Extradition to non-EU countries: the limits imposed by EU citizenship

Steve Peers

One of the best-known EU laws created the European Arrest Warrant (EAW), which replaced the prior rules governing extradition between Member States. But on the other hand, in principle EU law has nothing to do with extradition to non-EU countries, except where the EU has agreed a treaty on this issue (as it has with the USA and Norway and Iceland), or as regards asylum-seekers (the EU’s asylum procedures law limits their extradition to their country of origin, because it’s necessary to determine first if the country which seeks to prosecute them is in fact persecuting them).

Yesterday’s CJEU judgment in Petruhhin altered this legal position. EU law does apply to such issues, and the Court clarified some relevant issues while leaving others open. Furthermore, the judgment raises the question of future UK/EU relations on extradition following Brexit.

Background

Extradition between the EU and non-EU countries is governed by a combination of national law and bilateral and multilateral treaties – most notably the Council of Europe Convention on Extradition, which has been ratified by all 47 European countries plus three non-EU countries. There are four further Protocols to this Convention, which have been ratified by fewer States.

A key feature of extradition law is that in principle most States will not extradite their own citizens, although within the EU, the EAW law has overruled any absolute ban on surrendering nationals as between Member States. While the refusal to extradite citizens could run a risk of impunity if those citizens commit criminal offences in another country, most States avoid that risk by extending their criminal jurisdiction to cover acts of their citizens committed outside their territory. In fact many EU laws and international treaties require States to assert such extraterritorial jurisdiction as regards specific transnational crimes.

The EAW law says a little about possible conflict between EAWs and extradition requests from third countries. It states simply that in the case of such a conflict, the national authority should decide which takes priority ‘with due consideration of all the circumstances’, including the relevant treaty and ‘the relative seriousness and place of the offences’, the relevant dates of the requests and whether the extradition request or EAW aims to obtain custody of a fugitive for trial or to serve a sentence already imposed.

This compares with the original proposal for the EAW law, which always gave priority to an EAW if the extradition request came from a country which was not party to the Council of Europe Convention. That clause was dropped following intensive lobbying from the US government, while the law was being negotiated in autumn 2001 (the EAW law was largely motivated by the 9/11 terrorist attacks, although it is not limited to terrorist offences).

Judgment

The Petruhhin case concerned an Estonian citizen sought by the Russian government for prosecution for organised crime offences. He was safe from extradition to Russia as long as he stayed in Estonia, since that country will not extradite its nationals outside the EU. But at one point he was arrested in Latvia, which decided to implement the Russian request. While Latvia also refuses to extradite its own citizens outside the EU, an Estonian citizen prima facie obviously cannot rely on that protection.

So Mr Petruhhin tried to rely on his transnational form of citizenship instead, arguing that since he was an EU citizen in another Member State, he was entitled to equal treatment with Latvians – therefore protecting him from extradition from Latvia to Russia, just like them. (Logically if his argument had worked, he would also be protected from extradition from any other Member State which refuses to extradite its own citizens to Russia).

The CJEU ruled first of all that the despite the absence of EU law on this issue, the dispute fell within the scope of EU free movement law, since Mr Petruhhin was exercising free movement rights. Therefore he had a right to equal treatment with nationals of Latvia in principle. However, a breach of that equality right could be justified on the grounds of avoiding impunity from prosecution for alleged criminal offences: Latvia, like most States, extends its criminal jurisdiction to cover acts of its own citizens abroad, but not the acts of citizens of other countries abroad. This distinction between the position of Latvians and citizens of other Member States can justify different treatment as regards protection from an extradition request.

Having said that, the Court added a crucial rider. To limit the effect of its ruling upon free movement rights (the proportionality principle), it ruled that Latvia has to contact the Estonian authorities first, to see if they wish to prosecute him there on the basis of their extraterritorial jurisdiction, before handing him over to Russia. That’s an important proviso, as many people believe they are more likely to be treated fairly in the courts of their own State. At any rate, this likely means they will have access to defence and court proceedings in their own language, with any pre-trial detention closer to friends and family.

Finally, the Court stated that any extradition to Russia was subject to the ban on torture or other inhuman or degrading treatment set out in Article 4 of the EU Charter of Fundamental Rights, which transposes the standards set out in Article 3 ECHR and the relevant case-law of the European Court of Human Rights on this issue. That means that if there’s a real risk of such treatment in Russia, the fugitive cannot be extradited there in any case. It should be noted that the Charter equally bans extradition to face the death penalty.

Comments

First of all, the Court was correct to assert the link between EU free movement law and extradition to third States, although its rather abstract reasoning could be improved upon. The best argument supporting this part of the ruling is rather that Mr Petruhhin would have been deterred from leaving Estonia for another Member State if he ran a risk of being extradited to Russia every time he left the country.

Next, would EU law also apply to cases where a Member State considers extraditing its own citizen to a non-EU country? The question may not arise often, since as noted already, many Member States don’t do this at all. But where they do, logically the case law on citizenship of the European Union (as distinct from free movement applies). As developed since the Zambrano judgment, this prevents citizens of their own Member State from being forced outside the EU in principle, as they are thereby deprived of EU citizenship. But logically the same limits apply by analogy: extradition of citizens can be justified on grounds of preventing immunity, but that is qualified if the extraditing State subjects its own citizens to prosecution for acts committed abroad (most do, as noted already).

Third, could there be other grounds justifying extradition to a non-EU state, besides preventing impunity? This isn’t clear from the judgment. But logically the judgment would apply by analogy to cases where a fugitive has already been sentenced to a term of imprisonment. In such cases, Latvia (say) would contact Estonia to see if the latter country could take over the punishment imposed by Russia, pursuant to the Council of Europe treaty on the transfer of prisoners or another relevant international treaty.

Could there be further grounds preventing extradition to a non-EU state, besides the Charter ban on the death penalty and torture et al, and the priority for EAWs? For instance, what if the person concerned has already been tried in a Member State, or in a third State? The EU has a cross-border ban on double jeopardy, but it only applies to Member States and Schengen associates, not to countries like Russia and the USA. Extradition treaties sometimes address this issue, but don’t always cover every double jeopardy scenario. A pending case before the CJEU should clarify this issue.

Next, logically the ruling would also apply by analogy if a third Member State could apply its jurisdiction: say an Estonian in Latvia was wanted by Russia but could potentially be prosecuted or serve a sentence in France, due to an [alleged] assault against a Russian citizen in France, or a French citizen in Russia. (Some countries assert criminal jurisdiction where one of their citizens was a victim of crime).

This brings us to the issue of conflict between an EAW and an extradition request from a non-EU state. The CJEU didn’t have to comment on this issue in its judgment, because no EAW had been issued yet. But the Court’s judgment necessarily means that there is more likely to be such a conflict in future, if Estonia indeed issues an EAW. And if that happens, the new judgment implies that the open-ended conflict rule in the EAW has to give way to the primary law of the Treaties: so the Estonian EAW has to take precedence over the Russian extradition request. The Court has in effect enshrined priority for EAWs over (almost) all non-EU extradition requests, whereas the original Commission proposal, as noted above, would have given such priority only over extradition requests from non-Council of Europe states. Perhaps the Americans should also have lobbied the Court of Justice.

But then, the USA has its own extradition deal already with the EU, as noted at the outset. (The deal with Norway and Iceland has not been ratified yet). The Court says several times in its judgment that the general rules it elaborates here are without prejudice to extradition treaties concluded between the EU and third countries. Presumably it can interpret the EU/USA treaty, since it can interpret any treaties which the EU signs with non-EU states. In fact, there’s a pending case before the CJEU which asks the Court to interpret this very treaty.

Brexit?

This judgment is probably relevant for Brexit. The UK government has recently hinted that it will seek some continuation of criminal law cooperation with the EU. There will be transitional issues with EAWs pending on Brexit Day, which the EU/UK withdrawal treaty concluded under Article 50 TEU will hopefully address. In fact there are already possible complications arising from Brexit in this area, as there are several challenges in Ireland to the execution of UK EAWs on the grounds that Brexit is coming. The CJEU may well be called on to address these issues even before Brexit Day.

For the position after Brexit, it’s undoubtedly possible for the EU to conclude an extradition arrangement with the UK, as the Court’s judgment actively encourages the EU to sign such treaties. In fact, the judgment might arguably be the basis of an argument for EU exclusive competence over extradition treaties with non-EU countries, on the basis that any Member State agreements would affect the operation of the EAW law, at least as regards EU citizens. That would mean that the UK could no longer sign extradition deals with individual EU countries, but only with the EU as a whole.

If no deal were reached, the UK and EU could fall back on the Council of Europe extradition Convention. But as I have noted before, this would mean far less extradition (and much slower extradition) as compared to the EAW.

If there were a UK/EU deal, Member States may still want to refuse to extradite their own citizens to the UK, as they have under the treaty with Norway and Iceland. But even if they are willing to extradite them to the UK, on whatever treaty basis, it may be arguable on the basis of the new judgment that they can’t, as long as the fugitive can be tried or serve her sentence in the remaining EU. And although the UK can still assist an EU Member State in prosecuting its own citizens, that will be far more expensive for the UK authorities than trying the person in the UK.

Barnard & Peers: chapter 25, chapter 27, chapter 13

JHA4: chapter II:3

Photo credit: www.theregister.co.uk

The Extraterritorial Reach of EU Animal Welfare Rules

By Jessica Lawrence, PhD student, VU University Amsterdam

In an interesting judgment in Zuchtvieh-Transport, the CJEU has ruled that Regulation 1/2005 on the protection of animals during transport applies outside of EU borders to transport taking place in third states, if that transport began on EU territory. This is a novel ruling that is expected to have important positive impacts on animal welfare. However, it can also be seen as an example of the CJEU’s tendency in recent years to read the EU’s jurisdiction expansively, stretching traditional international law notions of ‘territorial jurisdiction’ to permit the regulation of conduct taking place in third states.

Facts and Judgment

The case at hand concerns the refusal of Stadt Kempten, a municipality in Bavaria (Germany), to issue an export permit to animal transport company Zuchtvieh-Export. In 2012, Zuchtvieh-Export planned to transport 62 cattle from Kempten to Andijan (Uzbekistan), a journey of some 7000 km. The trip would take approximately 9 days, during which time only two 24-hour long rest stops were planned. During these rest stops, the cattle would be fed and watered, but not unloaded. Stadt Kempten refused customs clearance for the cattle because this schedule was not in accordance with the provisions of Regulation 1/2005, which sets EU standards for animal welfare during transport.

Zuchtvieh-Export objected to this decision, and filed a claim at the Bayerischer Verwaltungsgerichtshof (Higher Administrative Court, Bavaria). During its proceedings, that court asked the CJEU for a preliminary ruling on the question whether, with respect to animal transport involving a long journey that begins in the EU but ends far outside of its borders, Regulation 1/2005 applies only to the portion of the transport taking place within the EU, or also to those parts of the transport taking place outside of EU territory.

The CJEU came down firmly on the side of extraterritorial application, stating unambiguously that Regulation 1/2005 “does not subject the transport of animals with a point of departure within the territory of the European Union and a destination in a third country to any particular approval scheme, different from that applicable to transport taking place within the European Union” (para. 47). The only nod the Court makes to the limits of EU authority is the following:

“Should it nevertheless be the case that the law or administrative practice of a third country through which the transport will transit verifiably and definitely precludes full compliance with the technical rules of [Regulation 1/2005], the margin of discretion conferred on the competent authority of the place of departure empowers it to accept realistic planning for transport which, in the light inter alia of the means of transport used and the journey arrangements made, indicates that the planned transport will safeguard the welfare of the animals at a level equivalent to those technical rules.” (para. 54)

In finding that Regulation 1/2005 also applies to those parts of animal transport taking place outside of the EU, the Court went against the opinion of Advocate General Bot. The AG was indeed of the opinion that the scope of the Regulation was limited to the EU, and that applying it to transport outside of EU borders would essentially deputize the authorities of other countries, requiring them to “check to ensure compliance with the rules laid down by the regulation” (AG’s opinion, para. 54). As Advocate General Bot pointed out, this would be inconsistent with the rules regarding the transport of animals into the EU, according to which transit companies must meet EU animal welfare standards only once they enter EU territory (AG’s opinion, para. 82).

Comment

It is particularly interesting to see Zuchtvieh in light of the Court’s other recent case law on the extraterritorial application of EU rules. Traditionally speaking, international law frowns upon extraterritorial regulation, instead deferring to state sovereignty and its corollary, the principle of non-interference in the affairs of other states. Extraterritorial rules are thus only permissible where there is a solid jurisdictional reason for enacting them (for example, because the actors involved are nationals, or the behaviour abroad has domestic territorial effects). In recent years, however, the CJEU has seemed quite willing to use the ambiguity inherent in these jurisdictional terms to permit the application of EU rules that have legislative effects in third states. It has justified the application of such rules outside its borders using what Joanne Scott has helpfully termed “territorial extension”: the practice of using a (potentially quite limited) territorial connection with the EU to justify the regulation of conduct taking place in third states.

In the Air Transport Association case, for example, an association of American air transport companies challenged the EU’s decision to apply its carbon emissions trading scheme to emissions by non-EU planes that took place outside European territory, if those flights landed in the EU. The CJEU found that this was permissible, and should not be seen as violating the prohibition of extraterritorial regulation under customary international law. (ATA para. 157). In the Court’s view, the emissions trading scheme was not ‘extraterritorial’, because it was applied only at airports within EU jurisdiction—regardless of any effects on extraterritorial behaviour. For other examples of broad readings of regulatory jurisdiction by the CJEU, one might look to earlier cases such as Minin, Poulsen, and Ebony Maritime.

Similarly, in Zuchtvieh, the CJEU found that there was no extraterritorial regulation because the permit for transporting the animals in question was issued within the EU. While Advocate General Bot expressed his concern regarding the effects such an interpretation would have on the conduct of transporters and customs officials in third states, the CJEU clearly did not find these issues relevant to its determination.

The Zuchtvieh ruling is expected to have positive effects on animal welfare, improving conditions for the millions of animals transported from the EU to third states every year. In addition to these concrete effects, however, the judgment also demonstrates the increasing tendency of the CJEU to expand the permissible reach of EU legislation to conduct taking place on third state territory.

It remains to be seen whether this trend will continue, and at what point the CJEU will consider that the extraterritorial reach of EU law has reached its limit. One may indeed question the impact of this case on the so-called ‘external dimension’ of EU law, which is one of the key concerns nowadays for EU policy-makers. Is the EU entitled to export its rules/values/fundamental rights standards to other countries? At what point does ‘territorial extension’ become an illegal or illegitimate exercise of EU authority? EU ‘territorial extension’ definitely encounters quite some resistance from the international community. Despite the CJEU’s approval of the emissions trading scheme in Air Transport Association, for example, international backlash against the rule was so strong that the EU agreed to suspend its operation so long as international negotiations on a more global rule were underway. Although Zuchtvieh has thus far not generated a similar protest, it does change the standard international legal conversation about jurisdiction, pushing an expanded understanding of who can and should regulate the behaviour of cross-border economic activities.

Originally published on EU LAW BLOG

Barnard & Peers: chapter 24

Photo credit: www.ciwf.org.uk

Towards a Web 3.0? The impact of the Google Spain judgment on social networks and Wikipedia

Steve Peers

If its age could be measured in ‘Internet years’, the EU’s data protection Directive would be prehistoric. This can easily be demonstrated by comparison with the age of Facebook. The Directive was adopted seven years before the virtual panty raid on Harvard students’ privacy that ultimately launched Facebook. Indeed, when the Directive was adopted in 1995, Mark Zuckerberg was eleven years old, and attending primary school. He turns 30 today.

That’s a significant birthday – but is there anything in the Google Spain judgment that would ruin the party? This blog post looks in detail at the possible application of the judgment to two well-known features of the Internet: social networks and Wikipedia.

Long ago (in Internet years), the Internet shifted to a ‘Web 2.0’ model, dominated increasingly by user-generated content such as social networks and Wikipedia (along with blogs and many other forms of such content). The question I want to pose here is whether the Google Spain judgment could launch a ‘Web 3.0’: an Internet dominated by data subjects’ control of their personal data?

Applying the Google Spain judgment to social networks and Wikipedia

Material scope of EU law

First of all, the information placed on social networks and Wikipedia certainly constitutes personal data, at least as far as it concerns living natural persons. It’s an interesting question as to whether the legislation also applies to dead persons: this conjures up the image of the supporters and critics of (say) Ronald Reagan or Margaret Thatcher using data protection law to litigate over the reputation of their heroes (or villains). But the exclusion of legal persons means that data protection law cannot be a vehicle for companies (or other legal persons such as NGOs, political parties, charities or governments) to attempt to remove all traces of criticism of their actions.

As the CJEU has made clear several times, it isn’t relevant that the data was initially (or subsequently) made available elsewhere. This point is relevant to Wikipedia in particular, given the sources it links to for most of its information.  

Placing information on the Internet amounts to ‘data processing’, at least where it is available to the general public. This is particularly relevant to Wikipedia, but it’s also relevant to those social network profiles which are accessible to the outside world. In both cases, the personal data would also be accessible by means of search engines, which means that Google (or other search engines) would be separately liable for securing data protection rights under the conditions set out in the Google Spain judgment.

However, where a social network profile is genuinely closed to the outside world and made accessible only to persons selected by the data subject, the EU’s ‘Article 29’ working party on data protection (a body made up of national data protection supervisors, which gives non-binding advice on the application of EU data protection law) has suggested that the so-called ‘household exception’ in the Directive might apply. This would mean that, since the data could only be seen by a closed circle of (presumably) friends and family, the EU law wouldn’t apply at all. Obviously, though, that exception wouldn’t apply to any processing of the personal data in question by the company which established the social network itself, for direct marketing or other purposes.

Who is the ‘data controller’, ie the person with greater liability for application of EU data protection legislation, as regards social networks and Wikipedia? On this point, there is a clash between the nature of Web 2.0 and the putative Web 3.0, to the extent that the content of the personal data is generated by the users. In principle, each individual chooses how much personal data to place online and who has access to it, and similarly the editors of Wikipedia generate its content. The liability of the social network provider or Wikipedia might arise, however, to the extent that they alter the privacy settings, or could be regarded as controlling (as in Google Spain) the systematic presentation of the data to the outside world.  We can’t forget that in that judgment, the CJEU ruled that there has to be a ‘broad definition of the concept’ of a data controller.

Territorial scope

Back when the Internet was (in Internet years) a teenager, the CJEU ruled in Lindqvist that the special rules on external relations in the data protection Directive should not, by means of the nature of the Internet, become a general regime applicable to the entire world. But in Google Spain, the Court conversely was anxious to ensure that the general rules of the Directive were applicable to companies based outside the EU.

However, this doesn’t mean that all social networks, or Wikipedia, are necessarily subject to the Directive. They are certainly subject to it if they are in the same situation as Google: with a subsidiary in a Member State, which is selling advertising connected to the Internet-related activities of the parent body. But this is surely not the only scenario when the Directive applies to companies based outside the EU. As the CJEU said in Google Spain, the Directive has ‘a particularly broad territorial scope’ and the relevant rules ‘cannot be interpreted restrictively’. So while it is an oversimplification to say that the Directive applies to any entity ‘doing business in the EU’, it probably applies at least where there is a significant local activity (certainly in the form of a branch, possibly in the form of an agent or licensee) by the parent entity, that has some link to its Internet activities.

It is also still open to argue (since the Court did not address the issue) whether a parent company can be regarded as ‘established’ or using equipment on the territory due to its use of domain names, storage of data, and use of crawlers or robots on the territory, or whether the EU Charter of Fundamental Rights imposes broader criteria as regards the territorial scope of the rules.

Of course, there will be practical difficulties enforcing the Directive where a non-EU entity does not have assets in the EU. However, in such cases there might be possibilities to enforce the Directive’s rules by seeking to enforce a court ruling in a non-Member State, or more directly by means of obtaining an injunction to block access to the information which infringes data protection rules. Undoubtedly, such an injunction could be sought against Google, where the data is accessible by means of its search engine, and arguably (by analogy with copyright law) against an Internet service provider.

Personal scope

One interesting question which the Court did not have to deal with in Google Spain was the personal scope of data subjects. For instance, could a celebrity based in America, who finally gets tired of stories about her enormous backside, try to use EU data protection law to prevent access to such stories?

There is no requirement in the Directive that the data subject must be a national of a Member State, and/or domiciled in the EU. Nor do the rules on the territorial scope of the Directive mention this factor. So it must follow that non-EU citizens who are not resident in the EU can rely upon the Directive to assert their data protection rights within Member States. So in principle, at least, the supporters and detractors of Barack Obama or Vladimir Putin could bring their disputes, in the context of editing Wikipedia entries, to the courts and data protection supervisors of EU countries.

While this might sound absurd, in fact there are other reasons which would stand in the way of the application of EU data protection law to such disputes – to which we now turn.

Responsibility of data controllers

Data controllers must ensure that the data quality rules in the Directive are satisfied, and that data was processed in accordance with one of the legal grounds for processing.

On the latter point, one of the crucial factors in the Google Spain case was that Google could only rely (as regards its search engine) on its ‘legitimate [commercial] interest’ in processing personal data, in accordance with Article 7(f) of the Directive. The same provision refers to the interests of third parties, namely freedom of expression. However, the Court held that such interests were overridden by the data subject’s rights in that case, due to the huge invasion of his privacy due to the use of search engines.

Two issues arise here: the balancing test, and the grounds for processing. The first issue is particularly relevant for Wikipedia, since (like Google, as regards its search engine) it must rely on this balancing test in order to justify its processing of personal data, in the absence of other possible grounds to justify it.  

Applying the balancing test, the CJEU ruled on both Google’s interest and the public interest in freedom of expression. As regards Google, the Court stated that its ‘merely economic’ interests were outweighed by the data subject’s. This suggests that a non-profit body like Wikipedia would arguably have a greater claim to assert its interests than a profit-making entity.

As regards the public interest, the Court listed the factors to be considered as ‘the nature of the information’, its ‘sensitivity for the data subject’s private life’, and the public’s interest in the data, which could ‘vary, in particular’, on the data subject’s ‘role…in public life’. It should be recalled that the concept of ‘private life’ usually includes data concerning a person’s activity in public, but here the Court does suggest that there might be a distinction between public and private activities. So the balance tips in favour of freedom of expression the more that the person concerned is a public figure, and the more that the information concerns his or her public activities. So certainly Wikipedia could contain a record of public criticism of a politician; but the sordid details of his intern’s (postponed) dry-cleaning might possibly be another matter.

The crucial question here is whether the test can be regarded as severable: ie can it be argued that even if a person is a public figure, his or her public and private activities can be distinguished? In any event, his or her mistress or children are data subjects in their own right, so would have a data protection right to assert independently of the politician, and are unlikely to be public figures. But of course, some spurned mistresses are very keen indeed to waive their data protection rights.

But who is a public figure in the first place? Presumably the concept has an autonomous meaning in EU law, so it is not up to Wikipedia (or the persons concerned) to determine what it means by themselves. But surely the nature of Wikipedia is a significant factor to take into account when developing and applying such a definition.

As regards the nature of the personal data, what if the information in question reflects very badly upon the person concerned? The CJEU did not address this issue expressly in Google Spain. But it could be argued that it depends on the public interest in receiving that information. So while past financial difficulty does not raise a public interest issue, there is a better case for arguing (say) that a woman who has been groped by a particular car mechanic has every right to warn other women against him via means of social networks.

Another crucial element in the Google Spain judgment was the journalist exception in the Directive. It didn’t apply, because Google itself was not a journalist, and the Court disregarded the use that journalists make of search engines. But where content is user-generated, such as Wikipedia and on blogs, surely the exception must apply, given the Court’s broad approach to it in previous judgments such as Satamedia and Lindqvist. So in that case it could be argued that the exception should be applied in practice by the national courts. Indeed, perhaps the only reason why the CJEU undertook the task of applying the balancing test between privacy and freedom of expression itself in Google Spain was because the journalist exception did not apply.

As for the second issue, social networks will usually be able to point to other grounds justifying the processing of personal data: namely unambiguous consent, and necessity to perform a contract. This raises important questions of how to interpret these grounds for data processing, but these are clearly different issues not addressed at all by the Google Spain judgment.

That judgment would only be relevant as regards the processing of personal data about third parties in social networks, for instance a man ranting about his ex-girlfriend on his Facebook page. The way to resolve situations such as these is for social networks to adopt and apply robust privacy policies, but the Google Spain judgment can only be an indirect source of inspiration for such policies.  

The right to be forgotten

Finally, what of the ‘right to be forgotten’? The Court derived such an implicit right from the rules in the Directive on the relevance of data (one of the data quality principles), given that it might cease to be relevant over a long period of time.  While this can be seen as a positive right for data subjects, conversely it suggests that if information is accurate (and complies with all other rules in the Directive), there is not much of a right for a data subject to object to its dissemination as long as it is relatively fresh.

Conclusion

Is there good reason for Mark Zuckerberg's own knickers to be in a twist, following the Google Spain judgment? The CJEU does suggest that the territorial scope of the Directive is relatively broad, and as such is more likely to apply to social networks and other well-known Internet services than might otherwise have been thought. But it is not yet certain whether and when the Directive does apply to entities whose situation differs from Google’s. Equally the judgment confirms that the material scope of the Directive is broad, and it seems clear enough that its personal scope is broad too.

However, the judgment is unlikely to lead to a ‘Web 3.0’ as regards Internet services besides search engines, because there are basic differences in the substantive data protection law of the EU as it applies to the bodies offering such services. These differences concern in particular: the very nature of user-generated content (arguably changing who is the ‘data controller’); the existence of privacy or editing policies; the public figure exception; the possible application of different, additional grounds for processing personal data; and the Google Spain judgment itself – since it provides for an alternative, more effective means of blocking access to the personal data concerned.

Barnard & Peers: chapter 9