Judicial Jurisdiction over Internet Privacy Violations and the GDPR: a Case of ''Privacy Tourism''?
Vol.11,No.1(2017)
This paper discusses the impact of art. 79(2) of the General Data Protection Regulation (GDPR) in international litigation over online privacy violations. The first part introduces the tendency of the European legislator to treat private international law problems in the field of data protection as isolated and independent from the traditional secondary private international law acts. The second part analyses the current status quo of international jurisdiction over online privacy violations according to Regulation 1215/2012. After briefly examining the eDate and Martinez ruling (joined cases C-509/09 and C-161/10), it concludes that the Court of Justice of the European Union has stretched the jurisdictional grounds of art. 7(2) Regulation 1215/2012 too far in order to afford strong protection to data subjects. In that sense, it raises doubts on whether art. 79(2) was necessary. Following this conclusion, it tries to explore the uneasy relationship of GDPR art. 79(2) with the jurisdictional regime established under Regulation 1215/2012. Instead of an epilogue, the last part tries to make some reflections on the impact of GDPR art. 79(2) in privacy litigation cases involving non-EU parties.
Conflict of Laws; International Jurisdiction; Internet; Data Protection Law; Forum Shopping; Regulation (EU) 2016/679; Regulation 1215/2012
p. 7–38
Ioannis Revolidis
Institute for Legal Informatics, Leibniz University Hannover
[1] Baumgartner, S. (2017) The External Dimensions of the European Law of Civil Procedure-A Transatlantic Perspective. In: Burkhard Hess (ed.) Der Europäische Gerichtsverbund-Die internationale Dimension des europäischen Zivilverfahrensrechts. Bielefeld: Verlag Ernst und Werner Gieseking GmbH, pp. 165-199.
[2] Bogdan, M. (2013) Website Accessibility as Basis for Jurisdiction Under the Brussels I Regulation in View of New Case Law of the ECJ. In: Dan Jerker B. Svantesson and Stan Greenstein (eds.) Internationalisation of Law in the Digital Information Society. Copenhagen: Ex Tuto Publishing, pp. 159-172.
[3] Bradford, A. (2012) The Brussels Effect. Northwestern University Law Review, 107(1), pp. 1-67.
[4] Brkan, M. (2015) Data protection and European private international law: observing a bull in a China shop. International Data Privacy Law, 5(4) pp. 257-278. https://doi.org/10.1093/idpl/ipv022
[5] Bygrave, L. (2000) Determining Applicable Law pursuant to European Data Protection Legislation. Computer Law & Security Report, 16, pp. 252-257.
[6] Chen, C. (2004) United States and European Union Approaches to Internet Jurisdiction and their Impact on E-Commerce. University of Pennsylvania Journal of International Economic Law, 25(1), pp. 423-454.
[7] Coester-Waltjen, D. (1999) Internationale Zuständigkeit bei Persönlichkeitsrechts-verletzungen. In: Festschrift für Rolf A. Schütze, Munich: C.H. Beck, pp. 175-187.
[8] Congressional Research Service (2010), The SPEECH Act: The Federal Response to “Libel Tourism”. 16 September. Available from: https://fas.org/sgp/crs/misc/R41417.pdf [Accessed 7 June 2017].
[9] Dickinson, A. (2012) Royal Appointment: No Closer to an EU Private International Law Settlement? [blog entry] 24 October. Conflict Of Laws.net. Available from: http://www.conflictoflaws.net/2012/by-royal-appointment-no-closer-to-an-eu-private-international-law-settlement/ [Accessed 7 June 2017].
[10] Dougan, M. (2008) The Treaty of Lisbon 2007: Winning Minds not Hearts. Common Market Law Review, 45(3), pp. 617-703.
[11] EU Council. The Hague Programme: Strengthening Freedom, Security and Justice in the EU. Official Journal of the European Union, (2005/C 53/1) 03 March. Available from: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52005XG0303
(01)&from=EN:PDF [Accessed 7 June 2017].
[12] EU Council. The Stockholm Programme — An open and secure Europe serving and protecting citizens. Official Journal of the European Union (2010/C 115/1) 05 May. Available from: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:C:2010:
115:FULL&from=en:PDF [Accessed 7 June 2017].
[13] Feiler, L. and Forgó, N. (2017) EU-Datenschutz-Grundverordnung-Kurzkommentar. Vienna: Verlag Österreich.
[14] Feldman, M. (2010) Putting breaks on libel tourism: Examining the effects test as a basis for personal jurisdiction under New York’s Libel Terrorism Protection Act. Cardozo Law Review, 31(6), pp. 2458-2489.
[15] Geimer, R. Unionsweite Titelvollstreckung ohne Exequatur nach der Reform der Brüssel I-Verordnung. In: Festschrift für Rolf A. Schütze, Munich: C.H. Beck, pp. 109-121.
[16] Goebel, R.J. (2011) The European Union and the Treaty of Lisbon. Fordham International Law Journal, 34(5), pp. 1251-1268.
[17] Hallstein, W. (1964) Angleichung des Privat- und Prozessrechts in der Europäischen Wirtschaftsgemeinschaft. Rabels Zeitschrift für ausländisches und internationales Privatrecht, 28(2), pp. 211-231.
[18] Harpaz, G. and Herman, L. (2008) The Lisbon Reform Treaty: Internal and External Implications. European Journal of Law Reform, 10(4), pp. 431-436.
[19] Hartley, T. (2010) „Libel Tourism“ and Conflict of Laws. International and Comparative Law Quarterly, 59, pp. 25-38. https://doi.org/10.1017/S0020589309990029
[20] Heinze, C. (2011) Surf global, sue local! Der europäische Klägergerichtsstand bei Persönlichkeitsrechtsverletzungen im Internet. Europäische Zeitschrift für Wirtschaftsrecht, 22(24), pp. 947-950.
[21] Hess, B.(2010) Europäisches Zivilprozessrecht. Heidelberg: C.F. Müller Verlag.
[22] Hess, B. (2012) Der Schutz der Privatsphäre im Europäischen Zivilverfahrensrecht. Juristen Zeitung, 67(4), pp. 189-193.
[23] Hess, B. (2015) The Protection of Privacy in the Case Law of the CJEU. In: Burkhard Hess and Christina Mariottini (eds.) Protecting Privacy in Private International and Procedural Law and by Data Protection. Baden-Baden: Nomos Verlag, pp. 112-113.
[24] Hess, B. (2015) Unionsrechtliche Synthese: Mindesstandards und Verfahrens-grundsätze im acquis communitaire/Schlussfolgerungen für European Principles of Civil Procedure. In: Matthias Weller and Christoph Althammer (eds.) Mindesstandards im europäischen Zivilprozessrecht. Tübingen: Mohr Siebeck, pp. 221-235.
[25] Hill, J. (2008) Cross-border Consumer Contracts. Oxford; New York: Oxford University Press.
[26] Huber, P. (1996) Persönlichkeitsschutz gegenüber Massenmedien im Rahmen des Europäischen Zivilprozeßrechts. Zeitschrift für Europäisches Privatrecht, 4(2), pp. 295-313.
[27] Isidro, M.R. On the Abolition of Exequatur. In: Burkhard Hess and Maria Bergström and Eva Stroskrubb (eds.) EU Civil Justice: Current Issues and Future Outlook, Oxford: Hart Publishing, pp. 283-298.
[28] Jenard, P. Report on the Convention on jurisdiction and the enforcement of judgments in civil and commercial matters. Official Journal of the European Union (1979/C 59/1) 05 March. Available from: http://aei.pitt.edu/1465/1/commercial_report_jenard_C59_79.
pdf [Accessed 7 June 2017].
[29] Karg (2014) EuGH: Löschungsanspruch gegen Google-“Recht auf Vergessen”. Zeitschift für Datenschutz, 4(7), pp. 350-361.
[30] Kartheuser, I and Schmitt, F. (2016) Der Niederlassungsbegriff und seine praktischen Auswirkungen. Anwendbarkeit des Datenschutzrechtes eines Mitgliedstaats auf ausländische EU-Gesellschaften. Zeitschrift für Datenschutz, 6(4), pp. 155-159.
[31] Kartheuser, I. and Klar, M. (2014) Wirksamkeitskontrolle von Einwilligungen auf Webseiten Anwendbares Recht und inhaltliche Anforderung im Rahmen gerichtlicher Überprüfungen. Zeitschrift für Datenschutz, 4(10), pp. 500-505.
[32] Klar, M. (2017) In: Jürgen Kühling and Benedikt Büchner (eds.) Datenschutz-Grundverordnung-Kommentar. Munich: C.H. Beck, pp. 99-123.
[33] Kramer, X.E. (2013) Cross-Border Enforcement and the Brussels I-bis Regulation: Towards a New Balance between Mutual Trust and National Control over Fundamental Rights. Netherlands International Law Review, 60, pp. 343-373. https://doi.org/10.1017/S0165070X12001295
[34] Kropholler, J. and Von Hein, J. (2011) Europäisches Zivilprozessrecht-Kommentar zu EuGVO, Lugano-Übereinkommen 2007, EuVTVO, EuMVVO und EuGFVO. Frankfurt am Main: Verlag Recht und Wirtschaft GmBH.
[35] Kubis, S. (1999) Internationale Zuständigkeit Persönlichkeits- und Immaterial-güterrechtsverletzungen. Bielefeld: Verlag Ernst und Werner Giesing.
[36] Kühling, J. and Martini, M. (2016) Die Datenschutz-Grundverordnung: Revolution oder Evolution im europäischen und deutschen Datenschutzrecht? Europäische Zeitschrift für Wirtschaftsrecht, 27(12), pp. 448-454.
[37] Kuner, C. (2009) An international legal framework for data protection: Issues and prospects. Computer Law & Security Review, 25, pp. 307-317. https://doi.org/10.1016/j.clsr.2009.05.001
[38] Kuner, C. (2014) The European Union and the Search for an International Data Protection Framework. Groningen Journal of International Law, 2(1), pp. 55-71. https://doi.org/10.21827/5a86a82b67dab
[39] Lanaerts, K. (2012) Die EU – Grundrechtecharta: Anwendbarkeit und Auslegung. Europarecht, 47, pp. 3-18.
[40] Landau, E.C. (2008) A New Regime of Human Rights in the EU? European Journal of Law Reform, 10(4), pp. 557-575.
[41] Mankowfski P. (2016) In: Ulrich Magnus and Peter Mankowfski (eds.) Brussels Ibis Regulation-Commentary. Köln: Verlag Dr. Otto Schmidt KG, pp. 323-328.
[42] Martini, M. (2017) In: Boris Paal and Daniel Pauly (eds.) Datenschutz-Grundverordnung. Munich, Germany: C.H. Beck, p. 720.
[43] Marton, E. (2016) Violations of Personality Rights through the Internet: Jurisdictional Issues under European Law. Baden-Baden: Nomos Verlag; Chawley Park, Cumnor Hill, Oxford: Hart Publishing.
[44] Moerel, L. (2011) Back to basics: when does EU data protection law apply? International Data Privacy Law, 1(2), pp. 92-110. https://doi.org/10.1093/idpl/ipq009
[45] Moerel, L. (2011) The long Arm of EU data protection law: Does the Data Protection Directive apply to processing of personal data of EU citizens by websites worldwide? International Data Privacy Law, 1(1), p. 28. https://doi.org/10.1093/idpl/ipq004
[46] Moshell, R. (2005) … And then there was one: The outlook for a self-regulatory United States amidst a global trend toward comprehensive data protection. Texas Law Review, 37, pp. 357-432.
[47] Pache, E. (2002) Eine Verfassung für Europa – Krönung oder Kollaps der europäischen Integration? Europarecht, 37, pp. 767-784.
[48] Pache, E. and Rösch, F. (2009) Die neue Grundrechtsordnung der EU nach dem Vertrag von Lissabon. Europarecht, 44 , pp. 769-790.
[49] Pech, L. (2011) The Institutional Development of the EU Post – Lisbon: A case of plus ca change…?, UCD Dublin European Institute Working Paper 11 – 5, December 2011.
[50] Piltz, C. (2012) Rechtswahlfreiheit im Datenschutzrecht? Kommunikation & Recht, 15(10), pp. 640-644.
[51] Pointier, J.A. and Burg, E. (2004) EU Principles of Jurisdiction and Recognition and Enforcement of Judgements in Civil and Commercial Matters according to the case law of the European Court of Justice. The Hague: TMC Asser Press.
[52] Reich, N. (2014) General Principles of EU Civil Law. Cambridge; Antwerp; Portland: intersentia.
[53] Reymond, M. (2013) Jurisdiction in case of personality torts committed over the Internet: a proposal for a targeting test. Yearbook of Private International Law, 14, pp. 205-246.
[54] Roberts, J. (2016) Privacy Laws Pose New Threat to Free Speech [blog entry] 19 January. Fortune-Tech. Available from: http://fortune.com/2016/01/19/libel-privacy-tourism/ [Accessed 7 June 2017].
[55] Rosen, M. (2012) The SPEECH Act’s Unfortunate Parochialism: Of Libel Tourism and Legitimate Pluralism. Virginia Journal of International Law, 53(1), pp. 99-126.
[56] Sarmiento, D. (2013) Who’s afraid of the Charter? The Court of Justice, National Courts and the new Framework of Fundamental Rights Protection in Europe. Common Market Law Review, 50(3), pp. 1267-1304.
[57] Savin, A. (2013) EU Internet Law. Cheltenham; Northampton: Edward Elgar.
[58] Schmidt, J. (2015) Rechtssicherheit im europäischen Zivilverfahrensrecht. Tübingen: Mohr Siebeck.
[59] Stone P. (2006) EU Private International law. Harmonization of Laws. 2nd ed. Cheltenham, UK; Northampton MA: Edward Elgar, 2006, pp. 93-94.
[60] Svantesson, D.J.B. (2013) A “layered approach” to the extraterritoriality of data privacy laws. International Data Privacy Law, 3(4), pp. 278-286. https://doi.org/10.1093/idpl/ipt027
[61] Svantesson, D.J.B. (2013) Extraterritoriality in Data Privacy Law. Copenhagen: Ex Tuto Publishing.
[62] Svantesson, D.J.B. (2015) A Jurisprudential Justification for Extraterritoriality in (Private) International Law. Santa Clara Journal of International Law, 13(2), pp. 517-571.
[63] Svantesson, D.J.B. (2016) Against “Against Data Exceptionalism”. Masaryk University Journal of Law and Technology, 10(2), pp. 200-211. https://doi.org/10.5817/MUJLT2016-2-4
[64] Terhechte, J.P. (2008) Der Vertrag von Lissabon: Grundlegende Verfassungsurkunde der europäischen Rechtsgemeinschaft oder technischer Änderungsvertrag? Europarecht, 43, pp. 143-190. https://doi.org/10.5771/0531-2485-2008-2-143
[65] Wagner, G. (1998) Ehrenschutz und Pressfreiheit im europäischen Zivilverfahrens- und Internationalen Privatrecht. Rabels Zeitschrift für ausländisches und internationales Privatrecht, 62(2), pp. 243-285.
[66] Werkmeister, C. (2017). In: Peter Gola (ed.) Datenschutz-Grundverordnung VO (EU) 2016/679-Kommentar. Munich: C.H. Beck, p. 730.
[67] Whitman, J.Q. (2004) The Two Western Cultures of Privacy: Dignity versus Liberty. The Yale Law Journal, 113, pp. 1151-1221. https://doi.org/10.2307/4135723
[68] Woods, A.K. (2016) Against Data Exceptionalism. Stanford Law Review, 68(4), pp. 729-789.
Copyright © 2017 Masaryk University Journal of Law and Technology