Due to the fact that the International Court of Justice (ICJ) is the only court within
the United Nations legal system and focuses on interstate conflicts, no relevant case
law dealing with data protection law in the proper sense exists. Nevertheless,
national courts and international courts are aware of UN data protection law. For
example, the Spanish Constitutional Court drew attention to the aforementioned UN
Guidelines in its ruling that shaped the right to data protection as a fundamental
right.
2 The European Court of Human Rights (ECHR) mentioned the UN Guidelines
in its Bărbulescu judgment, too.
3
New political awareness was raised with the release of resolution 68/167 in 2013,
which discusses the right to privacy in the digital age. In the end of 2014, the UN
General Assembly released Resolution 69/166 that made clear, rights were the same
online and offline.
4 The United Nations Human Rights Council appointed a Special
Rapporteur on the right to privacy in 2015. In March 2016, he presented his first
annual report to the council.
5 The right to privacy in the digital age is also discussed
by Resolution 71/199 of 19 December 2016 and, inter alia, by the United Nations
Human Rights Council Resolution 34/7 of 23 March 2017. A single international
data privacy regulatory framework is yet to be seen.
6 Nevertheless, legal scholars
have identified the need for such a framework.
7 The call for a global framework does
not come surprisingly as the data protection regulation on UN level has been
described as “normatively inferior, highly fragmented, and devoid of clear institutional arrangements so as to serve as a reliable source of international digital privacy
protection”.
8
The United Nations legal framework is accompanied by sector-specific guidelines
and policies that address particular fields of UN activities such as the “Policy on the
Protection of Personal Data of Persons of Concern to UNHCR” for the United
Nations High Commissioner for Refugees. Its purpose is to ensure that UNHCR
processes personal data in a way that is consistent with the 1990 UN General
Assembly’s Guidelines for the Regulation of Computerized Personal Data Files.
One could also mention the protection of personal and family privacy under the
United Nations Convention on the Rights of Persons with Disabilities (CRPD).
Article 22 of the CRPD has been inspired by the aforementioned provisions of the
ICCPR and other privacy protection rules on UN level such as the Convention on the
Rights of the Child and the Convention on Migrant Workers.
9
2 Yilma (2018), p. 10.
3 Yilma (2018), p. 14 referencing judgment of the ECHR of 5 September 2017, application
no. 61496/08, Bărbulescu v. Romania.
4 Rotenberg (2017), p. 51.
5 Available at: http://www.ohchr.org/Documents/Issues/Privacy/A-HRC-31-64.doc.
6 Bennett and Raab (2006), note 6, p. 295; see also Raab and Koops (2009), note 14, p. 209.
7 Corley (2016), pp. 770 f. and 778.
8 Yilma (2018), p. 1.
9 Weber (2017), p. 2.
520
T. Hoeren
the United Nations legal system and focuses on interstate conflicts, no relevant case
law dealing with data protection law in the proper sense exists. Nevertheless,
national courts and international courts are aware of UN data protection law. For
example, the Spanish Constitutional Court drew attention to the aforementioned UN
Guidelines in its ruling that shaped the right to data protection as a fundamental
right.
2 The European Court of Human Rights (ECHR) mentioned the UN Guidelines
in its Bărbulescu judgment, too.
3
New political awareness was raised with the release of resolution 68/167 in 2013,
which discusses the right to privacy in the digital age. In the end of 2014, the UN
General Assembly released Resolution 69/166 that made clear, rights were the same
online and offline.
4 The United Nations Human Rights Council appointed a Special
Rapporteur on the right to privacy in 2015. In March 2016, he presented his first
annual report to the council.
5 The right to privacy in the digital age is also discussed
by Resolution 71/199 of 19 December 2016 and, inter alia, by the United Nations
Human Rights Council Resolution 34/7 of 23 March 2017. A single international
data privacy regulatory framework is yet to be seen.
6 Nevertheless, legal scholars
have identified the need for such a framework.
7 The call for a global framework does
not come surprisingly as the data protection regulation on UN level has been
described as “normatively inferior, highly fragmented, and devoid of clear institutional arrangements so as to serve as a reliable source of international digital privacy
protection”.
8
The United Nations legal framework is accompanied by sector-specific guidelines
and policies that address particular fields of UN activities such as the “Policy on the
Protection of Personal Data of Persons of Concern to UNHCR” for the United
Nations High Commissioner for Refugees. Its purpose is to ensure that UNHCR
processes personal data in a way that is consistent with the 1990 UN General
Assembly’s Guidelines for the Regulation of Computerized Personal Data Files.
One could also mention the protection of personal and family privacy under the
United Nations Convention on the Rights of Persons with Disabilities (CRPD).
Article 22 of the CRPD has been inspired by the aforementioned provisions of the
ICCPR and other privacy protection rules on UN level such as the Convention on the
Rights of the Child and the Convention on Migrant Workers.
9
2 Yilma (2018), p. 10.
3 Yilma (2018), p. 14 referencing judgment of the ECHR of 5 September 2017, application
no. 61496/08, Bărbulescu v. Romania.
4 Rotenberg (2017), p. 51.
5 Available at: http://www.ohchr.org/Documents/Issues/Privacy/A-HRC-31-64.doc.
6 Bennett and Raab (2006), note 6, p. 295; see also Raab and Koops (2009), note 14, p. 209.
7 Corley (2016), pp. 770 f. and 778.
8 Yilma (2018), p. 1.
9 Weber (2017), p. 2.
520
T. Hoeren