Regulating Privacy: What Is the Point?

On the 27th of April 2016, the European Union officially published the General Data Protection Regulation (GDPR) (1), replacing a Directive dating back from 1995. This regulation is 88 pages long and is intended to regulate, as from the 25 may 2018, the processing (i.e. “any operation, or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means”) of personal data (i.e. “any information relating to an identified or identifiable natural person”, where an identifiable natural person is “one who can be identified directly or indirectly”) in Europe (2).The European Union has chosen the approach of adopting one single normative instrument to regulate every kind of use of personal data, including collection of data via the Internet. This approach raises several questions. The pervasive nature of the internet, the constant evolution of the technology, as well as the interests that the States themselves have in collecting information seem to limit the practical effect of adopting Regulation in this field. In this paper, I will, shortly but non-exhaustively, develop arguments in favor and against the adoption of such kind of regulation, through examples stemming from the European approach (both under the current European data protection directive and under the GDPR).

The cyberspace has no borders. A company located in the Silicon Valley can offer its services online to the entire world and collect all kinds of data relating to its users, without having any branch outside of the United States. On the contrary, regulations are very often bound to a specific territory. In certain cases, rules apply to categories of legal entities linked to an organization. But in any case, such limitation of the applicability to certain places or entities seems to make regulation of privacy on the internet impossible. As a result, one could question the efficiency of a regulation, especially when it comes to the enforcement of the rights it protects for a breach that took place on the other side of the planet. However, this limitation to a territory, with respect to data protection should be nuanced. In theory, the GDPR will be applicable to all companies offering services or collecting information regarding European behaviors through a website accessible in Europe (3). In practice, under the current Directive, the European Court of Justice (ECJ) applied the European data protection law to a processing carried out by Google Inc. in California. The ECJ decided that, despite the fact that the Spanish entity was not involved directly in the processing of personal data by Google Inc. (the Spanish entity was only in charge of selling advertisements), such processing took place “in the framework” of an establishment of Google, located in Spain (4). Even though the global aspect of the internet does not allow to regulate every entity processing personal data within a territory, regulation can have an extraterritorial effect.