Amazon Dash – the company’s single purpose internet-connected ordering button – may soon be blackening our skies with drones delivering loo rolls and detergent. And so, the relentless march of technology – not to mention cheap labour, unthinking consumerism and scandalous environmental devastation – goes on.
But while more convenient ordering of washing powder might have captured the headlines of late, Europe has been in the midst of a technological step change; a pivot in the world of data privacy.
Several notable events at the end of March, in Luxembourg, London and Geneva, show a glimmer of hope that those frail, beaten rights – privacy and data protection – might yet see their true worth in the digital age.
A moment, first, in defence of privacy – reports of whose death are, I hope, greatly exaggerated.
Privacy is a right for all – not just the filthy rich
Many fall into the trap of seeing privacy in an overly atomistic, individualistic, selfish way; the preserve of the filthy rich. And it is, if we see it as separable from collective freedom, or as absolute over other rights – of freedom of expression, opinion and association; freedom to protest; freedom to resist. But this is not privacy’s ask.
Privacy is about having decisional power, control, over which acts and events of our lives are disclosed and to whom, free from the prying eyes of states, corporations and neighbours. Privacy affords us the freedom to develop ourselves in the world.
The crux of the issue with digital technology is that our ability to make decisions and to control our personal information – the links and traces of our lives – is all but lost. Mostly without our knowledge, and certainly without informed consent, nation states sweep our data alleging ‘national security’ interests, whether legitimate or not. Corporations sweep our data, because they have powerful economic incentives to do so – and, with the capitalist lurch, no reason not to.
So what can be done to reclaim this systematic erosion; to reinstate rights over the long echo of our digital whispers and wanderings? In Europe, there are some rumblings of resistance. They are the rumblings of citizens, of regulators, of courts. And they are starting to find their voice.
No safe harbours: Schrems and the emboldened Court of Justice
On 24 March in Luxembourg, the Court of Justice of the European Union heard Austrian Max Schrems’ lawsuit against Facebook over the storage, security and treatment of European users’ data. In particular, it explored cooperation between Facebook and US intelligence agencies in sharing private information through Prism and other clandestine surveillance programmes.
The Schrems case is politically charged, thrust into the tense commercial and intergovernmental relations between the EU and US over data privacy, and particularly the imperilled ‘safe harbour’ regime, which has governed cross-border data transfers for the past 15 years.
The most striking feature of the hearing was that it showed an emboldened court in full flight – confident in its role, willing to challenge and test executive and legislative authority, and determined to respect fundamental rights both to privacy and data protection. The tenor of the questioning shows that the court is not afraid to challenge dogma – and that the security and privacy landscape, at least regionally, is prone to a shake-up.
It will have been given fuel by the discovery, revealed in the Guardian, that Facebook spies on virtually all European web users, even those who have opted out of its services, for up to two years.
The CJEU has become the unlikely hero of data privacy in Europe; from its remarkable decision a year ago invalidating the European data retention directive (leaving the UK and France relatively marooned); to the dramatic right to be forgotten case, which continues to have far-reaching effects; and the lesser-known Ryneš decision, last December, which confirmed that images collected in public spaces are subject to the full force of data protection.
If ex-NSA contractor Edward Snowden’s disclosures about the vast extent of digital surveillance issued a gunshot, then the European Parliament absorbed it, and the CJEU is now deflecting it. So much so that it has even reached the UK.
Opening the gates: Vidal-Hall and UK compensation claims
The UK is not particularly known as a stronghold of data protection and privacy. But that may have changed with a significant Court of Appeal case on 27 March – Vidal-Hall, which concerned claims by Apple Safari browser users against Google over secret tracking and collation of their browser-generated information and its sale to advertisers.
Vidal-Hall was a procedural decision, but it cleared the way for claims against international tech companies for the tort of misuse of private information, as well as confirming the availability of damages under the UK Data Protection Act for non-financial losses, such as anxiety and distress.
The court recognised that browser-generated information is often of an extremely private nature, and that the intrusion upon autonomy caused by secret and blanket tracking may cause distress – “the damages may be small, but the issues of principle are large”.
Vidal-Hall offers the final puzzle piece for a robust domestic privacy and data protection regime. By affording court remedies, the case creates additional pressure for business models that offer users real control over their personal data. The challenge now is to stop it descending into a feast for lawyers and claim farms.
Report kings: The UN and the new special rapporteur on privacy
Finally, and moving away from the courts, on 26 March, the UN Human Rights Council issued a resolution establishing a special rapporteur on privacy – the latest step in the Germany and Brazil-led coalition, initiated after the Snowden revelations, to bring privacy in the digital age to the United Nations.
The special rapporteur joins 25 positions dedicated to protecting and promoting human rights. It is a positive institutional development, formally recognising privacy’s significance, and spurring norm-development and in-country studies, with UN priorities such as the integration of a gender perspective (a neglected but crucial aspect of privacy).
But there are some dangers. The special rapporteur has such a broad remit that it could get diverted into dealing with every privacy issue under the sun, therefore neutralising its potential value in addressing data privacy.
In addition, given that the UN special rapporteur on counter-terrorism and the High Commissioner of Human Rights both issued damning reports on mass surveillance, one might wonder what impact a September report from the new privacy rapporteur will have, as against the barrelling expansion of privacy-eroding laws worldwide.
The more pernicious concern is that the new special rapporteur on privacy could mean the issue is removed from counter-terror and human rights – where it has a critically important role – as well as giving the illusion of movement on digital surveillance when, in reality, what we need is more action, less reports.
Where do we go from here?
Almost all of our new and much-vaunted technological advances – the app economy, drones, self-driving cars, the internet of things – pose unprecedented and, as presently conceived, unjustified trade offs with our autonomy, privacy and data rights.
There are signals and small flames of hope, however, that the balance can be readjusted, that corporate and governmental restraint can be introduced to digital platforms, and that citizens can be put back in the driving seat. Schrems and Vidal-Hall are two cases that are among the brightest, and the UN is our best existing mechanism for limiting the sovereignty of states for unbridled surveillance.
The challenge – and the question – is whether these cases and initiatives will develop in positive directions and, even if that’s the case, if this is too little, too late.
The challenge articulated 15 years ago by scholar Michael Froomkin stands as true as the day he said it:
“There is no magic bullet, no panacea. If the privacy pessimists are to be proved wrong, the great diversity of new privacy-destroying technologies will have to be met with a legal and social response that is at least as subtle and multifaceted as the technological challenge. Given the rapid pace at which privacy-destroying technologies are being invented and deployed, a legal response must come soon, or it will indeed be too late.”