Wednesday 29 April 2020

Data protection, the death penalty and mutual legal assistance in criminal law: Elgizouli v Secretary of State for the Home Department [2020] UKSC 10






Lorna Woods, Professor of Internet Law, University of Essex

Introduction

Elgizouli is the first UK Supreme Court judgment on the Data Protection Act 2018 (DPA).  The headline news is that ‘substantial compliance’ with the requirements set down in the Act is insufficient to make data transfers to third countries lawful. The judgment concerns Part Three, which implements the Law Enforcement Directive (Directive (EU) 2016/680) and focusses on procedural protections, but in terms of approach may have implications for the UK courts’ approach to the DPA and General Data Protection Regulation (GDPR) more generally, especially as it relates to the protection of individual rights found in the European Court of Human Rights (ECHR).

Facts

Eligizouli’s son was implicated in the murder in Syria of UK and UK citizens. As part of its investigations into the group responsible for the murders, the US made a mutual legal assistance (MLA) request to the UK, asking for information to be transferred. Theresa May, as Home Secretary, requested that the information would not be used either directly or indirectly in a prosecution that could lead to the imposition of the death penalty, an assurance the US did not give. Nonetheless, Sajid Javid, a subsequent Home Secretary, agreed to provide the information.

Eligizouli brought an action for judicial review, raising two questions: (1) whether the common law precluded the Secretary of State from exercising his or her powers in this way; and (2) whether such a transfer was lawful under the DPA understood in the light of EU law.  Specifically, the appellant argued that the Home Secretary’s decision was an unlawful breach of:

1)      the first data protection principle in section 35 of the Act;
2)      the second data protection principle in section 36;
3)      the provisions governing international transfers of personal data for law enforcement purposes in sections 73 to 76; and
4)      the special processing restrictions in section 80.

It was further argued that the Home Secretary had paid no regard to the duties imposed on him by the DPA. At first instance, the Divisional Court had held that the Home Secretary had demonstrated “substantial compliance” with the Act and that “special circumstances” could be relied on in relation to the transfer.

Judgment

The Supreme Court (by a majority) found that the common law had not evolved to a point where it recognised a principle prohibiting the provision of MLA that would facilitate the death penalty.  The Court was, however, unanimous in holding that the Home Secretary’s decision was unlawful under the DPA, specifically as regards the conditions under which data can be transferred to another jurisdiction and the leading judgment was given by Lord Kerr (although he was in  the minority on the common law point). Lady Hale’s judgment constitutes, in her words, a ‘short guide to the judgments’ [2].

There was agreement between all parties that Part 3 was in issue – that is, that there would be processing of personal data for a “law enforcement purpose” by a controller which is also a “competent authority” for the purposes of the Part 3 of the DPA.  It was also common ground that the Home Secretary did not expressly consider his duties under the DPA.

The main focus of the judgment was the conditions surrounding the transfer of the data to the US; the relevant provisions are found in ss. 73-76. Specifically, data cannot be transferred unless the three conditions in s 73(1)(a) are met. The first, in s. 73(2), is that “the transfer is necessary for any of the law enforcement purposes”. Section 73(3) contains the second condition. It lists three circumstances in which a transfer may take place:

1)      when it is based on an adequacy decision (simplifying data transfers) as set out in s. 74;
2)      if there is no such adequacy decision, then there are appropriate safeguards in accordance with s. 75; or
3)      if neither (1) nor (2) apply, is based on special circumstances in accordance with s. 76.

The third condition relates to the recipient of the information. 

The Court was agreed that the Home Secretary’s decision was not based on an adequacy decision, nor were there appropriate safeguards in the sense of s. 75. As Lady Hale remarked, “[t]his transfer was not based on an adequacy decision or on there being appropriate safeguards, because there were none” [10]. The issue of whether the decision was lawful would therefore depend on whether special circumstances existed; the Court did not consider whether special circumstances could only be relied on if neither of the other two categories apply. Section 76(1) specifies that special circumstances will apply if the transfer is necessary for one of five listed purposes:

1)      to protect the vital interests of the data subject or another person;
2)      to safeguard the legitimate interests of the data subject;
3)      for the prevention of an immediate and serious threat to the public security of a member State or a third country;
4)      in individual cases for any of the law enforcement purposes, or
5)      in individual cases for a legal purpose.

Section 31 DPA defines the law enforcement purposes. It would seem that s. 76(1)(d) and (e) are relevant here, but they are subject to a further control. Section 76(2) specifies they “do not apply if the controller determines that fundamental rights and freedoms of the data subject override the public interest in the transfer”. Further, according to s 76(3), the transfer must in all cases be documented.

Special circumstances, according to the Court, requires a specific assessment of whether these conditions are satisfied. The Court stated that the purpose of section 73 was to “set out a structured framework for decision-making, with appropriate documentation” [219] and, as the ICO submitted, requires:

 ‘conscious and contemporaneous’ consideration of the statutory tests prior to any transfer taking place. Further, the record-keeping requirement, including the requirement to set out the ‘justification for the transfer’ … cannot sensibly be read as requiring no more than ex post cosideration of whether a transfer was justified [218].

This was lacking here and the fact that the Home Secretary did not have regard to his duties as data controller meant that the special circumstances basis for transfer was not available [158]. Lord Carnwath sugggested here that the decision was based on political expediency rather than strict necessity as required by the statute [227] – Lord Kerr took a similar view.

There was a further question about impact of ‘fundamental rights and freedoms’ in s 76(2) – this per Lady Hale includes right to life in Art 2 ECHR. She argued, albeit obiter dicta, that this points towards an interpretation of s 76(2) so as to preclude a transfer of personal data to facilitate a prosecution which could result in the death penalty [26]. Lord Carnwath states that a failure to consider the point is a further reason that the Home Secretary’s decision cannot stand [228]; Lord Hodge sees the force of this point but as it was not fully argued reserves his position.

Lord Kerr took a different view, arguing that the processing (ie through the transfer of data as part of the MLA) was not lawful and fair – ie did not comply with the data protection principles in s. 34 DPA. He came to this conclusion because he, alone out of the judges, had taken the view that the common law would prevent the Home Secretary from acting in this way.

Comment

On one level the judgment could be seen as narrow; providing protection only through procedural mechanisms, leaving the Home Secretary free to make the same decision again, having directed her mind to the issues. Similarly, in its approach to the common law and the need for incremental development, the court is showing deference to the primacy of the legislature (see paras 170 and 233), especially in the context of the exercise of prerogative powers.  However, in its interpretation of the DPA and more particularly in the way it approached how the provisions should be interpreted, the judgment has a broader significance.  Indeed, its approach is in marked contrast to that of the lower courts, which may now change direction.

The Supreme Court here is emphasising the importance of data controllers actively engaging with the requirements imposed by the DPA; here the concerns stemmed from the fact that the Home Secretary “did not address his mind to the 2018 Act at all” [6]. So it seems that to be able to use any of the gateways in s. 73, consideration must be given to the protections in place, whatever the mechanism used. In terms of both the gateway based on appropriate safeguards and that which requires special circumstances, Lord Carnwath makes an important distinction between a decision which takes factors into account and one which is based on there being appropriate safeguards or special circumstances [219]. This distinction operates to raise the threshold of the standards required. The Supreme Court did not address the question of whether the three gateways operate in a hierarchy; that is each must be considered and discounted before moving on to the next. This would, as the respondents argued, place an additional burden on them.

The Supreme Court also confirmed the approach to understanding ‘necessary’ in s. 76(1) regarding the objectives in relation to which special circumstances may arise, which should be understood in the light of recital 72 to the LED. While the Divisional Court had used recital 72 to try to justify seeing this particular case as not being problematic (the recital gives the example of mass surveillance), The Supreme Court emphasises that any transfer must be ‘strictly necessary’ (rather than ‘necessary’ as in the DPA). Lady Hale referred to the judgment of Warby J in Guriev v Community Safety Development (UK) Ltd ([2016] EWHC 643 (QB)) who said

The test of necessity is a strict one, requiring any interference with the subject’s rights to be proportionate to the gravity of the threat to the public interest” (para 45)

While this may leave questions about the meaning of necessary and proportionality and their relationship to one another (a common question), it is clear that the scope of s. 76 is to be narrowly interpreted – as indeed is the general approach under EU law to derogations – and that the proportionality of the transfer must be considered.

Lady Hale’s obiter views on s 76(2) DPA (which the rest of the Court accepted had force) also indicate that the Supreme Court is taking a strict approach to compliance here.  Her argument accepts that even if a transfer is necessary and proportionate it may still be overridden by the rights of the data subject – as found in a range of instruments, including the ECHR. These rights are not limited to data protection and privacy rights but include any of the rights so protected. Lady Hale expressly identifies the right to life (Art 2 ECHR). This means that the protection awarded is not just procedural but could include an assessment of the substance of the rights. Significantly, she made the point that fundamental rights are protected whatever the person’s nationality or place of residence and, implicitly, that these protections may have an extraterritorial effect. That is, they protect not just the rights of data subjects who remain within the jurisdiction once their data are transferred but possibly also those data subjects who are outside the jurisdiction when their data are transferred by a controller within the jurisdiction.

The judgment is clearly important for the transfer of data under the LED, but the provisions on data transfer in that context bear some similarity to the structure to that of Art 49 GDPR dealing with transfers in specific situations. It is not hard to imagine that a similar analytical methodology could be applied by the British courts if confronted with such a case.

The final question is what impact, if any, might this decision have on the possibility of a data protection adequacy decision for the UK from the EU Commission after Brexit (which would simplify the transfer of data from the EU to the UK). On the one hand, this shows that the administration got things very wrong, which might count against an adequacy decision; conversely, the approach of the Supreme Court might provide reassurance that there is effective oversight of data protection rights by independent courts in the UK. It could then come down to how the Government reacts to the Supreme Court’s judgment.

Photo credit: David Iliff, via Wikicommons

Thursday 16 April 2020

A ‘new course’ of the Bundesverfassungsgericht in the context of constitutional complaints: the balancing of conflicting rights and the application of Union law




Lucia Serena Rossi, Judge at the Court of Justice of the European Union*

* The views included in this article are strictly personal and not attributable to the Court.
** The original version of this article (in Italian) ‘Il “nuovo corso” del Bundesverfassungsgeright nei ricorsi diretti di constituzionalità: bilanciamento fra diritti confliggenti e applicazione del diritto dell’Unione’ was published on Federalismi.it on 5 February 2020, ISSN 1826-3534.

Table of contents:
1. The complex ‘pluri-focal’ balancing between conflicting fundamental rights in the EU multilevel system.
2. The balancing in situations not entirely governed by Union law.
3. The balancing in situations wholly governed by Union law.
4. Not all those who wander are lost...


1.      The complex ‘pluri-focal’ balancing between conflicting fundamental rights in the EU multilevel system

On 6 November 2019 the first Senate of the German Constitutional Court (Bundesverfassungsgericht, hereinafter, ‘First Senate’ or ‘BVerfG’) issued two important orders following  constitutional complaints (Verfassungsbeschwerden) concerning the right to be forgotten. The two pronouncements should be read jointly and one in the light of the other. They lay down a new theory of interaction between the systems of fundamental rights protection guaranteed, on the one hand, by the national constitutional order, and, on the other hand, by the order of the European Union. They also offer new guidance on the role of the relevant judiciaries, with specific reference to the BVerfG, in the control over the application of the Charter of Fundamental Rights of the European Union (hereinafter, ‘Charter’ or ‘CFR’).

In the cases at hand, unlike the facts of the Taricco judgment of the Court of Justice (CJEU) or of the judgment 269/17 of the Italian Constitutional Court, the matters concern horizontal situations, requesting first of all to balance the rights of two individuals (i.e. an entity who indexes or disseminates information online, and an individual invoking the right to be forgotten, in the form of deindexing of information from Google). However, as we shall see, in these cases the act of balancing is particularly complex, because it must take into account the interests and rights not only of these two parties, but also of others, in particular, the freedom of expression of those who created the information and the interest of the public to receive information. In these instances, the balancing of the rights has a pluri-focal nature: Courts must in fact examine, in order to make a choice, a plurality of rights and interests, hierarchically equivalent in abstracto, within the same legal order.

The task of the judge is even more complex when this balancing should be conducted in a multi-level system of protection, such as the EU. Indeed, the interactions existing between Union law and the constitutional systems of the EU Member States significantly influence the activities of courts. What is at stake in these circumstances, and what makes such balancing highly complex, it is not a conflict between a Union law and a constitutional right, where, as established in the Melloni case, conflicts between Union law and national constitutional rights can be resolved using the parameters of primacy and harmonisation. Rather, the problem arises as to how to identify which of the various rights recognized and guaranteed by the EU and national systems (as well as by the ECHR) to different individuals should prevail.

By taking into account the values of the respective legal orders, judges pertaining to different systems could reach divergent interpretations of the ‘bundle’ of rights at stake. As a result, ‘conflicts of balancing’ may arise, and the same right could be applied differently under national or Union law. The complexity of the interplay between legal orders therefore requires a coordination of the relevant systems of protection.

The two German constitutional orders introduce a sort of actio finium regundorum, both regarding the competent judge and the applicable standards of protection - at least with reference to the constitutional complaint action. This article will summarise and analyse the theory outlined in these orders in the light of Union law.

2.      The balancing in situations not entirely governed by Union law

The first order concerned an individual who had committed a crime in 1981. Due to Google’s indexing, and following the online publication by the newspaper Der Spiegel’s archives, the name of the applicant was associated primarily with that crime on the internet. Invoking the right to be forgotten, and thus asking for the deindexing of that news from the research engine, the applicant challenged before the BVerfG the unfavourable judgment issued by the German Supreme Court (Bundesgerichthof).

The First Senate recalls that the so-called ‘media privilege’ is a matter which has not been completely determined (nicht vollständig determiniert) by Union law, notably, under Article 9 of directive 95/46 (the data protection Directive) and Article 85(2) of the General Data Protection Regulation (GDPR). Both pieces of legislation explicitly grant deference to the Member States to provide exemptions or derogations ‘necessary to reconcile the right to privacy with the rules on freedom of expression’. These derogations would also apply in relation to the treatment of personal data that is carried out exclusively for journalistic purposes or for artistic or literary expression. The First Senate further recalls that, despite such balancing is mandated to the Member States by Union law, the Court of Justice held that the question of how to reconcile the fundamental right to privacy and the freedom of expression falls within the competence of the Member States.

The German Federal Court further states that, in the absence of complete guidance by Union law, the fact that fundamental rights protection systems may vary within the Member States constitutes a ‘structural principle’ (Strukturprinzip) of the European Union. Moreover, the First Senate suggests anchoring the aforementioned principle also to Article 53 of the Charter, which refers to the possibility of (inter alia) national constitutions giving a higher level of human rights protection than the Charter – within their scope of application. Reliance on this provision by the BVerfG would ensure, in line with the CJEU’s case law, that conflicts of fundamental rights may, in principle, be resolved on the basis of the respective fundamental rights protection systems of the Member States.

According to the First Senate, this interpretation of the division of competences between the EU and the Member States is confirmed both by the principle of subsidiarity, referred to in Article 51(1) CFR, the Preambles of the Treaty on European Union and of the same Charter, which both recognize the diversity of cultures and traditions of the Member States. The First Senate further states that the Union legislature, by adopting rules that regulate to different extents a subject-matter, also defines the framework for the application of the fundamental rights of the Member States ‘in a federal balance’ (in einer föderativen Balance). This framework is therefore based on politically responsible decisions, subject to full compliance with the principle of subsidiarity.

Consequently, in an area not entirely regulated by Union law, fundamental rights are mainly governed by the German Constitution, even when domestic law implements Union law. A twofold assumption may arise with regards to the conclusion of the First Senate: first, EU law is intended to leave discretion to Member States as to the protection of rights; second, the German protection regime is also supposed to fulfil the standard prescribed by Union law, as interpreted by the Court of Justice. Furthermore, both the Federal Constitution and Union law share the minimum standard offered by the ECHR. According to the First Senate, a further assessment of the adequacy of the protection based on Union law becomes necessary only when there are sufficient and specific indications that the level of protection ensured by the Grundgesetz (the German Basic Law) is insufficient.

The First Senate observes that, even if the fundamental rights provided for by the national Constitution must be interpreted in the light of the Charter of the Union, and both these instruments in the light of the ECHR, divergent interpretations may arise. Therefore, the choice of the prevailing standard must be sought case by case, also with reference to the context. In the absence of a complete guidance by Union law, although the German Constitution is, as a general rule, the only applicable standard, the First Senate recognizes that exceptions to this rule may arise. Exceptions to the applicability of the German Constitutions apply whenever Union law leaves a margin of discretion to national systems and provides, beyond a substantial consonance (substantielle Gleichklang), higher standards.

The First Senate seems nevertheless to limit the scope of the Charter, and, in particular, the relationship between the latter and secondary Union law. It acknowledges that the Charter contributes to reconcile the different visions that Member States have in relation to fundamental rights, in due consideration of the historical and social context of each of them. According to the judgment, it is also evident, however, that the Charter does not intend - and cannot - totally uniform either national protection systems or the balancing between conflicting rights. Therefore, any indications that Union laws, while leaving some discretion to States, require higher protection standards than the national ones, shall result explicitly from the wording and the context of these rules. The general obligation that Union acts should respect the Charter of Fundamental Rights would thus not be in itself sufficient to establish more rigorous standards than the national ones.

One may wonder if this dictum involves an inversion of the ‘Solange theorem’, according to which it must be assumed that national law meets the minimum standard – and, therefore, respects EU law primacy – so long as the national level of protection is proved to be adequate under Union law standards. The German Court acknowledges that the presumption of the suitability of the Grundgesetz to ensure the level of protection provided by the Charter is a presumption iuris tantum, which can be reversed if the Court of Justice claims that the national standard is insufficient for ensuring the protection required by Union law. However, the BVerfG highlights that it will refer to the Court of Justice (exclusively) in case of doubts relating to the standard prescribed by the Union; where, instead, it considers that such doubts do not exist, it will proceed directly to incorporate the Union standard into the national ones and to apply it.

In addition, the First Senate specifies that it does not wish to question the direct effects of the Charter when applicable pursuant to Article 51 thereof. The Court further explains that German ordinary judges remain entitled to directly apply the Charter, or refer to the CJEU for its interpretation, although they are also required to apply the Grundsgesetz whenever Union law leaves the Members States a margin of discretion. This statement seems to safeguard the Max-Planck jurisprudence (discussed here), according to which some provisions of the Charter (yet, not directives) may have horizontal direct effects. 

In the theory formulated by the German Constitutional Court, the room for manoeuvre left to the national standards depends, in inverse proportion, on the degree of harmonisation of the standards that Union rules (be they regulations or directives) specifically aim to guarantee. The German Court nevertheless is respectful of the dynamic nature of the harmonisation process carried out by the European Union and, consequently, of the expansion of the scope of the Charter of Fundamental Rights.

In the light of these considerations, the German Constitutional Court notes that in the case at hand only the national constitutional parameter applies, given that, as regards the so-called media privilege, Directive 95/46 and the GDPR expressly leave a margin of discretion to the Member States.

The First Senate subsequently proceeds to balance the various rights in conflict. It observes that the right to be forgotten, falling within the rights of the personality, does not result in a total ‘informational self-determination’ (informationelle Selbstbestimmung), that is an exclusive right to decide what should be removed from the Internet. Such self-determination would conflict with rights of other people and therefore ‘horizontal’ indirect effects must be assessed. In the case at hand, even if the freedom of expression and of the press appears to carry less weight, as the case involved simple online dissemination of content, it is still necessary to consider the interest of the public to receive information. 

On the one hand, the Federal Court states that the right to informative self-determination must be distinguished from general personal rights. While individuals should have the right to influence the context and the way in which their data are made accessible and used by others, they do not enjoy an unrestricted right to filter publicly available information on the basis of their choices and ideologies, nor they can limit that information to aspects of their personal image that they consider appropriate.

On the other hand, the First Senate notes that the profiling of an individual resulting from the indexing of Internet content related to him is liable to portrait that individual. In particular, such profiling influences the way that individual interacts in the context of his social relationships. Specifically, everyone has the right to change and evolve, without being continually associated with the mistakes he made in the past. (The BVerfG cites the judgments of the Court of Justice in this regard of 13 May 2014, Google Spain and Google, C-131/12, EU: C: 2014: 317, para 98 – discussed here – and of 9 March 2017, Manni, C-398/15, EU: C: 2017: 197, para 77.) In this regard, it also underlines the importance of some factors, which must be considered on a case by case basis and whose importance has been stressed also in the CJEU’s case law, such as the length of time elapsed between the events and data reported in the news and the deindexing request, or the fact that the information had been legally disclosed or not. It is the view of the Court that the law must prevent that past views, statements and actions are made available to the public without any restrictions.

To deal with these conflicting objectives, the First Senate states that it is necessary, on the one hand, to ensure access to data by the public, and, on the other hand, to limit the harmful effects on the concerned person's public image. The Court thus concludes that the challenged judgment did not adequately balance all the outlined factors, and upholds the constitutional complaint.

3.      The balancing in situations wholly governed by Union law

The second order involved a judgment of the Court of Appeal (Oberlandsgericht) of Celle refusing to impose a deindexing obligation on Google in relation to the transcription of a television interview. The request of deindexing was submitted by the interviewee, who had been accused of unfair employment practices. That interview had been broadcast online. Unlike the case examined above, the matter falls entirely within the scope of the directive 95/46 and GDPR, which have completely unified the matter of the right to be forgotten (vollständig vereinheitlicht). (As to Directive 95/46, the right to erasure of personal data (so-called right to be forgotten) can be inferred from the combined provisions of articles 12(b) and 14(1)(a) as interpreted by the Court of Justice with the judgment of 13 May 2014, Google Spain and Google, C-131/12, EU: C: 2014: 317; in the case of the GDPR, however, the right to be forgotten is expressly provided for in Article 17, which codifies the jurisprudence of the Court of Justice.) Furthermore, the exceptions provided for the media privilege by Article 9 of the directive are not applicable. Therefore, Member States have no margin of discretion in this respect.

The First Senate holds that, since the matter is regulated exhaustively by Union law, having introduced a complete standardisation of the laws of the Member States, the Union system of protection of rights enjoys a ‘primacy in the application’ (Anwendungsvorrang) compared to the German Constitution.

The Court provides a twofold clarification in this regard. On the one hand, the primacy of Union law derives from the transfer of sovereign powers from the Member States to the European Union. Thus, in the presence of a Union discipline of a certain subject, also the protection of fundamental rights must follow European uniform standards, as deriving from Union law - in particular from the Charter - and from the ECHR, constituting the common minimum basis of protection of fundamental rights in the EU. On the other hand, nevertheless, the First Senate recalls that the recognition of Union law primacy is subject to the condition that the protection guaranteed thereunder is sufficiently effective, although according to the consolidated jurisprudence of the same BVerfG, the Union standards are presumed to equate those of the Grundgesetz. (Since the judgment of 22 October 1986 - 2 BVR 197/83 (so-called Solange II), the BVerfG has ackowledged the primacy of EU law - and therefore the inadmissibility of a constitutional complaint brought against an act adopted by the Community - so long as the protection of fundamental rights at European level has been adequate. In the subsequent case law, starting from the judgment of 12 October 1993 - 2 BvR 2134, 2159/92, on the Treaty of Maastricht, the BVerfG has identified two instruments by which to ascertain this adequacy: the so-called identity review and the ultra vires reviews, both based on Article 79, par. 3 GG and exercised in accordance with the principle of openness to EU law (Europarechtsfreundlichkeit). This case law enables the BVerfG to verify whether the EU acts have been adopted in manifest and structural violation of the limits to Union jurisdiction deriving from the principle of attribution or whether they violate the essential core of the national constitutional identity; for a summary of these principles, see the ordinance of 24 January 2014 - 2 BvR 2728/13, paras 22-30.)

As long as the fundamental rights of the German constitution are replaced by the ‘primacy of the application’ of Union law, the Federal Constitutional Court controls the application of Union rights by German authorities, in the light of the ECJ case law and Charter of Fundamental rights. In an unexpected and explicit way, the First Senate thus affirms its competence to carry such balancing itself, checking that the national authorities respect Union fundamental rights when enforcing Union law.

The ‘new course’ of the fundamental rights’ protection system in Germany is more evident in this order than in the other one. In its previous jurisprudence, the BVerfG had never chosen to apply Union parameters directly, leaving that task to the German ordinary judges who cooperated with the Court of Justice through the instrument of preliminary ruling procedure. The main novelty introduced by the second order is that the Federal Court will no more refrain from exerting its full scrutiny in the assessment of the compliance by national authorities and courts with Union fundamental rights in areas fully regulated under Union law. This assessment will be carried in full collaboration with the Court of Justice pursuant to Article 267(3) TFEU. The ground of this new reasoning is that Article 23(1) of the German Constitution and the ‘principle of openness’ established therein must not be interpreted as imposing negative obligations, thus exempting the German Federal Court from any checks on matters whose jurisdiction has been transferred to the Union. Instead, that principle should be read as attributing, in a positive sense, ‘responsibility for integration’ to all bodies of the German state, including the BVerfG, when it comes to the implementation and development of the Union integration process. In this way, the fundamental rights of the Union are incorporated among the judicial tools that the Federal Court applies in the Verfassungsbeschwerden.

Yet, the ‘new course’ seems strictly limited to direct actions of constitutional review: Through this new interpretation, the Court claims to be able to fill the judicial protection gap resulting from the absence of individual direct actions before EU Courts regarding the application of the Union fundamental right. According to the First Senate, this lacuna would not be sufficiently filled by the possibility that ordinary judges submit preliminary ruling requests to CJEU. Consequently, the only appropriate remedy is to extend the Verfassungsbeschwerde to the application of Union fundamental rights.

The Federal Court acknowledges, remarkably, that it will use the parameters laid down in the Charter in close cooperation with the Court of Justice. That Court has in fact the ‘last word’ (letztverbindliche Auslegung) on the interpretation of Union law in accordance with Article 19 TEU and 267 TFEU. The interpretative monopoly of the CJEU over EU law also includes the interpretation of Charter rights and the development of the principles necessary for their application, without prejudice for the obligation of national judges of last instance to refer questions to the CJEU, as required by the CILFIT doctrine.

The First Senate specifies that it will itself use the instrument of the preliminary reference when the matter has not already been clarified by the CJEU, or if the principles of interpretation to be applied are not evident - for example on the basis of the jurisprudence of the European Court of Human Rights, which also determines the content of the Charter in individual cases pursuant to Article 52(3) CFR.

The First Senate further recognizes that although the protection of the fundamental rights of the Grundgesetz and that of the Charter can often coincide and the principles of interpretation can be transferred from a system to another, caution is needed in the context of such interpretative activities so as not to affect the unity of EU law. In principle, in these cases the interpretation of the BVerfG must be based directly on the fundamental rights of the Charter itself and the jurisprudence of the CJEU, which is linked to the understanding of fundamental rights in the Member States of the Union as a whole. In particular, it is for the Court of Justice to interpret the fundamental rights of the Union pursuant to article 267(3) TFEU while the German Constitutional Court acts as a judge of last instance when deciding a Verfassungsbeschwerde.

Interestingly, in the case at hand the First Senate concludes that it is not necessary to refer to the CJEU: the Court claims that no questions requiring a new interpretation of the ECJ, or whose solution could not be traced in the existing CJEU’s case law read in the light of that of the Strasbourg Court (The Strasbourg Court’s case law constitutes an additional source of interpretation of the Charter pursuant to Article 52(3) CFR), arise. Moreover, it is not necessary to ask whether the ordinary judge, if acting at last instance, is required to submit a reference to Luxembourg, since the Oberlandsgericht is not a judge of last resort. Finally, the first Senate claims to be able to decide itself without having to refer the matter to the plenum of the Constitutional Court, as it does not carry out any revirement of Solange II jurisprudence. While the latter ruling raised problems of compliance of Union rules with the German Constitution, the present case is different in that it concerns the application of fundamental rights of the European Union under a fully harmonised legal framework.

The First Senate states that its task is, in the present case, not to check the correct application of the directive, but rather to verify whether the judgment under appeal correctly struck the balance among the different rights involved. Therefore, using the parameter of the Charter of fundamental rights of the Union, the BVerfG directly assesses the application of Union law by national authorities. In the light of these considerations, the Court considers the action admissible, but unfounded.

For this purpose, the First Senate reformulates the constitutional complaint’s subject: although the applicant referred only to the German Constitution, he in fact complained about the violation of his rights to respect for private and family life and confidentiality, as stemming from the articles 7 and 8 of the Charter. Taking into account these latter provisions, the Court finds that the contested judgment is not manifestly invalid, since it had correctly assessed all the interests involved and their interplay. The First Senate points out that the present case is different from the one examined by the CJEU in Google Spain, and that it cannot be assumed that the right to privacy should automatically prevail over other conflicting rights, such as freedom of expression: all these rights must instead be placed on an equal footing. In evaluating the various interests, the German Court considers different CJEU judgments and expressly cites them. The First Senate essentially embraces the defensive arguments raised by Google according to which, in the present case, particular attention should be paid to the fact that the processing of personal data is included in television communications, the fact that the complainant's private life was not affected, since this news concerned his professional life, and that there was in any event a general interest for that information to be shared with the public.

First of all, Google’s freedoms to conduct business, laid down in Article 16 of the Charter, and of expression, protected under Article 11 Charter, are not in themselves prevalent over the applicant’s privacy right. However, third parties’ rights must also be balanced, notably, against the general interest of the public to be informed and the freedom of expression of the broadcaster. As a result, the deindexing requested by the applicant would result in a restriction of the dissemination of an online publication.

In addition, the balancing must be carried out by not giving the individual the right to decide what information concerning him can be disseminated online, but by evaluating in concreto the possible damages to the right to free self-determination caused by the diffusion of certain information. This assessment should consider different factors. In this regard, the Oberlandsgericht erred in assessing that the issue concerned only the social life of the applicant. Given the ease of finding information on the Internet, it indeed becomes difficult to trace the limits between threats to the social sphere and those to the private sphere. Nonetheless, the Oberlandsgericht had correctly assessed, first of all, the influence of elapsed time between the events and the deindexing request, as prescribed by Article 17 of the GDPR; secondly, the fact that the information transmitted did not amount to slander, but was based on true factual data; thirdly, the fact that the information concerned not the applicant's private life, but his role as employer; and, finally, that the interview had been granted voluntarily. Therefore, according to the First Senate, the contested judgment did not fail to assure sufficient effectiveness to the Charter, nor was it based on an incorrect understanding of the meaning and scope of the rights provided thereunder.

4.      Not all those who wander are lost…

The orders discussed above raise some questions about the compatibility of the ‘new course’ concerning the protection of fundamental rights with Union law.

First, one might wonder whether the fact that the Constitutional Court itself decides the case, without referring the case back to the national lower courts, may risk creating a short circuit in the relationship between legal systems and violating the principle of loyal cooperation, protected by Article 4(3) TEU. This concern involves especially the outcome of the first order of the Bundesgerichthof, which, as a judge of last instance, could have (and should have) applied to the CJEU in case of doubt under Article 267(3) TFEU. Yet, if this new course is limited, as it might appear from the analysis of the two orders, to only the direct actions of constitutional review in the field of fundamental rights (Verfassungsbeschwerden, provided under Article 93(1), no 4(a) of the Grundgesetz), those concerns are unfounded. The national judge could indeed still have referred the matter to the CJEU before issuing its judgment, and, therefore, prior to the BVerfG’s decision on the direct action. If the issue arises before a judge of last instance, the duty to refer to the CJEU would have applied in accordance with Article 267(3) TFEU, within the limits of the CILFIT doctrine.

An essential element making this ‘new course’ compatible with Union law is that BVerfG states that the powers of national courts to refer to the Court of Justice are not questioned. Indeed, the BVerfG itself will dialogue with the CJEU when applying the Charter of fundamental rights of the Union. Judges of last instance can therefore submit any interpretative question to the CJEU, even in the absence of direct action of constitutional review, on which also the BVerfG could refer under Article 267 TFEU. 

This approach does not entail any limitation to the powers of national judges to refer to CJEU. The two orders of the Federal Court lead to a different outcome from the judgment no. 269 of 2017 of the Italian Constitutional Court, which seemed to suggest a constraint on the power of national judges to make preliminary ruling requests. However, this reading of the Italian Constitutional Court has later been denied by the Court itself in subsequent judgments.

It is nevertheless clear that, if the jurisprudence of the Federal Court evolved in such a way as to expand its role beyond the Verfassungsbeschwerden to the detriment of the application of Article 267(3) TFEU by ordinary judges, the same criticisms raised in relation to the Italian Constitutional Court judgment n. 267/2017 would apply. Such a jurisprudential development would be in breach of the well-established case law of the Court of Justice since the Simmenthal case. It is evident that the caselaw of these Constitutional Courts expresses a shared desire for a more active and direct role for those courts in the application of fundamental rights. Although they seem eager to play a greater role, it may be affirmed that none of these Courts seem to intend to undermine the preliminary reference system.

However, there is another important element which must be taken into account when assessing the compatibility of the ‘new course’ with Union law, that is the distinction (not easy to identify) between interpretation and application of Union law.

It must be considered that, the Treaties established through the mechanism of the preliminary reference a true monopoly on the interpretation of EU law of the Court of Justice. Such monopoly is necessary to guarantee the uniform application of European Union legal rules and the equality of the Union’s citizens and Member States before Union law. This monopoly does not affect the fact that it is for the national judges to decide, on a case-by-case basis, the application of European Union standards and principles developed by the Luxembourg jurisprudence. Under this classification, one could argue that the second order issued by the First Senate is only apparently divergent from the Google Spain judgment, as it is the result of an application of EU law. The subsequent question arises as to what parameters should be used to assess whether an application of EU law by national courts reflects the interpretation provided by the Court of Justice. This would be a matter for the Luxembourg Court to adjudicate, due to its monopoly on the interpretation of EU law. National judgments should even disapply national law conflicting with European rules having direct effects. Moreover, the Court of Luxembourg is increasingly urging national courts to find themselves the concrete solution to cases and applying EU law in light of the characteristics of the litigation pending before them.

In this regard, with the aim to draw a map of the duties of the various judges of the multilevel system, it can be noted that the concept of full harmonisation used by the BVerfG does not always lend itself to being coordinated with that of direct effects, which Court of Justice (see, again, the Popławski II judgment) reiterated as constituting the precondition for the national judge's power / duty to disapply the national rule in conflict with that of the EU, when no consistent interpretation of national law in the light of EU law can be reached.

As a result of this judicial ‘ménage-à-trois’, the task that the BVerfG arrogates for itself is that of controlling, through the instrument of direct action of constitutional review, that the German courts comply with the application of fundamental rights in the light of the following principles. For the purpose of this control, national ordinary judges should use the Constitutional parameter if the matter is not completely governed by Union law, and that of the Charter of Fundamental Rights in case a complete discipline has been adopted at European Union level. As to the balancing between fundamental rights, the direct action of constitutional review is a further guarantee for individuals in addition – and with no limitation – to the powers of the ordinary judges and the procedure envisaged at article 267 TFEU.

This reading is certainly acceptable under Union law, but there are some crucial aspects to it worthy of further analysis.

The first one concerns the concept of "full coverage", which has a significant importance in the reconstruction of the BVerfG to define the parameters of the balancing between the various colliding rights.

Firstly, it should be noted that, in case of doubt, only the Court of Justice, and not a Constitutional Court, can define the degree of coverage, whether exhaustive or not, entailed by Union law. Also the margin of discretion, which remains (or not) to the Member States and the national courts should be defined by the Court of Justice.

It is indeed the Court of Justice itself which recognises, in its case-law, the impact of the degree of harmonisation of a matter by EU law on the possibility for Member States to invoke national standards for the protection of rights: if EU law harmonised these standards, Member States are barred from invoking their own, even if they are higher than the harmonised ones, and therefore, proposing their own autonomous balancing in the event of any conflicts between fundamental rights. In the absence of harmonisation, however, national authorities and judges remain free to apply national standards for the protection of fundamental rights (and therefore to balance these rights), provided that the level of protection provided for by the Charter is not compromised.

In case this caveat was not followed, the ‘new course’ of the BVerfG would lead to a paradoxical consequence, by reserving to the national judge – and to the non-consistent application – a very delicate question of division of competences between the EU and the Member States.

In addition, the concept on which the two orders offered prevalence to the application of the Charter of Fundamental Rights, instead of the Constitutional standards, should not be understood as "harmonisation" in a technical sense, but rather as regulatory "coverage" or "discipline". Moreover, contrary to the press releases in English, the two orders do use not the term "harmonisation" (Harmonisierung) in the original text, but (nicht) vollständig determiniert (in the first order) and vollständig vereinheitlicht werden (in the second order). The two expressions do not coincide: the first one, usually used by the BVerG in connection with Union law, indicates that a matter is fully determined, while the second one implies a real unification. One could actually wonder if the use of two different terms in the context of two orders, that prescribe the application, in the first case, of the constitutional parameter, and, in the second, of the Charter of fundamental rights, is either random or voluntary. In this latter hypothesis, the issue arises as to whether the BVerG intended to make a distinction also with regard to the scope of the Charter.

Beyond this doubt, the fact that there is no mention of harmonisation is important for three reasons. First of all, it should be recalled that the Charter also applies with reference to fundamental freedoms and other provisions of the Treaty on European Union (a peculiar case of applicability of the Charter in conjunction with the provisions of the Treaty could be represented by the principle of non-discrimination on the basis of nationality, pursuant to Article 18 TFEU and Article 21(1) of the Charter; the applicability of the first provision, in fact, precisely presupposes that the situation falls within the scope of EU law but is not governed by specific prohibitions of discrimination on the basis of nationality provided for by other primary or secondary legislation, such as example the provisions on fundamental freedoms; see, for a reconstruction of the case law of the Court on the matter, the judgment of 18 June 2019, Austria / Germany, C-591/17, EU: C: 2019: 504, paragraphs 37-41), for which it would be inappropriate to discuss in terms of harmonisation. (Even before the recognition of the binding legal value of the Charter with the entry into force of the Lisbon Treaty, the CJEU had faced similar problems in the judgments of 12 June 2003, Schmidberger, C-112/00, EU: C: 2003: 333 and of October 14, 2004, Omega, C-36/02, EU: C: 2004: 614.)

Furthermore, strictly speaking, harmonisation is expressly excluded from the Treaty on the Functioning of the EU in a large number of subjects, on which EU competences yet exist. In particular, the TFEU excludes harmonisation in the fight against discrimination (Article 19), in the integration of third-country nationals legally residing in the EU (Article 79), in crime prevention (Article 84), in the incentive to employment (Article 149), in support competences, such as sport (Article 165), culture (Article 166), public health (Article 168) tourism (Article 195), civil protection (Article 196), administrative cooperation (Article 197), in the common commercial policy (Article 207), and, finally, in the general residual clause on implicit powers (Article 352).

Finally, the more or less complete "coverage" by law of the Union can derive not only from harmonisation, in a technical sense, but also from interpretation that the CJEU has given to existing rules. Even if an act of the Union does not fully harmonise a matter, it should be still applied in the light of the interpretation - which sometimes leads to creative interpretative outcomes – of the CJEU.

If it is true that, as the BVerfG states, the Charter itself cannot harmonise Union law – and, indeed, it could hardly find application in connection with a subject matter that is not, at least in part, governed by Union law (see judgment in TSN and AKT) – it can nevertheless be used by the CJEU as an interpretative tool to fill any potential gaps in a Union act, as a source of general principles (in line with Article 6 TEU). This is what happened, for example, in the Max-Planck judgment, in which the direct effects of a provision of the Charter have overcome the lack of horizontal effects of a directive. In this regard, however, the BVerfG must be praised for having expressed its intention not to question the direct effects of the Charter.

The second complex issue concerns the nature of the balancing and the delimitation of the concept of ‘application’ of European Union law. As mentioned above, in situations similar to those considered by the analysed orders, the matter is not the application of Union acts and rights stemming therefrom in a vertical relationship between the individual and the public authority, but the balancing between conflicting rights of different individuals. The question thus arises: is this balancing an act of application or interpretation?

The boundary is subtle: to the extent that the solution depends on the facts of the litigation, it is an application. However, whenever the issue concerns the content of certain rights, their absolute or relative nature, or even their respective hierarchy (this is the case, for example, for dignity, hierarchically superior, or for the right to property, hierarchically lower), this would undoubtedly be an interpretation question. Different judges would be called to solve cases of interpretation or application of Union law (and rights).

On the one hand, in principle, the task of applying the fundamental rights provided for by EU law and the possible balancing between them when they conflict with each other must be attributed to the national courts, leading to varying solutions for different cases and in the various legal systems of the Member States. On the other hand, however, it would not be legitimate for the scope and value of those rights, as well as any priority criteria among them - which can be inferred from the Charter, or from EU law - to be subject to assessments different from the national courts, even constitutional, subtracting them from the uniform interpretation of the Court of Justice. Finally, it should be noted that, as an exception (though not rare), situations may arise in which the classification of the facts of the case itself becomes an interpretative question of EU law. In these circumstances, different legal solutions can be provided to solve that issue, the Court of Justice being the competent court.

Overall, it must be observed that the two orders examined in this article take due account of the substantial case law of the CJEU on Directive 95/46 and GDPR and apply the criteria developed by it thereunder. As for the right to be forgotten, it is in fact preferable that the balance between the various rights, which following Google Spain seemed entrusted to the operator of the website, is carried out by the national judge under the control of the Constitutional Court.

The third crucial issue concerns the role that the ECHR and the relevant jurisprudence play in this theoretical construction. The fact that, pursuant to Articles 52(3) and 53 CFR, the ECHR can be an interpretative tool and a minimum standard with respect to the Charter, or a source of general principles of law (as can be inferred from Article 6 TEU) could prove to be of little help when it comes to balancing various rights, especially if Strasbourg and Luxembourg come to different configurations of this balancing. The BVerfG qualifies the ECHR as an additional source, but in the first order it seems to argue that it will not be necessary to refer to the CJEU when no doubts about the adequacy of the parameters of the German Constitution raise, because of their compliance with the ECHR standards. It is certain that the BVerfG also specifies that the standards developed by the CJEU are incorporated into the German Constitution. However, it should be clarified that, in the event of a divergent balancing struck in the jurisprudence of the two supranational courts, that of Luxembourg must prevail and compliance with the parameters of the ECHR does not necessarily equates to compliance with those of the Charter. In other words, the ECHR case law could not be used as an alibi to circumvent the CJEU's interpretative monopoly on Union law.

In a logic of loyal cooperation, the overall structure of judicial dialogue inaugurated by the two orders examined in this article in the field of constitutional complaints before the BVerfG should be understood as follows. In the event of incomplete regulatory coverage of the case by EU rules, if the balancing is to be done in the light of the parameters of the German Constitution – a duty to be carried out by the BVerfG – the CJEU is responsible to define the existence and the degree of coverage of the discipline dictated by EU law and, therefore, the residual margin of discretion left to the Member States. Instead, in the case of full regulatory coverage by EU law, the CJEU will interpret the EU rules exclusively, defining not only the scope but also the meaning. In parallel, the BVerfG will supervise in the context of constitutional complaints the respect and balancing of fundamental rights offered by ordinary judges in the application of Union rules, without prejudice to the powers of the ordinary German judges to make the preliminary reference to the CJEU.

Ultimately, the ‘new course’ of the German Constitutional Court does not seem to deviate from a consolidated logic of cooperation with the CJEU, nor, subject to the caveat outlined above, does it seem to call into question the logic of the preliminary ruling of Article 267(3) TFEU. The loyal cooperation imposed on constitutional judges under Article 4(3) TEU as well as the principle of openness to Union law, enshrined in Article 23(1) of the Grundgesetz, however, require the Federal Court to respect the limits drawn in the two orders on the right to be forgotten.

A critical problem, on which reflections and exchanges between the Court of Justice and the judges of the Member States become increasingly needed, is how determine who is responsible for striking the balancing of rights within the scope of EU law.

With regard to the nature and scope of the individual rights affirmed by the Charter - also with reference to the balancing between them - the answer seems to depend, firstly, on whether the balancing has a general and abstract nature, or instead concrete and linked to the particularities of the case, and, secondly, on whether an interpretation of EU law is required. If doubts arise about these alternatives, the clarification should be requested to the Court of Justice, pursuant to Article 267(3) TFEU.

Barnard & Peers: chapter 9
Photo credit: Gunter Josef Radig, via Wikicommons