 10 and 11 ECHR Transparancy (arts. 10 and 11 DPD) > Art. 10 ECHR Subjective rights (arts. 12, 14 and 15 DPD) > Right to access and correct data (10 and 13 ECHR, partially 8 ECHR >right to reputation). Fair proces (art. 6 DPD) > Right to a fair trial (arts. 5 and 6 ECHR)

Literature: See De Hert/Gutwirth: Data protection in the case law of Strasbourg and Luxemburg : constitutionalisation in action See ECHR: Factsheet - Data protection

Special points Combating terrorism Telephone tapping Secret services Bugging of a flat Files and access to data Medical data Employment context

Article 8 ECHR (A) Individual right (subjective right of natural persons) ECtHR rejects: Class action/actio popularis ECtHR rejects: Legal persons as claimants (B) Individual interest ECtHR rejects: In abstracto claims ECtHR rejects: A-priori cases ECtHR rejects: Hypothetical complaints ECtHR rejects: claims about minimal harm (De minimis rule) ECtHR rejects: claims about societal interests > only individual interests: autonomy, freedom, dignity (C) Balancing of interests ECtHR approaches privacy and societal interests as relative Those interests are balanced and wheighed in concrete cases (D) Focus on legal regulation First documents were mainly codes of conduct, with only marginal legal enforcement Now, there is an increased focus on legal regulation and sanctions

Big Data Massive amounts of data stored By citizens (smartphones), businesses (cookies) and states (covert surveillence) Use/goal only clear after processing Not targeted at specific individuals Data mostly aggregated – group profiles and statistical patterns Datasets shared, connected and harvested

Big Data Data protection rules Personal /sensitive data – anonimous/ metadata > move towards circular data streams Data minimisation > move towards maximum gathering of data Purpose limitation > move towards re-use/secondary use Safety and confidentiality > move towards sharing data and open data

Big Data 1. Individual right 2. Individual interest Unaware of potential violation Unable to claim right (in practical sense) To complicated to give a realistic form of consent 2. Individual interest Individual interest vague and abstract Societal interest at stake? 3. Balanced against each other Societal interests vague and abstract Absolute norms? 4. Legal regulation Terrorial problem/lack of shared values Societal interests > political realm

Privacy as societal interest Privacy is also a societal interest It is constitutive for Friendships Trust in the government and legitimacy of the state Democracy > secrecy of ballot The legal domain > confidentiality between lawyer and client Journalism > confidentiality sources and journalists Medical sector > confidentiality doctor and patient

Privacy as societal interest Anita Allen: ‘First, confidentiality encourages seeking medical care. Individuals will be more inclined to seek medical attention if they believe they can do so on a confidential basis. It is reassuring to believe others will not be told without permission that one is unwell or declining, has abused illegal drugs, been unfaithful to one ’s partner, obtained an abortion, or enlarged one ’s breasts. […] Second, confidentiality contributes to full and frank disclosures. Individuals seeking care will be more open and honest if they believe the facts and impressions reported to health providers will remain confidential. It may be easier to speak freely about embarrassing symptoms if one believes the content of what one says will not be broadcast to the world at large.’

Privacy as societal interest 1. Privacy should not only be regarded as an individual right: Duties of states and data controllers to protect the privacy Class actions by groups and civil society and enforcement by DPAs 2. Privacy should not only be about consequences for the citizen: Intentions and duties of care for state and data controllers Societal interests involved with privacy and data protection

Privacy as societal interest 3. Cases should not only be resolved by balancing interests: Instrinsic assessement of the quality of laws, policies and research proposals Absolute prohibitions on certain uses and practices 4. Privacy should not only be regulated through black letter law: focussing on guidelines, codes of conduct and soft law Regulation through reputation

The ECtHR’s approach to Big Data/mass surveillance The ECtHR leaves its own focus on individual rights and personal interests in order to be able to assess cases concerning mass suveillance under Article 8 ECHR: In those cases specifically it does accept: Hypothetical complaints: reasonable likelihood A-Priori cases: chilling effect In abstracto claims: the mere existence of a law Legal persons as claimants Class actions Societal interest And does not engage in a balancing of interests, but uses a mere legal test – is the mass surveillance program prescribed by law? (Quality of the law)

The ECtHR’s approach to Big Data/mass surveillance In these types of cases, what is at stake is: Not an individual right, but a general right Not an individual interest, but a general interest Not a balancing of interests, but a pure legal assessement

Is the Human Rights framework still fit for the Big Data era? Big Data Problems: exist at a general level, affect societal interests and are based on aggregated data, statistical correlations and group profiles and are used for general policies ↕ Human Rights: are formulated as subjective rights of natural persons to protect their individual interests/personal data/focus on indivdiual harm

End Questions