Who decides on the future of data protection? Role of law firms in shaping European data protection regime

Abstract

Drawing on theories of European integration and governance and sociological studies on the influence of elite law firms on rule-setting, this paper shows that law firms (a) operate in the area of data protection that is of extreme complexity and requires expert knowledge; and (b) display characteristics similar to other actors who succeeded in influencing agenda-setting and the results of policy-making despite having no formal competence to do so. This article proposes a hypothesis of the influence of elite law firms in EU data protection rule-setting. It argues that the EU data protection sector is prone to such influence as it is by definition transnational and, at some technical and some core points, inadequate to reflect the real data processing practices and therefore is entrenched with uncertainty. Therefore, the research into politics of data protection in Europe cannot disregard the role of these actors in shaping the European data protection regime.

Keywords:

• law firms
• privatization of rule-setting
• data protection

Acknowledgement

I am indebted to the anonymous referees of this paper for their helpful comments.

Notes

1. See Bennett (2008) and Newman (2008) on the role of national data protection authorities promoting common EU data protection policies.

2. For example. Quack (2007), and Flood (2007).

3. Although the right to data protection has firmly entered the European policy and academic discourse, as well as EU constitutional texts in Article 8 of the EU Charter of fundamental rights, the exact contours of this right are still being debated. During the 2012 data protection reform efforts, e.g. it is still debated whether such new elements as a right to be forgotten and data portability should be part of the modern data protection regime (see Koops, 2011); for arguments concerning the classification of the right to data portability as a data protection right, see UK Ministry of Justice (2012) on whether the right to data portability is a data protection right or a consumer protection measure).

4. Proposal for regulation on the protection of the individuals with regard to the processing of personal data and free movement of such data. COM(2012)11 final (hereinafter ‘the Proposal’)

5. In 1992 Colin Bennett wrote that ‘it is not immediately obvious … what harm results from the computerized collection, use, and disclosure of personal data’ (Bennett 1992, 12). In 2012 in the age of international data flows, there is still no agreement on national, regional or transatlantic levels on the single set of data processing concerns (Bennett, 1992; Purtova 2011a).

6. According to Koops (2010), both visions have potential in data protection.

7. For more details on evolution of data protection see, for example, Bennett (1992) and Mayer-Schőnberger (1997).

8. Raab and Koops (2009) call for the development of ‘a new analytical paradigm of the ‘who’ of privacy protection.'

9. As opposed to governance as process (Börzel and Risse 2010).

10. For a brief description of theories of European integration and analysis of the roles of state-, supranational-, and non-state actors see Craig (2011).

11. On influence of consultancies see for example Hutter (2006).

12. See Nelson (1985) and the sources cited there.

13. For example, Flood (2007) based in the UK, examines not only large US but also UK law firms operating transnationally; Quack, a German-based scholar, studies the impact of large law firms on transnational law-making, also in Europe (Quack 2007).

14. See Nelson (1985, 546); Quack (2007); Flood conducted a series of interviews with lawyers working at the elite law firms showing that a large international law firm with a bigger office is often chosen over a local firm of sufficient expertise (Flood 2007, 63).

15. Lawyers also come across other sorts of uncertainty in their work, that do not have a demonstrated causal connection to their influence on rule-setting, e.g. lawyers realize that their clients' and their counterparts' expectations regarding a deal may change and have to be renegotiated (Flood 1991, 41–71).

16. Flood (2007); Quack (2007); Flood and Skordaki (1997) investigating how lawyers effectively developed ‘a private system of law’ to handle international mega-insolvencies.

17. For an overview of sources of international business law see any textbook on International Private Law or International Business law, e.g. Clarkson et al. (2010).

18. Flood (2007, 37) brings two examples of such gap-bridging. In the first example, one of the elite law firms filled in the legal vacuum by drafting missing legislation. A $9 million project for development of oil and gas reserves of the island of Sakhalin, Russia, was initiated. The governing law on Production Sharing Agreements in order for the project to take off required that certain national laws involving environmental regulation, taxation, banking and financing, and other regulatory issues were adopted. However, only 70% of all the necessary legislation was in place. An elite law firm was asked to and produced final drafts of missing pieces of legislation.

19. In the second example, an elite law firm overcame the absence of a covered bond – a form of securities – under the UK legal system by creating a new body of rights and guarantees of equivalent scope using alternative legal constructs, bypassing the legislature. The advantage of the covered bond is that the legislation protects it in case of an issuing bank's insolvency by putting bond-holders ahead of other creditors, and a low-risk rating. The bond existed already in a number of European countries, such as Germany, France, and Ireland, but not in the UK. A major investment bank approached a partner of one of the elite law firms with a request to create an equivalent product. The resulting vehicle turned out to have a risk rating even lower than the original covered bond under, for example, German legislation, and therefore more attractive to investors. This created a controversy to the point that the German government claimed the UK construct was inconsistent with the EU law. To resolve the controversy the UK enacted necessary legislation on covered bonds within three years (Flood 2007, 57–62).

20. See Quack (2007, 647) (‘Small and gradually accumulating variations in practical actions with incidental or unintended results can lead to rather far-reaching effects in terms of institution-building’) and literature cited there;

21. There may be other motives at play guiding the exercise of influence by the law firms, e.g. the fact that they operate as businesses and compete against their peers occupying the same market niche, but selling different legal solutions as their ‘products’ (e.g. Flood 2007, 44).

22. See for example Feder (1980, 263–283) and Thayyil (2012) on dealing with risk in European regulation of genetically modified organisms.

23. UN Guidelines adopted by the General Assembly on 14 December 1990.

24. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and the free movement of such data;-Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications, as amended by Directive 2009/136/EC of 29 November 2009) repealing and replacing Directive 97/66/EC of the European Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector;

• - EU Charter of Fundamental Rights of 7 December 2000;

• - Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC;

• - Regulation (EC) 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by Community institutions and bodies and on the free movement of such data.

25. Consolidated Version of the Treaty on Functioning of the European Union.

26. For example paragraphs 1 and 2 of Article 6 (ex Article F) of the consolidated text of the Treaty on the European Union.

27. Initially in the Nold case (ECJ 14 May 1974, J. Nold Kohlen- und Baustoffgroßhandlung v. Commission, case 4/73 [1974] ECR 491, paragraphs 13 and 14).

28. For example, the Committee of Ministers of the Council of Europe have adopted Recommendation No. R (90) 19 of the Committee of Ministers to Member States on the protection of personal data used for payment and other related operations (adopted by the Committee of Ministers on 13 September 1990 at the 443rd meeting of the Ministers' Deputies) and Recommendation No. R (89) 2 of the Committee of Ministers to Member States on the protection of personal data used for employment purposes (adopted by the Committee of Ministers on 18 January 1989 at the 423rd meeting of the Ministers' Deputies).

29. See, for example, Reding (2010).

30. For more on the status and effect of the directives in community law see Prechal (2005).

31. ‘A single law will do away with the current fragmentation and costly administrative burdens. This will save businesses around €2.3 billion a year’ (European Commission 2013).

32. For example, for two opposing views on the applicability of the data protection directive see two opinions written by two prominent practising lawyers in the field: Moerel (2011, 92-110), and Kuner (2010, 176, 227).

33. Digital Civil Rights in Europe, Final Agreements between EU and USA on PNR and Swift.

34. Under Article 26 of the Directive, a Member State may also authorize a transborder data transfer if the controller ensures adequate safeguards. Such safeguards may be in a form of standard contract clauses or Binding Corporate Rules – BCRs (Article 26(2) of the Directive).

35. Robinson et al.. 2009. Review of the European Data Protection Directive: Technical Report Prepared for the Information Commissioner's Office. RAND.

36. Those countries are Switzerland, Canada, Argentina, Guernsey, Jersey and the Isle of Man (http://ec.europa.eu/justice/data-protection/document/international-transfers/adequacy/index_en.htm).

37. Working Document on Transfers of personal data to third countries: Applying Article 26 (2) of the EU Data Protection Directive to Binding Corporate Rules for International Data Transfers, 3 June 2003, WP 74.

38. For example, Nugter (1990, 29, quoted in Heisenberg 2005, 53–54) describes the division of the two considerations already on the stage of drafting the data protection directive: ‘[T]he primary concern of the Commission seemed rather to be more the protection of a European data processing industry, than the safeguarding of individual rights. The European Parliament's primary concern, by contrast, has been the protection of the individual. […] In fact, these different attitudes characterize the many reports, proposals and studies that were to come in the following years’.

39. The author first framed the informational self-determination versus fair information practices dilemma as an issue of data ownership earlier elsewhere (Purtova 2012).

40. For an extensive argument in favour of resolving the issue of ownership of personal data see Purtova (2011a)

41. One should look back at the drafting history of the Directive to understand that it emerged against a backdrop of 20 years of the national data protection laws, each rooted in national legal and normative traditions.

42. For instance, the UK rejected the German proposals for a default consent requirement for data processing as too strict. For an overview of the various competing national and industrial group interests on the stage of drafting of the Directive see Heisenberg (2005, 51 et seq.).

43. In a wider European context, the case-law of the European Court of Human Rights has laid a connection between European privacy and data protection regimes and the informational self-determination, by recognizing development of personality and personal autonomy as the interests protected under Article 8 ECHR. Already in the European Commission's decisions and later in the Court's judgments, ECHR jurisprudence (Niemietz v. Germany) has recognized the right to develop relationships within and beyond one's family circles, protected by Article 8 right to privacy^. Later jurisprudence linked the right to establish and develop relationships to the right to ‘development and fulfilment of one's own personality^’. ECHR, 1992, paragraph 29; the Court ruled that the respect of private life under Article 8(1) ‘must also comprise to a certain degree the right to establish and develop relationships with other human beings’. (See Commission Report X. v. Iceland (Application No. 6825/74) of 18 May 1976 in Decisions and Reports, Vol. 5 at p. 87; Harris et al. 1996, 231; Ooosterwijck v. Belgium, Comm. Report 1.3.79, paragraph 51, p. 36.).

44. For example in Österreischer Rundfunk (Joint cases C-465/00, C-138/01, and C-139/01 [2003] ECR I-6041) concerning the conflict between data protection rights and a public interest in efficient use of public funds, the Court found that if the national Austrian law requiring publication of the officials' salaries is not compatible with Article 8 ECHR, it is also incompatible with the Directive (para. 91);

45. As early as in 1994, Beddard wrote that although the European Convention ‘does not talk of the right of personality, […] particularly within Articles 8 to 11 are found the rights which go towards the fulfilment of personal hopes, aspirations, and ideals’ (Beddard 1994, 95). More recently, De Hert and Gutwirth wrote that the Strasbourg court's terminologically ambiguous privacy case law, although does not yet grant protection to the right of self-determination, does guarantee a right to personal development (see ECHR, Christine Goodwin v. the United Kingdom [GC], no. 28957/95, § 90, ECHR 2002-VI) and acknowledges the importance of the principle of individual autonomy, including in data protection cases (De Hert and Gutwirth 2009, 15). Rouvroy and Poullet bring examples of the Article 8 ECHR case law acknowledging the interest of individual decisional autonomy in various areas: sexual life, right to die, right to access to full information about a place of residence, and so on (Rouvroy and Poullet 2009, 62).

46. (COM/2012/09 final) Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions ‘Safeguarding Privacy in a Connected World A European Data Protection Framework for the 21st Century’; Neelie Kroes (2012), Vice-President of the European Commission responsible for the Digital Agenda, when commenting on the proposal said that it ‘starts from everybody owning their own personal data’.

47. (COM/2012/09 final) Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions ‘Safeguarding Privacy in a Connected World a European Data Protection Framework for the 21st Century’. Costa and Poullet (2012) and De Hert and Papakonstantinou (2012) consider these and other data protection innovations in more detail.

48. A detailed analysis of the Proposal is done elsewhere (e.g. Purtova 2012; Costa and Poullet 2012, 255). These are only a few points signifying the departure from the idea of informational self-determination and the individual ownership of personal data: (a) the Proposal is not connected to the informational self-determination on the level of its objectives; (b) the Regulation also narrows down the scope of the control rights compared with the situation under the Directive, i.e. the area of default entitlement of the individual in personal data is narrower in comparison to the system of the Directive, while the scope of the default entitlements of others is broader.

49. Nelson (1985) points to the same problem.

50. The law firms are profit-oriented businesses, after all.

51. Article 29 Working Party. 2003. Working Document on Transfers of personal data to third countries: Applying Article 26 (2) of the EU Data Protection Directive to Binding Corporate Rules for International Data Transfers, 3 June 2003, WP 74;

52. WP 74; Article 29 Working Party. 2004. Model Checklist, Application for approval of Binding Corporate Rules, 25 November 2004, WP 102; Article 29 Working Party. 2005. Working Document Setting Forth a Co-Operation Procedure for Issuing Common Opinions on Adequate Safeguards Resulting From ‘Binding Corporate Rules’, 14 April 2005, WP 107; Article 29 Working Party. 2005. Working Document Establishing a Model Checklist Application for Approval of Binding Corporate Rules, 14 April 2005, WP 108; Article 29 Working Party. 2007. Recommendation 1/2007 on the Standard Application for Approval of Binding Corporate Rules for the Transfer of Personal Data; Article 29 Working Party. 2008. Working Document setting up a table with the elements and principles to be found in Binding Corporate Rules, 24 June 2008, WP 153; Article 29 Working Party. 2008. Working Document Setting up a Framework for the Structure of Binding Corporate Rules, 24 June 2008, WP 154; Article 29 Working Party. 2008. Working Document on Frequently Asked Questions (FAQs) related to Binding Corporate Rules, 24 June 2008, WP 155;

53. For examples of this ‘transnational historical materialism’ account of European integration see, for example, Bieler and Morton (2001), cited in Cowles (2003, 111)

54. For example, the EU seems to be cautious about private regulation in the area of fundamental rights (‘[Co-regulation] is only suited to cases where fundamental rights or major political choices are not called into question.’ Commission of the European Communities. 2001. The White paper on European governance. COM (2001) 428 final. Brussels, 25.7.2001: 21; The Inter-institutional agreement on better law-making reaffirms that self- and co-regulation will not be chosen as regulatory instruments where fundamental rights are ‘at stake’ (European Parliament, Council, Commission, Interinstitutional agreement on better law-making, 2003/C 321/01, Brussels, 31.12.2003, para 17)).