Amending in progress Regulating Privacy: What Is the Point?

On the 27th of April 2016, the European Union officially published the General Data Protection Regulation (GDPR), replacing a directive dating back from 1995. This regulation intends to regulate, as from the 25 may 2018, the processing (i.e. any operation which is performed on personal data) of personal data (i.e. any information relating to an identified or identifiable natural person) in Europe (2). The European Union opted for the approach of adopting one single normative instrument to regulate every kind of uses of personal data, including collection of data via the Internet. This approach raises several questions. Perhaps the most important one is: how does this regulation achieve its main goal: protecting privacy? The privacy is a complex notion. It protects several aspect of an individual's personality. Among these aspects, the ones most commonly invoked are the following: the autonomy, the secrecy, and the anonymity of a person. Because anonymity and secrecy are not always possible (e.g. companies often need to have a list of their employees, a list of their providers and customers, such lists include most of the time some personal data such as names, adresses for deliveries), the GDPR's main goal is to ensure the autonomy of the individuals whose personal data is being processed, through ensuring control by these individuals over their data. Under the GDPR, any natural person (i.e. excluding companies)whose personal data is being processed qualifies as "data subject", and can therefore invoke a series of rights (i.e. the right to be informed, the right to access, the right to rectify, the right to data portability and the right to be forgotten). The GDPR wants to ensure data subjects can control the use that is made of their data. To a certain extent , it also protects secrecy of the data (by regulating the data controler's disclosure of the data) and the anonymity (for example, by requiring a privacy impact assessement and by requiring data controller to ensure privacy by design). Iwill analyze one the most famous inoovation of the GDPR: the so called "right to be forgoten". I will then analyze if regulation of privacy can interfere with freedom of speech. .

The right ot be forgoten is the quintessence of the individual's autonomy in protecting their privacy. It allows individual to object to the processing of their personal data by a data controler (i.e. any entity who determines the purposes and the means of the processing of the personal data - in other words, if Columbia University decides to automatically collect the information related to my activity on its network (means), in order to ensure security (purpose), it would qualify as "data controler" under the GDPR, should it apply-)under certain circumstances. Under Google v. Costeja Gonzalez, the claimant, Consteja Gonzalez, objected to the processing of its personal data by a Spanish newspaper and by Google. The claimant objected to the fact that when an internet users enterd his name in a search engine, the results showed articles dating back from 1998 mentioning him as being subject to a public auction for the recovery of unpaid social security debts. In particular the claimant insisted that the procedure had been resolved for many years and that referencing it was now irrelevant. The Spanish data protection authority in charge rejected Costeja Gonzalez complaint against the newspapers (because it found that the newspaper was processing the information lawfully and for a legitimate purpose) but it upheld the complaint against Google. Google appealed this decision in front of the Spanish courts, and the Court referred to the European Court of Justice for a preliminary ruling. The ECJ decided that Google was responsible under the European Data protection law and that it should answer to data subjects' objections to the processing of data relating to them.

Under European law, data protection is not just a consumer’s right to be properly informed: it is a fundamental right, incorporated in the Charter of Fundamental Rights of the European Union. Article 8.1 of the Charter states that: “everyone has the right to the protection of personal data concerning him or her”. I think that explaining to the citizens that a violation of data protection law constitutes a violation of their fundamental rights is a powerful symbolic and educational tool. In today’s world, absent any regulations, the notion of privacy would be forgotten faster and progressively, nobody would stand for it anymore. During the recent years, some citizens have successfully invoked their rights under the directive in courts (Costeja Gonzalez, Max Schrems). The rights of the individuals have been extended under the GDPR. As an example, the right to information requires now a more detailed description of the processing activities (5). Thanks to these legal requirements, reading such privacy policy will give a lot of information to the individuals and enables people for whom privacy is a concern to know under which conditions the data relating to them will be processed, and to choose the provider that will not spy on them. Of course, you can lead a horse to water, but you cannot make it drink.

One of the new features of the GDPR is the possibility for data protection authorities (DPA) to impose significant fines (up to EUR 20,000,000 or 4% of the global turnover of the infringer, whichever is higher) (6). Under the directive, some countries did not foresee the possibility to impose fines. Where such fines were foreseen, the amount at stake were also much lower than under the GDPR. This creates a significant economic risk for companies collecting personal data; certain practices could not be as profitable as before, should such a fine be imposed.

I think that the adoption of regulation is not incompatible with other ways to ensure privacy, such as promoting the use of open sources software. Even if regulation is not a perfect solution towards privacy, I think it is one step in the good direction. It gives enforceable rights to large categories of individuals against a large category of companies that collect their behaviors. As emphasized above, it also helps to raise awareness and to a certain extent, to empower the individuals. By enforcing their rights, individuals could request data protection authority to impose significant fines, thereby creating an economic risk for these companies and a potential preventive effect.