The protection of natural persons in relation to the processing of personal data is
considered a fundamental right under EU law.
12 Article 8(1) of the Charter of
Fundamental Rights of the European Union (‘the Charter’) and Article 16(1) of
the Treaty on the Functioning of the European Union (TFEU) provide that everyone
has the right to the protection of personal data concerning him or her. The CJEU had
previously made clear that Union data protection law establish a specific and
reinforced system of protection compared with the right to privacy
13 which is laid
down in Article 7 of the Charter. Notwithstanding this, both the CJEU and the
European Court of Human Rights (ECtHR) tend to treat data protection as closely
related to the right to privacy. It is noteworthy that the European Convention on
Human Rights (ECHR) has no corresponding provision to Article 8 of the Charter
which addresses specifically the fundamental right to data protection and provides
that personal data must be processed fairly for specified purposes and on the basis of
the consent of the person concerned or on some other legitimate basis laid down by
law. In the absence of a similar provision, the ECtHR has derived the right of data
protection from Article 8 of the ECHR on the right to privacy.
14 From the perspective of EU law, it can be considered that both rights are closely linked and overlap to
a significant extent but differences in their respective scopes may also be identified.
For instance, EU legislation on data protection is limited to information relating to
natural persons but the right to privacy encompasses legal persons.
15
The CJEU has constantly held that EU Data Protection Law, in so far as it governs
the processing of personal data liable to infringe fundamental freedoms, must
necessarily be interpreted in the light of the fundamental rights guaranteed by the
Charter
16 (and the case-law cited). Given the position of data protection law as a
fundamental right the case-law of the CJEU on the balancing of the fundamental
right to data protection with others, such as the protection of intellectual property, the
fundamental freedom to conduct a business enjoyed by internet intermediaries,
17 has
become particularly significant.
12 See on this matter González Fuster (2014).
13 Judgment of the CJEU of 29 June 2010, Comisión/Bavarian Lager, C-28/08 P, ECLI:EU:
C:2010:378.
14 See Judgments of the ECtHR of 16 February 2000, Amann v. Switzerland, App. no. 27798/95,
para. 65; and 4 May 2000, Rotaru v. Romania, App. No. 28341/95, para. 43, available at http://
hudoc.echr.coe.int.
15 Kokottand and Sobotta (2013), p. 225.
16 See Judgment of the CJEU of 6 October 2015, C-362/14, Schrems v. Data Protection Commissioner, ECLI:EU:C:2015:6506, para. 38, with further references.
17 See, e.g., Judgments of the CJEU of 24 November 2011, Scarlet Extended SA v. Société belge des
auteurs, compositeurs et éditeurs SCRL (SABAM), C-70/10, ECLI:EU:C:2011:771; of 16 February
2012, Belgische Vereniging van Auteurs, Componisten en Uitgevers CVBA (SABAM) v. Netlog NV,
C-360/10, ECLI:EU:C:2012:85; and 19 April 2012, Bonnier Audio and Others v. Perfect Communication Sweden AB, C-461/10, ECLI:EU:C:2012:219.
460
P. A. de Miguel Asensio
considered a fundamental right under EU law.
12 Article 8(1) of the Charter of
Fundamental Rights of the European Union (‘the Charter’) and Article 16(1) of
the Treaty on the Functioning of the European Union (TFEU) provide that everyone
has the right to the protection of personal data concerning him or her. The CJEU had
previously made clear that Union data protection law establish a specific and
reinforced system of protection compared with the right to privacy
13 which is laid
down in Article 7 of the Charter. Notwithstanding this, both the CJEU and the
European Court of Human Rights (ECtHR) tend to treat data protection as closely
related to the right to privacy. It is noteworthy that the European Convention on
Human Rights (ECHR) has no corresponding provision to Article 8 of the Charter
which addresses specifically the fundamental right to data protection and provides
that personal data must be processed fairly for specified purposes and on the basis of
the consent of the person concerned or on some other legitimate basis laid down by
law. In the absence of a similar provision, the ECtHR has derived the right of data
protection from Article 8 of the ECHR on the right to privacy.
14 From the perspective of EU law, it can be considered that both rights are closely linked and overlap to
a significant extent but differences in their respective scopes may also be identified.
For instance, EU legislation on data protection is limited to information relating to
natural persons but the right to privacy encompasses legal persons.
15
The CJEU has constantly held that EU Data Protection Law, in so far as it governs
the processing of personal data liable to infringe fundamental freedoms, must
necessarily be interpreted in the light of the fundamental rights guaranteed by the
Charter
16 (and the case-law cited). Given the position of data protection law as a
fundamental right the case-law of the CJEU on the balancing of the fundamental
right to data protection with others, such as the protection of intellectual property, the
fundamental freedom to conduct a business enjoyed by internet intermediaries,
17 has
become particularly significant.
12 See on this matter González Fuster (2014).
13 Judgment of the CJEU of 29 June 2010, Comisión/Bavarian Lager, C-28/08 P, ECLI:EU:
C:2010:378.
14 See Judgments of the ECtHR of 16 February 2000, Amann v. Switzerland, App. no. 27798/95,
para. 65; and 4 May 2000, Rotaru v. Romania, App. No. 28341/95, para. 43, available at http://
hudoc.echr.coe.int.
15 Kokottand and Sobotta (2013), p. 225.
16 See Judgment of the CJEU of 6 October 2015, C-362/14, Schrems v. Data Protection Commissioner, ECLI:EU:C:2015:6506, para. 38, with further references.
17 See, e.g., Judgments of the CJEU of 24 November 2011, Scarlet Extended SA v. Société belge des
auteurs, compositeurs et éditeurs SCRL (SABAM), C-70/10, ECLI:EU:C:2011:771; of 16 February
2012, Belgische Vereniging van Auteurs, Componisten en Uitgevers CVBA (SABAM) v. Netlog NV,
C-360/10, ECLI:EU:C:2012:85; and 19 April 2012, Bonnier Audio and Others v. Perfect Communication Sweden AB, C-461/10, ECLI:EU:C:2012:219.
460
P. A. de Miguel Asensio