Steve Peers
There are many laws which exist
on paper, but cannot easily be enforced practically. One example is data
protection law, which relies largely for its enforcement on overworked data protection
authorities. Individual ‘data subjects’ whose data protection rights have been
infringed can sue the infringing companies directly, but they face a number of barriers
in this respect.
In particular, if they have not
suffered any direct economic loss, can they sue for non-economic loss? If not,
there is probably little point in bringing legal proceedings – and the
infringing company faces fewer constraints upon its breach of the law
concerned.
Of course, this issue is not unique
to data protection law. But this was the subject-matter of the important judgment
of the Court of Appeal in Vidal-Hall v
Google last week, which relied upon the EU Charter of Rights to strike down
UK legislation which limited the ability to sue for non-economic losses as
regards EU data protection law. This ruling could have broad implications not only on the enforcement of data protection rights, but also other rights protected by EU law.
Judgment
The case concerned allegations
that Google had infringed the data protection rights of users of Apple’s Safari
browser, by getting around protections against tracking which were intended to
prevent Google from collecting information on those users’ behaviour online. American
litigation on the same issue had foundered due to the inability of plaintiffs
to obtain damages for non-economic losses under American law, although Google
had reached a settlement with federal and state regulators which entailed
payment of a large penalty.
As regards UK/EU law, the Court
of Appeal had to address four issues: (a) is there a tort of ‘misuse of private
information’; (b) whether it was possible to sue for non-economic damage; (c)
whether the information involved was ‘personal data’ for the purposes of data
protection law; and (d) whether there was an arguable case in tort and data
protection law. The Court decided all four issues in favour of the plaintiffs,
but that does not mean they have won the case yet: at this stage, the Court of
Appeal was only deciding whether documents could be served on Google in the
first place.
Remedies for breach of EU law
This judgment raises many
important questions of privacy rights and data protection law, and
substantially advances the enforcement of those rights and that law in the UK. There
are excellent discussions of these finer points already by Jon Baines, Christopher Knight and Alexander Hanff. My focus here is on the broader importance of this judgment for the
enforcement of EU law rights.
The starting point in this case
is the EU’s data protection Directive, which provides that any person
who has suffered damage due to breach of the Directive can receive compensation
from the data controller for that breach. The UK Data Protection Act implements
that rule by providing (in s. 13) for separate claims for damages and distress,
imposing conditions (a link to damages, or data processing for special
purposes) upon any claim for distress. UK courts have interpreted s. 13 of the
Act to mean that ‘damages’ can only refer to economic loss, with non-economic
loss subject to the more restrictive rules relating to ‘distress’.
However, the Court of Appeal
ruled that the rule in the EU Directive had a wider meaning, covering both
economic and non-economic loss, basing itself on CJEU case law relating to the
EU’s package holidays Directive. It based this argument on its interpretation of
the aim of the Directive (protecting privacy rights), read alongside the right
to privacy in Article 8 ECHR and the data protection rights in Article 7 of the
EU Charter of Fundamental Rights.
But what were the consequences of
this finding? First of all, the Court of Appeal rejected the possibility of using
the CJEU’s principle of indirect effect, set out in case law since Marleasing, to strike down s. 13(2) of
the UK Act. This is undoubtedly correct:
CJEU case law makes clear that the principle of indirect effect is a rule of interpretation, requiring national
courts to stretch the interpretation of national law on the books as far as
possible to ensure that it implements EU law correctly. That principle reaches
its limits when national law cannot be interpreted consistently with EU law, as
the Court of Appeal determined in this case.
So the Court of Appeal rightly
relied instead on Articles 7 and 8 of the Charter (privacy and data protection
rights), applying Article 47 of the Charter (the right to a fair trial and
effective remedy) to strike down national law, just as it had recently done in Benkharbouche (discussed here).
That case involved a claim for employment law rights against foreign embassies,
and the Court struck down the relevant provisions of the State Immunity Act to allow the suit to continue (insofar as the
claims were based on EU law). The Court of Appeal did limit the impact of
Article 47 of the Charter by confirming that it could not be used to strike
down legislation where that would involve the courts rewriting a legislative
scheme and making complex choices that should be left to the legislature to
make. But that was not the case here.
As in Benkharbouche, this judgment offers confirmation of the significant
possibilities of using the Charter in human rights litigation. Unlike the prior
judgment, it was not necessary in Vidal-Hall
to distinguish between claims linked to EU law (where the Charter applies) and
claims not connected to EU law (where the Charter does not apply), because all
of the claims in this case are linked to EU law. The crucial relevance of that
distinction is that the Charter can be used to disapply Acts of Parliament,
whereas the Human Rights Act cannot. (Moreover,
any UK court can disapply an act of Parliament conflicting with the Charter,
whereas only the higher courts can issue declarations of incompatibility with the
Human Rights Act).
It is clear from Vidal-Hall that Article 47 can be used
not just to strike down Acts of Parliament that confer immunity upon defendants,
but also to strike down rules that limit heads of damage that can be recovered.
It follows that many other types of restrictions on remedies could be
challenged: other forms of standing rules, time limits and restrictions on
legal aid, for instance. It is also clear that the ‘complex legislative scheme’
exception should not be interpreted widely: plaintiffs should target their challenges
to Acts of Parliament against very precise and specific limitations in order to
ensure that the exception does not apply.
The existence of this exception
does mean, however, that it might be significantly more difficult to use
Article 47 to ask the courts to create an entirely new remedy for breach of EU
law, because the counter-argument would be that the creation of new remedies is
a complex issue best left to Parliament. On the other hand, plaintiffs in such
cases could also argue that the common
law should develop to create new forms of remedy to ensure effective protection
of Charter rights, just as tort law relating to privacy rights was clarified in
Vidal-Hall.
It should be noted here that the Vidal-Hall litigation concerns the
application of a Directive between private parties. The judgment thus clearly
demonstrates the importance of the Charter in overcoming the traditional
restriction on applying Directives against private parties, where national law
is incompatible with the Directives (ie, the lack of ‘horizontal direct effect’
of Directives). The alternative option of bringing a Francovich damages action against the state for its breach of EU law is not even discussed here.
Obviously it will always be simpler and cheaper for the plaintiffs to follow
the direct route of disapplying the Act of Parliament in the main litigation, as
compared to having to bring an action against the State instead – especially in
cases like Vidal-Hall, where the
merits of the case have not even been tried yet.
Furthermore, it should be
emphasised that the court was applying Article 47 of the Charter to disapply UK
law, not Articles 7 and 8 of the Charter, which set out the substantive rights
to privacy and data protection. That is an important distinction because
according to last year’s CJEU ruling in AMS
(discussed here), not all Charter rights can be enforced by setting
aside national law. The CJEU has yet to rule on whether Articles 7 and 8 can be
enforced by this route (it dodged this bullet in Satamedia), but it will be hard to avoid it forever.
Finally, what other areas of EU
law could this judgment be relevant to? A lot of EU law concerns economic
damages in any event (cf the case law on private damages for breach of EU
competition law). Even consumer law is largely about economic loss, too: the package
holiday judgment referred to by the Court of Appeal is an exception, because in
the case of holidays, consumers’ distress arises from being unable to spend their money on holiday as they had
planned.
There is at least one obvious other
area of EU law where this judgment may also be relevant: the free movement of
EU citizens. It is possible to claim for economic loss in such cases, for instance
where a person has lost his job as a result of breach of EU free movement law
(see the discussion of a recent Irish judgment here). However, often the
loss is purely personal: the inability to spend time with a spouse and
children. There may also be some economic costs (due to the need to travel to visit
a family member, or a job which is lost or cannot be applied for due to
breaches of free movement law), but the inherent loss of family life is surely
highly significant too. Moreover, the root human right being protected in such
cases is in part the same right as that being protected in Vidal-Hall: the right to private and family life (Article 7 of the
Charter, Article 8 ECHR). The next UK
government should ensure full compliance with the law on ‘Surinder Singh’ cases
(as discussed here), if it does not wish to expose taxpayers to
considerable liability.
Barnard & Peers: chapter 6,
chapter 9
No comments:
Post a Comment