1. New frontiers for the right to privacy in the twenty-first century. The concept of digital privacy

The recognition of privacy as a fundamental human right dates back several decades, along with the recognition of the need to safeguard it against external violation^[3]. However, privacy rights attracted renewed attention in 2013, when the leaking of sensitive data, international espionage, and the unauthorized disclosure of information resulted in extensive media coverage and political controversy in a number of countries around the world.

These developments highlighted the new risks to which personal privacy is exposed in the Internet era and gave rise to a powerful response in terms of public opinion and at many political levels, both national and international.

One of the most important debates took place within the UN, with an exchange of views between the High Commissioner for Human Rights (Navanethem Pillay), and the UN Member States, international and regional organizations, and human rights organizations^[4].

The final report from the Commissioner was published on 30 June 2014 providing an overview of the main issues.

The starting point of the report is that the development and dissemination of Internet technologies: “[….] offer the promise of improved enjoyment of human rights”. However, at the same time “[…] in the digital era, communication technologies also have enhances the capacity of Governments, enterprises and individuals to conduct surveillance, interception and data collection”^[5].

At the heart of the Commissioner’s report lies the concern that the rights held by citizens offline must also be protected online, especially in consideration of the fact that interference in the peaceful enjoyment of rights is likely to be easier, quicker, subtler and more difficult to detect and prevent online.

2. Interferences: limits, risks and protection

Traditionally, the first concern about interference in privacy comes from the exercise of public power affecting the private life of citizens and limiting its full enjoyment.

In a democratic society this may occur frequently, but State intervention should not be arbitrary or unlawful^[6].

Interferences should not take place except in cases envisaged by the law, and national legislation needs to comply with certain requirements to be legitimate in an international perspective: it must be consistent with international Covenants; reasonable and necessary in the particular circumstances, and proportional to the aim sought.

Proportionality has become a fundamental concept, especially in recent years with measures taken to combat terrorism, and Governments adopting mass surveillance measures seeking to justify them on grounds of national security.

In her report, the Commissioner recognizes that: “[…] digital communication technologies can be, and have been, used by individuals for criminal objectives” and that “surveillance on the grounds of national security or for the prevention of terrorism or other crime may be a legitimate aim”.

This in itself is not sufficient: the measures of surveillance adopted by States must be proportionate as well (“the less intrusive instrument amongst those which might achieve the desired result”), otherwise they may be deemed to be illegitimate even if they have a legitimate purpose and have been adopted on a legal basis.

In other words, a balance should be struck between the requirements of the State and privacy safeguards.

Mention should also be made of the fact that Governments often require private enterprises to grant them direct access to the communications and personal information of their customers, and then retain this information.

Such measures may give rise to an abuse of public power^[7].

In conclusion, it is clear that violations are more frequent and less easily detected, and, as a result, it is harder for citizens to obtain a remedy^[8].

According to the UN High Commissioner: “Effective remedies to violations of privacy through digital surveillance can thus come in a variety of judicial, legislative or administrative forms”.

3. The ruling of the Court of Justice of European Union (CJEU) on the Data Retention Directive

The Courts clearly play a leading role in providing remedies to violations of the right of privacy.

It is important to consider in this connection the recent judgment of the CJEU on joined cases C-293/12 and C-594/12^[9] that casts light on digital privacy.

The Court was called upon to decide if the European Directive 2006/24, that laid down the obligation on the providers of electronic communications services to retain for a certain period of time the persona data of their costumers,^[10] was compatible with the right of privacy regulated in Article 7 of the Charter of Fundamental Rights of the European Union ^[11] and in Article 8 of the European Convention on Human Rights; and if it was compatible with Article 8 of the Charter, concerning personal data protection.

The first point of the Court’s reasoning was to ascertain whether the aims and provisions of the Directive satisfied a general interest, and the Court concluded that this was the case^[12].

However, it is widely recognized that the aim of “national security” is not sufficient: any interference by the public authorities must take place within certain limits, otherwise the fundamental rights of citizens would be infringed. EU legislation was necessary  to lay down “[…] precise rules for governing the scope and application of the measure”^[13] provided in the Directive; and here, the Court found more than one fault.

First, the Court underlined that the Directive does not specify a clear relationship between the data retained and a threat to public security; second, there is no provision determining a limit to the access to personal data by national authorities; and moreover, data protection safeguards are painfully lacking^[14]. The conclusion of the Court is that the EU legislation under scrutiny does not comply with the principle of proportionality between its scope and its concrete measures of application: as a result the Directive is invalid.

4. Conclusion

In her report the UN Commissioner  made a number of references to the judgments of European Courts, highlighting their effectiveness in identifying the matter at stake, and in providing a remedy.

However, in the collective effort to find a solution to the problem of violation of digital privacy, the Courts cannot be the sole actors.

Greater openness between States and cooperation with private intermediaries are among the first steps to take, but, for the moment, this appears to be more of a statement of principle than an effective remedy.

© Copyright Seast – All rights reserved