1
Privacy & Data Protection: Case Law
- ECtHR
- CJEU
Lecture 2: Context and background of European data protection law
Case Topic Facts Legal question Solution
CJEU Digital Rights Ireland 2014 Cases involving two rights Directive 2006/24/EC required Is the Directive an interference Even though it pursued a
providers of publicly available e- with the fundamental right to data legitimate aim, the interference
communication services or public protection? with the rights to personal data
communication networks to retain protection and private life was
citizens’ telecommunication data serious and not limited to what
for up to two years in order to was strictly necessary.
prevent serious crime.
→ The Directive was declared
invalid.
Justified interference (art. 8 ECHR)
ECtHR Rotaru v Romania 2000 Requirement (1) in accordance - Applicant alleged a violation Was there an interference with - Domestic law did not lay down
with the law because the Romanian article 8 ECHR by the any limits on gathering,
Intelligence Service held and Intelligence Service? recording and archiving secret
used a file containing his files of information.
personal information - The Court concluded that
domestic law did not comply
with the requirement of
foreseeability.
→ violation of article 8 ECHR
ECtHR Taylor-Sabori v the Requirement (1) in accordance - Police intercepted messages Was there an interference with The interference with his rights
United Kingdom 2002 with the law sent to applicant and arrested article 8 ECHR by the Police? had not been in accordance with
him. the law.
- However, at that time there
was no provision in British law → violation of article 8 ECHR
governing such interception.
, 2
ECtHR Vukota-Bojić v Requirement (1) in accordance - A private insurance company Was the surveillance in Domestic law failed to indicate
Switzerland 2016 with the law commissioned private accordance with the law? with sufficient clarity the scope
investigators to surveil a social and manner of exercise of the
insurance claimant discretion conferred on insurance
- The State had provided them companies acting as public
the right to provide benefits authorities in insurance disputes.
arising from compulsory
medical insurance and to → violation of article 8 ECHR
collect insurance premiums
ECtHR Peck v the United Requirement (2) pursuing a - The applicant attempted Was the publishing of the footage There were no relevant or
Kingdom 2003 legitimate aim suicide unaware that CCTV pursuing a legitimate aim? sufficient reasons to disclose that
was filming him. footage without the applicant’s
- The police rescued him and consent.
subsequently passed the
footage to the media who → violation of article 8 ECHR
published it without masking
the applicant’s face
ECtHR Khelili v Switzerland Requirement (3) necessary in a - The applicant alleged that the Could a pressing social need - The allegation of unlawful
2011 democratic society police entered her name in within the meaning of art. 8 prostitution appeared to be too
their records as a prostitute, ECHR be identified and thus vague and general. It was not
which is an occupation she necessity in a democratic society? supported by concrete facts
denied so she wants it to be and therefore no pressing
deleted. social need within the meaning
of art 8 ECHR could be
identified.
- Also the retention of the word
prostitute in the police files for
years had not been necessary in
a democratic society.
→ violation of article 8 ECHR
, 3
ECtHR S. and Marper v the Requirement (3) necessary in a - Two applicants arrested & Was the retention of the DNA - The Court found this
United Kingdom 2008 democratic society charged with criminal offences profiles necessary in a democratic unjustified. It recalled that
but never convicted. The police society? - The core principles of data
decided to store and keep their protection ECtHR Leander v
DNA profiles in the database. Sweden 1987 require the
- UK: the retention assists in the retention of personal data to be
identification of future proportionate in relation to the
offenders, and thus pursued a collection purpose and that
legitimate aim. retention periods must be
limited.
- The interference could not be
regarded as necessary in a
democratic society.
→ violation of article 8 ECHR
ECtHR Leander v Sweden 1987 Requirement (3) necessary in a - A secret scrutiny was Was the secret scrutiny necessary - Due to these safeguards, the
democratic society performed on people applying in a democratic society? Court concluded that the
for employment in posts of Swedish personnel control
importance for national system met the requirements of
security. art. 8.2 ECHR.
- Special safeguards were laid - The interests of national
down in national law for security prevailed over
protecting the interests of the individual ones.
data subject.
→ no violation article 8 ECHR
Justified interference (art. 52(1) Charter)
CJEU Schrems 2015 Requirement (2) respect the - Schrems’ personal data were Do the Safe Harbour Principles - The Principles are deemed as
essence of the right transferred from Facebook’s respect the essence of the right ‘compromising the essence of
Irish subsidiary to Facebook guaranteed by art. 7 Charter? the fundamental right to
Inc in the US, where they were respect for private life, as
processed. guaranteed by art. 7 Charter’.
- He argued that US law did not - The CJEU invalidated the Safe
offer sufficient data protection Harbour decision and there
(Safe Harbour Principles) was
- The US legislation permits
public authorities to access, on → violation of art. 52(1) Charter
a general basis, the content of
electronic communications → no respect for the essence of
art. 7 Charter
, 4
CJEU Digital Rights Ireland 2014 Requirement (2) respect the - Directive 2006/24/EC leading Does the interference respect the The interference did not
essence of the right to retaining citizens’ essence of the rights and compromise the essence of the
telecommunication data for up freedoms? rights:
to two years in order to prevent
serious crime. The right to privacy:
The directive did not permit the
acquisition of knowledge of the
content of the messages
The right to personal data
protection:
The directive required e-
communications providers to
respect certain principles of
protection / security and
implement appropriate technical /
organisational measures to this
end.
→ no violation of art. 52(1)
CJEU Volker und Markus Scheck Requirement (3) necessity and - Through two regulations the Was the obligation necessary and - The Council and the
2010 proportionality Council and the Commission proportional? Commission had exceeded the
imposed an obligation to limits imposed by the principle
publish personal data relating of proportionality.
to each natural person who was - Certain provisions of the
a beneficiary of aid from regulations were declared
certain agricultural funds. invalid and one in its entirety.
- There was no distinction based
on relevant criteria. → violation of art. 52(1)
Privacy & Data Protection: Case Law
- ECtHR
- CJEU
Lecture 2: Context and background of European data protection law
Case Topic Facts Legal question Solution
CJEU Digital Rights Ireland 2014 Cases involving two rights Directive 2006/24/EC required Is the Directive an interference Even though it pursued a
providers of publicly available e- with the fundamental right to data legitimate aim, the interference
communication services or public protection? with the rights to personal data
communication networks to retain protection and private life was
citizens’ telecommunication data serious and not limited to what
for up to two years in order to was strictly necessary.
prevent serious crime.
→ The Directive was declared
invalid.
Justified interference (art. 8 ECHR)
ECtHR Rotaru v Romania 2000 Requirement (1) in accordance - Applicant alleged a violation Was there an interference with - Domestic law did not lay down
with the law because the Romanian article 8 ECHR by the any limits on gathering,
Intelligence Service held and Intelligence Service? recording and archiving secret
used a file containing his files of information.
personal information - The Court concluded that
domestic law did not comply
with the requirement of
foreseeability.
→ violation of article 8 ECHR
ECtHR Taylor-Sabori v the Requirement (1) in accordance - Police intercepted messages Was there an interference with The interference with his rights
United Kingdom 2002 with the law sent to applicant and arrested article 8 ECHR by the Police? had not been in accordance with
him. the law.
- However, at that time there
was no provision in British law → violation of article 8 ECHR
governing such interception.
, 2
ECtHR Vukota-Bojić v Requirement (1) in accordance - A private insurance company Was the surveillance in Domestic law failed to indicate
Switzerland 2016 with the law commissioned private accordance with the law? with sufficient clarity the scope
investigators to surveil a social and manner of exercise of the
insurance claimant discretion conferred on insurance
- The State had provided them companies acting as public
the right to provide benefits authorities in insurance disputes.
arising from compulsory
medical insurance and to → violation of article 8 ECHR
collect insurance premiums
ECtHR Peck v the United Requirement (2) pursuing a - The applicant attempted Was the publishing of the footage There were no relevant or
Kingdom 2003 legitimate aim suicide unaware that CCTV pursuing a legitimate aim? sufficient reasons to disclose that
was filming him. footage without the applicant’s
- The police rescued him and consent.
subsequently passed the
footage to the media who → violation of article 8 ECHR
published it without masking
the applicant’s face
ECtHR Khelili v Switzerland Requirement (3) necessary in a - The applicant alleged that the Could a pressing social need - The allegation of unlawful
2011 democratic society police entered her name in within the meaning of art. 8 prostitution appeared to be too
their records as a prostitute, ECHR be identified and thus vague and general. It was not
which is an occupation she necessity in a democratic society? supported by concrete facts
denied so she wants it to be and therefore no pressing
deleted. social need within the meaning
of art 8 ECHR could be
identified.
- Also the retention of the word
prostitute in the police files for
years had not been necessary in
a democratic society.
→ violation of article 8 ECHR
, 3
ECtHR S. and Marper v the Requirement (3) necessary in a - Two applicants arrested & Was the retention of the DNA - The Court found this
United Kingdom 2008 democratic society charged with criminal offences profiles necessary in a democratic unjustified. It recalled that
but never convicted. The police society? - The core principles of data
decided to store and keep their protection ECtHR Leander v
DNA profiles in the database. Sweden 1987 require the
- UK: the retention assists in the retention of personal data to be
identification of future proportionate in relation to the
offenders, and thus pursued a collection purpose and that
legitimate aim. retention periods must be
limited.
- The interference could not be
regarded as necessary in a
democratic society.
→ violation of article 8 ECHR
ECtHR Leander v Sweden 1987 Requirement (3) necessary in a - A secret scrutiny was Was the secret scrutiny necessary - Due to these safeguards, the
democratic society performed on people applying in a democratic society? Court concluded that the
for employment in posts of Swedish personnel control
importance for national system met the requirements of
security. art. 8.2 ECHR.
- Special safeguards were laid - The interests of national
down in national law for security prevailed over
protecting the interests of the individual ones.
data subject.
→ no violation article 8 ECHR
Justified interference (art. 52(1) Charter)
CJEU Schrems 2015 Requirement (2) respect the - Schrems’ personal data were Do the Safe Harbour Principles - The Principles are deemed as
essence of the right transferred from Facebook’s respect the essence of the right ‘compromising the essence of
Irish subsidiary to Facebook guaranteed by art. 7 Charter? the fundamental right to
Inc in the US, where they were respect for private life, as
processed. guaranteed by art. 7 Charter’.
- He argued that US law did not - The CJEU invalidated the Safe
offer sufficient data protection Harbour decision and there
(Safe Harbour Principles) was
- The US legislation permits
public authorities to access, on → violation of art. 52(1) Charter
a general basis, the content of
electronic communications → no respect for the essence of
art. 7 Charter
, 4
CJEU Digital Rights Ireland 2014 Requirement (2) respect the - Directive 2006/24/EC leading Does the interference respect the The interference did not
essence of the right to retaining citizens’ essence of the rights and compromise the essence of the
telecommunication data for up freedoms? rights:
to two years in order to prevent
serious crime. The right to privacy:
The directive did not permit the
acquisition of knowledge of the
content of the messages
The right to personal data
protection:
The directive required e-
communications providers to
respect certain principles of
protection / security and
implement appropriate technical /
organisational measures to this
end.
→ no violation of art. 52(1)
CJEU Volker und Markus Scheck Requirement (3) necessity and - Through two regulations the Was the obligation necessary and - The Council and the
2010 proportionality Council and the Commission proportional? Commission had exceeded the
imposed an obligation to limits imposed by the principle
publish personal data relating of proportionality.
to each natural person who was - Certain provisions of the
a beneficiary of aid from regulations were declared
certain agricultural funds. invalid and one in its entirety.
- There was no distinction based
on relevant criteria. → violation of art. 52(1)
