Regulating intersectional activity: privacy and energy efficiency, laws and technology

ABSTRACT

Using a case study, this paper explores the extent to which one area of law (privacy and data protection) can intersect with, and be challenged by, proposals for delivery of another goal – greater energy efficiency. The article then explores the extent to which these fields are becoming more integrated; and also the risks of relying on technology (notably through Privacy by Design) to do this, particularly given the uncertainties embraced by lawyers and which can be problematic to technologists. Having identified challenges in meeting both energy efficiency and privacy/data protection goals at the same time, the article develops two responses. One looks more widely in law, to competition, to prevent particular activity and to confirm the relevance of greater legal interdisciplinarity. The other is a more multi-faceted collaborative governance approach, involving legal and technical expertise and consumer perspectives, with standards having a valuable role. Addressing climate change through greater energy efficiency should be an appropriate motivation to bring about this second approach, which draws on wider environmental governance developments. With largely a UK and EU focus, but seeking to be of transnational relevance, the paper makes key contributions as to the capacity and limits of how law can address societal challenges; explores the risks of assuming that social and legal problems can be readily addressed by technology; confirms the need for lawyers to look to other fields of law; and assists progress in an increasingly intersectional and dynamic field.

KEYWORDS:

• Privacy
• energy efficiency
• intersections

Disclosure statement

No potential conflict of interest was reported by the authors.

ORCID

Abbe Brown http://orcid.org/0000-0002-2222-4537

Rónán Kennedy http://orcid.org/0000-0002-6319-1903

Notes

1. United Nations Framework Convention on Climate Change (opened for signature 9 May 1992, entered into force 21 March 1994) 31 International Legal Materials 849.

2. Kyoto Protocol to the United Nations Framework Convention on Climate Change (opened for signature 11 December 1997, entered into force 16 February 2005) 37 International Legal Materials 22, articles 2–4, Annex A.

3. UN Doc FCCC/CP/2009/L.7. There is agreement on enhancing actions, see articles 1, 2, 4, 5.

4. UN Doc FCCC/CP/2015/L.9/Rev.1.

5. Paris Agreement, articles 2, 3, 4, 5, 7, 11, and 12; regarding compliance articles 13–15.

6. Council Directive (EU) 27/2012 on energy efficiency [2012] OJ L315/1, recitals 27 and 31 (“Energy Efficiency Directive”).

7. The Queen’s Speech and Associated Background Briefing, on the Occasion of the Opening of Parliament on Wednesday 21 June 2017. https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/620838/Queens_speech_2017_background_notes.pdf (Queen’s Speech), pages 13, 32

8. Charter of Fundamental Rights of the European Union (Charter) arts 7 and 8.

9. Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention on Human Rights, as amended) (“ECHR”) art 8.

10. Campbell v MGN [2004] 2 AC 457, Weller v Associated Newspapers [2015] EWCA Civ 1176. Note also the decision (delivered after acceptance of this paper) by the Ontario Court of Appeal regarding reasonable expectation of privacy and energy use R v Orlando – Habsburgo (2017) – an issue worthy of future detailed exploration.

11. Lion Laboratories Ltd v Evans [1985] QB 526 (CA).

12. Data Protection Act 1998.

13. Council Directive (EC) 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L281/31.

14. UK Data Protection Act 1998 s1, s 2, s36, schedule 1, schedule 2

15. Council Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data [2016] OJ L119/1 (“GDPR”).

16. GDPR arts 3, 4, 5, 7, 13, 14, 32, 44 – note also the right to be forgotten art 17 and provisions regarding automated decision-making in arts 21 and 22.

17. GDPR, art 4, 6(1)(a), 7, 13 and 14 (regarding provision of information).

18. GDPR, art 6(1) (e) and (f), 13(a)(d) and 14 (regarding provision of information).

19. Queen’s Speech, pp. 16, 46.

20. GDPR, art 4(11)

21. This is in contrast to 2016 attitudes in the UK, leading to the Investigatory Powers Act 2016 and the Digital Economy Bill 2016.

22. Note that in the UK, climate change is since 2016 part of the Department for Business, Energy and Industrial Strategy.

23. Again, Energy Efficiency Directive recitals 27 and 31.

24. Energy Efficiency Directive, recital 32.

25. Council Directive (EC) 2009/72 concerning common rules for the internal market in electricity [2009] OJ L211/55

26. Council Directive (EC) 2009/73 on common rules for the internal market in natural gas [2009] OJ L211/94.

27. Energy Efficiency Directive, art 9(2)(b).

28. Energy Efficiency Directive, art 7(8)(b) – with confidential information to remain as such.

29. Charter, art 37.

30. GDPR, arts 25 and 42.

31. GDPR, arts 40, 41

32. See, for example, new approaches to data protection enforcement, in the UK through section 13 and also 55A-E Data Protection Act 1998 and GDPR arts 77–84; see also Google Inc v Vidal-Hall [2015] EWCA Civ 311.

33. See discussion above regarding international pathways notes 1–5. Enforcement in respect of climate change, energy and the environment more generally is very fragmented and can sit at the border of private/public questions, as well as involving questions of ,for example, nuisance and disputes relating to specific regulatory regimes such as trading schemes – see cited sources for discussion across jurisdictions and eg Urgenda (Rechtbank Den Haag (2015) C/09/456689) and R (on application ClientEarth v Secretary of State for the Environment, Food and Rural Affairs [2016] EWHC 2740 (Admin).

34. Case 27/76 United Brands v Commission [1978] ECR 208.

35. European Commission (1997).

36. Microsoft Corp v Commission [2007] ECR II-3601 (note 146). And note that for EU competition law to apply there must be an effect on trade across member states, although this is likely to be met when data might be crossing borders, as seems possible given the case study – see European Commission (2014c).

37. See findings of dominance and abuse in technology sectors, see for example Microsoft Corp v Commission [2007] ECR II-3601 (note 53, 151).

38. Building on for example Case C-418/01 IMS Health v NDC Health [2004] ECR I-5039; Case T-201/04 Microsoft Corp v Commission [2007] ECR II-3601.

39. Building on Case C-6/73 Commercial Solvents v Commission [1974] ECR 233, Case C-418/01 IMS Health v NDC Health [2004] ECR I-5039 (note 53), Case T-201/04 Microsoft Corp v Commission [2007] ECR II-3601 (note 53).

40. And as was done by the EU Court of Justice in considering when it was abuse to seek an injunction after an undertaking had been given to licence a standard essential invention on a fair, reasonable and non-discriminatory basis Case C-170/13 Huawei v ZTE [2015] Bus LR 1261, AT.39985 – Motorola – enforcement of GPRS Standard Essential Patents (29 April 2014), http://ec.europa.eu/competition/antitrust/cases/dec_docs/39985/39985_928_16.pdf. See also balancing of different human rights by the EU Court of Justice in cases involving privacy and data protection eg Case C-101/01 Bodil Lindqvist v Åklagarkammaren i Jönköping [2003] ECR I-12971; Case C-275/06 Productores de Música de España (Promusicae) v Telefónica de España SAU [2008] ECR I-00271; Case C-131/12 Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González; and Case C-73/07 Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy [2008] ECR I-09831 http://ec.europa.eu/competition/antitrust/cases/dec_docs/39985/39985_928_16.pdf. See also balancing of different human rights by the EU Court of Justice in cases involving privacy and data protection eg Case C-101/01 Bodil Lindqvist v Åklagarkammaren i Jönköping [2003] ECR I-12971; Case C-275/06 Productores de Música de España (Promusicae) v Telefónica de España SAU [2008] ECR I-00271; Case C-131/12 Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González; and Case C-73/07 Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy and Satamedia Oy [2008] ECR I-09831.

41. Charter arts 7, 8 and 37.

42. Case COMP/M.7217 Commission Decision [2014] OJ C 417/2. (although not in relation to Google/Doubleclick) Case COMP/M.4731 Commission Decision [2008] OJ C 184/10.

43. For details of a Bundeskartellamt proceeding 2 March 2016.

44. No longer quite so different from those now in the GDPR, see note 30, but the large prospect of a fine of up to 10% of global turnover Article 23(2) Council Regulation 1/2003 of 16 December 2002 on implementation of rules on competition OJ L 4 January 2003, 1–25 and see European Commission (2006) regarding competition fines.

45. See also on this, for example, 1986 UN Declaration on the Right to Development A/RES/41/128 and the UN Sustainable Development Goals https://sustainabledevelopment.un.org/?menu=1300.

46. See https://www.forestry.gov.uk/theukforestrystandard.

47. A particular example might be ISO/IEC 29100:2011.

48. For example, ISO 14001, ISO 50001 regarding good practice in energy management and quantifying and communicating greenhouse gas emissions ISO 14064 and 14065, and dedicated web page https://committee.iso.org/tc207sc7.

49. California Department of Substance Control, Restrictions on Use of Hazardous Substances “http://www.dtsc.ca.gov/HazardousWaste/RoHS.cfm.

50. UN Doc A/CONF.151/26 (Vol. I).

Additional information

Funding

The London workshop upon which this article builds was kindly funded by the British and Irish Law Education and Technology Association (BILETA) 2015–2016.