Data Protection Comes of Age: The Data Protection Clauses in the European Constitutional Treaty

Abstract

This article traces the evolution of the right to data protection in European law, with a particular focus on the inclusion of the right in the European Union Charter of Fundamental Rights and its proposed legal status under the new Constitutional Treaty. In particular, the discussion considers the legal impact of this ‘constitutionalisation’ of this area of legal protection. It is argued that this should be viewed as more than just a formal development in that entrenchment of the right may strengthen ground-level interpretation and implementation of data protection principles.

Notes

To be signed in Rome on 29 October 2004. Text available online at: http://ue.eu.int/igcpdf/en/04/cg00/cg00087.en04.pdf (document reference CIG87/04, dated 6 August 2004).

E.g., following the events of 9/11, the United States authorities requested the transfer to them of the passenger name record (PNR) data of all flights into and out of the United States. The need for adequate protection in the processing of the personal information by the American authorities is an important concern from a European perspective (see Opinion 02/2004 of the Article 29 Working Group on the adequate protection of personal data contained in the PNR of Air Passengers to be transferred to the United States' Bureau of Customs and Border Protection. Available online at: http://europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2004/wp87_en.pdf.

E.g., the increased proliferation of the use of closed-circuit systems, cameras and video surveillance by public and private authorities and hence the multiple personal data being collected and processed by these systems is a source of concern from a data protection perspective (see Opinion 04/2004 of the Article 29 Working Group on the processing of personal data by means of video surveillance. Available online at: http://europa.eu.int/comm/internal_market/privacy/docs/wpdocs/2004/wp89_en.pdf).

The second pillar is Common Foreign and Security Policy. The third pillar is Police and Judicial Cooperation in Criminal Matters (formerly, prior to the Amsterdam Treaty, Justice and Home Affairs).

Article 8: ‘Everyone has the right to respect for his private and family life, his home and his correspondence. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.’

Article 10: ‘1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers. This article shall not prevent States from requiring the licensing of broadcasting, television or cinema enterprises. 2. The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or the rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.’

ETS No. 108 (available online at: http://conventions.coe.int/Treaty/en/Treaties/Html/108.htm). Convention 108 was opened for signature on 28 January 1981.

Austria, Portugal and Spain.

Information available online at: http://conventions.coe.int/Treaty/Commun/ (accessed 12 March 2004).

Directive 95/46/EC, OJ L28/31, 23 November 1995.

See Recommendation R (2002) 9 on the protection of personal data collected and processed for insurance purposes (18 September 2002); Recommendation R (1997) 5 on the protection of medical data (13 February 1997); Recommendation R (1987) 15 regulating the use of personal data in the police sector (17 September 1987).

See the First Commission Report on the Implementation of the Data Protection Directive (95/46/EC), 15 May 2003, COM(2003) 265 final.

OJ L24/1, 30 January 1998.

OJ L201/37, 31 July 2002.

OJ C364/1, 18 December 2000.

Article II-68, in Part II: The Charter of Fundamental Rights of the Union, Title II-Freedoms of the Constitutional Treaty for Europe (document reference CIG87/04, dated 6 August 2004). Available online at: http://ue.eu.int/igcpdf/en/04/cg00/cg00087.en04.pdf (accessed 31 August 2004).

See S. Douglas-Scott (2004) ‘The Charter of Fundamental Rights as a Constitutional document’, European Human Rights Law Review, 1, at p. 42. Douglas-Scott lists as the sources of the rights found in the Charter of Fundamental Rights: the European Convention of Human Rights, the European Social Charter, common constitutional traditions, rulings of the European Court of Justice and of the Court of Human Rights, as well as international conventions of the Council of Europe and the International Labour Organisation.

See Douglas-Scott, ‘Charter of Fundamental Rights’, p. 40.

See I. Rogers (2002) ‘From the Human Rights Act to the Charter: Not another human rights instrument to consider’, European Human Rights Law Review, 3, at pp. 347 – 350.

On 1 November 2006, provided that all the instruments of ratification have been deposited or, failing that, on the first day of the second month following the deposit of the instrument of ratification by the last signatory State to take this step (Article IV-447 of Constitutional Treaty (document reference CIG87/04, dated 6 August 2004. Available online at: http://ue.eu.int/igcpdf/en/04/cg00/cg00087.en04.pdf; accessed 31 August 2004).

E.g., in 1973 (OJ 1973, C26/7 et seq) and in 1989 (OJ 1989, C120/50, 16 May 1989).

Articles 6 and 18 (OJ 1989, C120/50, 16 May 1989).

Title VIII.

OJ 1994, C61/155, 28 February 1994.

Affirming Fundamental Rights in the European Union: Time to Act. Report of the Expert Group on Fundamental Rights presented to the European Commission, February 1999. Available online at: http://europa.eu.int/comm/dgs/employment_social/publicat/fundamri/simitis_en.pdf (accessed 12 March 2004).

Affirming Fundamental Rights, p. 16.

See CHARTE 4112/2/00 Rev 2, 27 January 2000, pp. 1, 5.

See CHARTE 4137/00 Convent 8, p. 5.

See CHARTE 4284/00 Convent 28, p. 14.

Up to 14 June 2000 – CHARTE 4360/00 Convent 37, pp. 23 – 24.

See CHARTE 4360/00 Convent 37, p. 25.

Volkszählungsurteil (1983), 65 Entscheidungen des Bundesverfassungsgerichts (BVerfGE ), at p. 43. For an analysis of the case, see P. Schwartz (1989) ‘The computer in German and American constitutional law: Towards an American right of informational self-determination’, American Journal of Comparative Law, 37, p. 675.

See CHARTE 4423/00 Convent 46, pp. 7 – 8

Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJL8 12 January 2001, p. 1).

See Affirming Fundamental Rights.

The second pillar is Common Security and Foreign Policy, and the third pillar is Justice and Home Affairs.

Affirming Fundamental Rights, p. 8.

See Douglas-Scott, ‘Charter of Fundamental Rights’, p. 46.

See Affirming Fundamental Rights, p. 9 (the report gives the rules governing Europol as an example).

Jacqueline Dutheil de la Rochère (2004) ‘The EU and the individual: Fundamental rights in the Draft Constitutional Treaty’, Common Market Law Review, 41, at p. 351. She argues that one advantage of including the EU Charter of Fundamental Rights in the Constitutional Treaty is that ‘it grants fundamental rights of the Union an indisputable value of positive law’.

See First Commission Report on the Implementation of the Data Protection Directive (95/46/EC), dated 15 May 2003, COM(2003) 265 final.

Regarding discussions in the Dutch and British parliaments, see S. Simitis (1998) ‘Autodisciplina: approccio europeo e statunitense a confronto’. Paper presented at Internet e Privacy—Quali regole? 9 May 1998. Available online at: www.privacy.it/garanterelsim.html (accessed 12 March 2004).

A. J. McClurg (2003) ‘A thousand words are worth a picture: A privacy tort response to consumer data protection’, Northwestern University Law Review, 98, p. 92.

There exist a variety of options in the technical approach. These range from further segregation of data sets and personal identifiers within database systems to integration of encryption programs in word processing and browser software.

Notably Sweden and Malta.