In several European countries, personal data protection, or informational selfdetermination, is a fundamental right, either derived from the Constitution’s general
rules, such as article 2(1) of the German Basic Law, which enshrines a “right to the
free development of one’s personality”,
14 and article 2 of the Italian Constitution,
which establishes that “the Republic recognizes and guarantees the inviolable rights
of the person, both as an individual and in the social groups where human personality
is expressed”
15 ; or contained in specific provisions, such as article 35 of the
Portuguese Constitution,
16 and article 9A of the Greek Constitution.
17
Informational self-determination comprises, according to an authoritative definition in German literature:
the right of a person to decide for herself on whether, when, the contents of, as well as the
form of the use and disclosure of her personal data.
18
Some countries have, however, refrained from adopting European-style comprehensive data protection rules and follow instead a sector-specific approach: such is
the case of the United States of America, the law of which relies in this respect on a
combination of federal and state-level legislation, administrative regulations and
self-regulation instruments.
19
Although the Privacy Act was adopted in the U.S. in 1974, it only applies to the
collection, maintenance, use, and dissemination of information about individuals
that is maintained in systems of records by federal agencies. For their most part, data
protection rules in force in this country are contained in a myriad of consumer
protection regulations. The right to privacy is, to be sure, protected under the
Constitution of the United States,
20 but so is free speech, to which the First
Amendment expressly refers and on which data protection laws potentially impinge.
Unsurprisingly, no constitutional right to personal data protection is enshrined in the
American Constitution.
21
14 See the German National Report, Sect. 1.1.
15 See the Italian National Report, Sect. 2.1.
16 See the Portuguese National Report, Sect. 1.
17 See the Greek National Report, Sect. 1.1.
18 See Larenz and Wolf (2004), p. 137: “Die informationelle Selbstbestimmung umfasst das Recht
der Person, selbst über das Ob, die Zeit, den Inhalt sowie die Art und Weise der Verwendung und
Preisgabe ihrer persönlichen Daten zu entscheiden”. For a more recent analysis of this theme, see
Sousa Pinheiro (2015) and van der Sloot (2017).
19 See, for a detailed description of those sources, the United States of America’s National Report,
Sect. 1.
20 Although the exact extent to which it is so is far from settled in case-law and legal literature: see,
on this, Prosser (1960); Fried (1968); Rubenfeld (1989); and Post (2001).
21 See, however, arguing for the constitutional recognition of a right to information selfdetermination, as part of the substantive due process liberty elaborated on by the U.S. Supreme
Court, Eberle (2001).
Data Protection in the Internet: General Report
5
rules, such as article 2(1) of the German Basic Law, which enshrines a “right to the
free development of one’s personality”,
14 and article 2 of the Italian Constitution,
which establishes that “the Republic recognizes and guarantees the inviolable rights
of the person, both as an individual and in the social groups where human personality
is expressed”
15 ; or contained in specific provisions, such as article 35 of the
Portuguese Constitution,
16 and article 9A of the Greek Constitution.
17
Informational self-determination comprises, according to an authoritative definition in German literature:
the right of a person to decide for herself on whether, when, the contents of, as well as the
form of the use and disclosure of her personal data.
18
Some countries have, however, refrained from adopting European-style comprehensive data protection rules and follow instead a sector-specific approach: such is
the case of the United States of America, the law of which relies in this respect on a
combination of federal and state-level legislation, administrative regulations and
self-regulation instruments.
19
Although the Privacy Act was adopted in the U.S. in 1974, it only applies to the
collection, maintenance, use, and dissemination of information about individuals
that is maintained in systems of records by federal agencies. For their most part, data
protection rules in force in this country are contained in a myriad of consumer
protection regulations. The right to privacy is, to be sure, protected under the
Constitution of the United States,
20 but so is free speech, to which the First
Amendment expressly refers and on which data protection laws potentially impinge.
Unsurprisingly, no constitutional right to personal data protection is enshrined in the
American Constitution.
21
14 See the German National Report, Sect. 1.1.
15 See the Italian National Report, Sect. 2.1.
16 See the Portuguese National Report, Sect. 1.
17 See the Greek National Report, Sect. 1.1.
18 See Larenz and Wolf (2004), p. 137: “Die informationelle Selbstbestimmung umfasst das Recht
der Person, selbst über das Ob, die Zeit, den Inhalt sowie die Art und Weise der Verwendung und
Preisgabe ihrer persönlichen Daten zu entscheiden”. For a more recent analysis of this theme, see
Sousa Pinheiro (2015) and van der Sloot (2017).
19 See, for a detailed description of those sources, the United States of America’s National Report,
Sect. 1.
20 Although the exact extent to which it is so is far from settled in case-law and legal literature: see,
on this, Prosser (1960); Fried (1968); Rubenfeld (1989); and Post (2001).
21 See, however, arguing for the constitutional recognition of a right to information selfdetermination, as part of the substantive due process liberty elaborated on by the U.S. Supreme
Court, Eberle (2001).
Data Protection in the Internet: General Report
5