Thursday, 16 November 2017

Minimum Alcohol Pricing is Appropriate & Necessary: Scotch Whisky Association v Lord Advocate [2017] UKSC 76



Angus MacCulloch, Law School, Lancaster University (@AngusMacCulloch)

Lord Mance has handed down the long awaited judgment in SWA v Lord Advocate in the UK Supreme Court finally dismissing the SWA’s appeal, and permitting the Scottish Government to implement its Minimum Unit Pricing (MUP) policy in relation to retail alcohol sales. The scheme to introduce a MUP of £0.50 per unit, under the Alcohol (Minimum Pricing)(Scotland) Act 2012, has been delayed for 5 years by this legal challenge which characterised the scheme as being contrary to EU law; in that it was contrary to both Article 34 TFEU, as it was a measure having equivalent effect to a quantitative restriction on trade, and that it was contrary to the bar on price fixing under the Single CMO Regulation EU/1308/2013 covering wine.  

This is the fourth, and final, substantive judgment in this litigation. At first instance the Outer House of the Court of Session found MUP to be lawful, [2013] CSOH 70, and after receiving a response to a preliminary ruling from the Court of Justice of the EU, Case C-333/14 EU:C:2015:845, the Inner House, [2016] CSIH 77, also upheld the lawfulness of MUP. The SWA’s appeal was perhaps inevitable, but after a hearing in July 2017, the final judgment has largely confirmed the findings of both Scottish courts that the policy could be justified on the basis of the protection of public health.

By the time the case reached the Supreme Court it was largely settled that MUP could be characterised as a measure having equivalent effect to a quantitative restriction under Art 34 TFEU, and would be contrary to the Single CMO Regulation, but any restriction contrary to those provisions could be justified on the basis of public health protection. The majority of the discussion in the Supreme Court surrounded the proportionality of MUP; was there an alternate measure which could achieve MUP’s aim but which be less restrictive of trade or competition?

The Aim and Assessment of the Measure

Much of the Supreme Court judgment contains an, at times detailed, analysis of the public health evidence presented to justify the introduction of MUP. The CJEU addressed the appropriate time frame for the assessment of a measure and Lord Mance similarly adopted a permissive attitude to the question. Flexibility was given to allow the consideration of the most recent health studies, and the respondent, the Scottish Government, was permitted, at [28], to:

‘refine the aims advanced and to demonstrate that, on the material now available, the proposed measure is justified, even if it only meets an aim which is narrower than, but still falls within the scope of those originally advanced’.

Both the AG and the CJEU drew attention to the ‘two fold objective’ (CJEU [34]) of MUP, in relation to problem drinking and the general consumption of alcohol, but this flexibility allowed the Scottish Government to refocus their argument on what the new evidence showed to be the most important benefits of MUP, in relation to problem drinking, and away from the issues of general consumption. That was to their advantage when as it was seeking to justify a more targeted measure - MUP - over a more general one - increased excise duty.

The Test of Proportionality

Lord Mance opened with a consideration of the guidance set out by both AG Bot and the CJEU in relation to justification and the proportionality of restrictions under EU Law. After setting out sections of the AG’s Opinion Lord Mance characterised his approach as being a three part test: is the measure i) appropriate, ii) necessary, and iii) a balancing of the restrictive effects of the measure as opposed to possible alternatives [14]. In his assessment of the CJEU’s ruling on the question of proportionality Lord Mance found the CJEU’s test to be somewhat narrower, only relying on the first two limbs, although he did recognised that the CJEU considered some aspects of third limb within ‘necessity’. On this question of the third limb, or ‘proportionality stricto sensu’, Lord Mance posed the following rhetorical question, at [47]:

‘can it be that, provided an objective is reasonable and can only be achieved in one way, it is irrelevant how much damage results to the ordinary operation of the EU market?’

This task was described as being a comparison, ‘between two essentially incomparable values’ – health and the market [48]. It was also stressed that, ‘it was not for any court to second-guess the value which a domestic legislator may decide to put on health’ [48]. This rejection of a ‘balancing’ approach between the competing values of health and the market was important. It reduced the need for the Scottish Government to produce compelling economic evidence of the impact of MUP on future markets, but, more importantly, because it did not compel the court to weigh up, ‘the number of deaths or hospitalisations … [which were] “proportionate to” the degree of EU market interference’ [48].

The final decision on proportionality – after consideration of the new evidence and argument before the Supreme Court – was clear.

‘A critical issue is, as the Lord Ordinary indicated, whether taxation would achieve the same objectives as minimum pricing. … [T]he main point stands, that taxation would impose an unintended and unacceptable burden on sectors of the drinking population, whose drinking habits and health do not represent a significant problem in societal terms in the same way as the drinking habits and health of in particular the deprived, whose use and abuse of cheap alcohol the Scottish Parliament and Government wish to target. In contrast, minimum alcohol pricing will much better target the really problematic drinking to which the Government’s objectives were always directed and the nature of which has become even more clearly identified by the material more recently available’ [63].

This conclusive finding that MUP is the most effective way of targeting a particular pattern of problem drinking in Scotland reflects the same analysis of the evidence by the Lord Ordinary and Lord President in the Court of Session.

The other key point that Lord Mance went on to make concerned the respective roles of the Scottish Parliament, in setting health policy priorities, and the court, in assessing the proportionality of a measure. As the ‘balancing’ approach, suggested by AG Bot, had ready been rejected it is perhaps not surprising that Lord Mance restricted the role of the court.

‘the Scottish Parliament and Government have as a matter of general policy decided to put very great weight on combatting alcohol-related mortality and hospitalisation and other forms of alcohol-related harm. That was a judgment which it was for them to make, and their right to make it militates strongly against intrusive review by a domestic court’ [63].

But in perhaps the most important passage Lord Mance continued:

‘That minimum pricing will involve a market distortion, including of EU trade and competition, is accepted. However, I find it impossible, even if it is appropriate to undertake the exercise at all in this context, to conclude that this can or should be regarded as outweighing the health benefits which are intended by minimum pricing’ [63].

Given the strength of that conclusion it is difficult to see a circumstance in which a UK court presented with clear evidence of prospective health benefits from an intended public health intervention, which is predicted to prevent mortality and hospitalisations, would decide that such a measure is a disproportionate intervention.

On Evidence

The Supreme Court’s heavily reliance on the evidence base behind the adoption of MUP is unsurprising. The CJEU stressed the importance of evidence to justify a measure in both the SWA reference and Case C-148/15 DPV. There is, however, no better example of the extent to which evidence can become important, but also a significant burden (as indicated at 411) to a court, than BAT v Dept of Health [2016] EWHC 1169 (Admin).

Although the Supreme Court was heavily reliant on the wealth of modelling evidence presented to it, it did recognise that much of the evidence was, as the AG described it, ‘somewhat experimental’, and that it would difficult ‘predicting the precise reactions of markets and consumers to minimum pricing’ [62]. In that regard the Lord Mance appears to have taken comfort that the proportionality of the measure in the longer term would be assured as the Scottish Government had built a sunset clause into the Act, and that a formal review of the actual effects of the legislation would be required or it would cease to be in force after six years.

Conclusions

I have been following this case for a very long time and my initial reaction is that it is a good conclusion. The Supreme Court has made it clear, much more so than the CJEU did, that a convincing and well evidenced public health argument should, and hopefully now will, win out over trade or competition concerns. The proportionality test still has teeth. A Member State seeking to justify a measure must be clear about its aim, and it must have a good evidence base to explain and justify the effectiveness of the intervention it has chosen. But it now appears that the courts, in the UK at least, will now give some deference to the policy choices of the legislature if they stand up to that scrutiny.

It is not the courts role to second-guess policy in these areas, but I am sure that we will see new challenges if other jurisdictions attempt to introduce similar policies. Other administrations may see this case as clearing the way, but they should be careful as the decision in this case was tied to a detailed analysis of a particular Scottish problem. It is not the case that the same intervention will be appropriate or necessary everywhere else.

Barnard & Peers: chapter 15, chapter 16

Photo credit: Sky News

Wednesday, 15 November 2017

Dual citizens and EU citizenship: clarification from the ECJ




Professor Steve Peers

One of the basic rules of EU free movement law is that in principle it can only be invoked by EU citizens who are in a Member State other than their Member State of nationality. As a corollary, those EU citizens who are in the Member State of which they are a national cannot invoke free movement law – although ECJ case law in some cases allows them to claim rights on the basis of their EU citizenship instead.

So what happens if someone is a citizen of two Member States? If they are living in one of those two States, at first sight they are Schrodinger’s EU citizen: simultaneously entitled to free movement rights (as they are in a Member State other than their Member State of nationality) and not entitled to those rights (as they are in the Member State of which they are a national). In its 2011 judgment in McCarthy, the ECJ ruled that a dual citizen of two Member States (the UK and Ireland) who had not moved from the UK could not claim rights based on free movement law or EU citizenship. But did that finding rest on the mere fact that Ms McCarthy was a dual citizen of two Member States – or rather upon the fact that she was a dual citizen who had not moved between Member States?

Yesterday’s ECJ judgment in Lounes has clarified this important point. (On the background to the ruling, see Alina Tryfonidou’s analysis). It concerned a Spanish citizen who moved to the UK, who then gained UK nationality and married a non-EU citizen. She invoked free movement rights so that he could stay with her, but the UK government, having changed its law after the McCarthy ruling, argued that she was subject not to EU law, but to the more restrictive family reunion rules applicable to UK citizens.

The ECJ ruled that she was not entitled to invoke the free movement rights (including the family reunion rules) in the EU citizens’ Directive, since she was now a UK citizen in the UK. However, the Court said that she could invoke her EU citizenship based on the Treaties: for that purpose she was still regarded as a Spanish citizen who had moved within the EU. While the Treaty citizenship provisions, unlike the citizens’ Directive, contain no specific rules on family members, the Court said that she should be treated no less favourably than those covered by the Directive, as it would be unjust to treat her worse than a Spanish citizen who had moved to the UK and not acquired UK nationality.

In effect, dual citizens of two Member States who move within the EU therefore form another exception to the rule that EU citizens cannot claim free movement or citizenship rights against their Member State of nationality. They join: EU citizens who move to another Member State and return home (Surinder Singh); EU citizens who live in their State of nationality but who take up economic activity outside it (Carpenter); and EU citizens who live in their State of nationality but would be compelled to leave the EU if their non-EU parent is expelled (Ruiz Zambrano). (The ECJ most recently clarified the status of the first two categories in two 2014 rulings, which Chiara Berneri discussed here; and it most recently clarified Ruiz Zambrano cases in a spring 2017 ruling, which I discussed here).

Comments

The Court’s ruling in Lounes raises several questions. First of all, does it apply only where the EU citizen acquired the second nationality after moving to that second Member State? At first sight, the Court’s ruling suggests this. But it would be odd to deny the same rights to those who gained the second nationality earlier, upon marriage to a national of that second Member State, or to those who have had two nationalities since birth, for instance because: their parents have different nationalities; or they were born in one Member State but one or both parents is a national of another Member State; or they obtained both UK and Irish nationality because they were born in Northern Ireland. Of course, in each of those scenarios, the dual citizen would still need to move within the EU to invoke the EU citizenship rights.

What about those who lost the citizenship of one Member State when they acquired the nationality of another one? The earlier case of Scholz suggests that they, too, keep rights – although that case was decided on free movement rather than citizenship rights.

For dual citizens covered by Lounes, do all the rights derived from the citizens’ directive apply by analogy? A particular issue arises with acquiring permanent residence, where the Court previously suggested in Alarape that only those covered by the citizens’ Directive as such could gain permanent residence. (While gaining permanent residence would be irrelevant to Ms. Lounes as a citizen of the UK, it would be important to establish whether her non-EU husband could obtain that status). But that case concerned a comparison between those covered by the EU citizens’ Directive and those covered by a separate Regulation, not those covered by the Treaties. And in Lounes, the Court insisted upon the citizens’ Directive applying by analogy. So it is arguable that the permanent residence rules still apply. (See also the argument on this made in the Free Movement blog).

Finally, what happens after Brexit, for dual citizens of the UK and another Member State? For those who moved before Brexit Day, it will be important to ascertain whether the withdrawal agreement (if there is one) fully guarantees the continuation of ECJ case law on this issue, given that family reunion is still a disputed issue between the UK and EU27 sides. For those who arrive within a transition period (if one is agreed), the issue will be whether the withdrawal agreement also guarantees the full application of EU laws and case law to them. For those who arrive after that transition period ends, the issue will be whether the UK has made any commitments at all on this issue, or whether UK law only will apply – in which case more restrictive family reunion rules will apply. If there is no deal on this issue between the UK and EU27, then the UK’s more restrictive rules will apply – unless those rules change as a consequence of an election that might then follow. (Note that UK citizens living in Spain cannot obtain Spanish nationality at present).

Those who have two nationalities already, and who fall in love with someone who has a third nationality, inevitably bring out the greatest tension between the arid dictates of immigration law and the human need of family members to live their lives together. It remains to be seen whether those whom EU law has joined together, will be split asunder by Brexit. 

JHA4: chapter I:6
Barnard & Peers: chapter 27, chapter 13

Photo credit: thinkSPAIN

Monday, 6 November 2017

The EU and the Spanish Constitutional Crisis




Cecilia Rizcallah, Research Fellow at the Belgian National Fund for Scientific Research affiliated both to Université Saint-Louis Bruxelles and Université libre de Bruxelles

Background

Spain is facing, since more than a month now, a constitutional crisis because of pro-independence claims in Catalonia. These claims resulted in the holding of an independence referendum on 1 October 2017, organized by the Spanish autonomous community of Catalonia’s authorities, led by its President Mr. Carles Puigdemont. According to Barcelona, 90% of the participants voted in favor of Catalonia’s independency on a turnout of 43%.

Several weeks before the holding of the referendum, the Spanish Constitutional Court held that such plebiscite was contrary to the Spanish Constitution, and it was therefore declared void by the same Court. The Spanish central Government moreover firmly condemned this act and suspended Catalonia’s autonomy, on the basis of Article 155 of the Spanish Constitution which allows the central Government to adopt “the necessary measures to compel regional authorities to obey the law” and, thereby, to intervene in the running of Catalonia.

EU’s Incompetency in Member States’ Internal Constitutional Affairs

During these events, a contributor to the New York Times wondered “Where is the European Union?”. The Guardian stated “As Catalonia crisis escalates, EU is nowhere to be seen”. EU authorities’ restraint can yet easily be explained, at least, from a legal point of view. Indeed, the European Union has in principle neither the competence, nor the legitimacy, to intervene in its Member States’ internal constitutional affairs. Article 4.2 TEU incidentally underlines that the EU shall respect Member States’ “national identities, inherent in their fundamental structures, political and constitutional, inclusive of regional and local self-government” and that it “shall respect their essential State functions, including ensuring the territorial integrity of the State, maintaining law and order and safeguarding national security. In particular, national security remains the sole responsibility of each Member State”. The President of the Commission, J.-C. Junker stated that it was “an internal matter for Spain that has to be dealt with in line with the constitutional order of Spain” but however noted that in case of separation of Catalonia from Spain, the region would consequently “find itself outside of the European Union”. 

Puigdemont’s  Departure for Brussels

Theoretically, the EU has thus no legal standing to intervene in the Spanish constitutional crisis. Recent events have, however, brought the EU incidentally on stage.

Mr. Puigdemont, the deposed leader of Catalan authorities, left Barcelona for Brussels several days ago, where he declared he was not intended to seek asylum and that he would return in Spain if judicial authorities so request, provided he was guaranteed conditions of a fair judicial process. In the meanwhile, the State prosecutor decided to start proceedings against Mr. Puigdemont and other officials of the ousted Catalan government for rebellion, sedition and embezzlement and demanded to the judge in charge of the processing charges to issue a European arrest warrant (hereafter EAW) for Mr. Puigdemont and four other members of his former cabinet, after they failed to appear at the High Court hearing last Thursday.  The EAW was issued by the Spanish judge last week. EU law has thus been relied upon by Spanish authorities to respond to its internal crisis, because of the departure of several Catalan officials to Brussels, which constituted, at the outset at least, nothing more than a lawful exercise of their free movement rights within the Schengen area.

Mr. Puidgemont and the other people subject to a EAW presented themselves to Belgian authorities, which decided to release them upon several conditions including the prohibition to leave the Belgian territory. A Belgian Criminal Chamber has as of now two weeks to decide if they should be surrendered to Spain or not.

The Quasi-automaticity of the European Arrest Warrant System

According to Puidgemont’s Belgian lawyer, the former Catalan leader will agree to return in Spain provided that he will be guaranteed respect of his fundamental rights, including the right to an impartial and independent trial. He moreover underlined that Puidgemont will submit itself to Belgian judicial authorities which will have to assess whether or not these conditions are met.

The system of the EAW, however, entails a quasi-automaticity of the execution by requested authorities of any Member State. Indeed, because it relies upon the principle of mutual trust between Member States, requested authorities may not, save in exceptional circumstances, control the respect by the requesting State of fundamental values of the EU, including democracy and human rights. The Council Framework Decision 2002/584 of 13 June 2002, which establishes the EAW includes a limitative list of mandatory and optional grounds for refusal which does not include a general ground for refusal based on human rights protection (Articles 3 and 4). Indeed, only specific violations or risk of violations of fundamental freedoms justify the refusal to surrender, according to the Framework Decision. As far as the right to a fair trial is concerned, the Framework Decision does not include possibilities to rebut the presumption of the existence of fair proceedings in other Member States except when the EAW results from an in abstentia decision and only under certain conditions (Article 4a).  

A strong presumption of respect of EU values underlies EU criminal cooperation and the ECJ has, as of now, accepted its rebuttal on grounds of human right not included in the main text of the Framework Decision only where a serious and genuine risk of inhuman and degrading treatment existed for the convicted person in case of surrender (see the Aranyosi case, discussed here). In that respect, the lawyer of the other Catalan ministers who are already in jail has lodged a complaint for mistreatment of them, but more elements will be required to refuse the execution on the EAW on this basis.

Indeed, according to the Court of Justice, “the executing judicial authority must, initially, rely on information that is objective, reliable, specific and properly updated on the detention conditions prevailing in the issuing Member State and that demonstrates that there are deficiencies, which may be systemic or generalised, or which may affect certain groups of people, or which may affect certain places of detention”. Moreover, the domestic judge must also “make a further assessment, specific and precise, of whether there are substantial grounds to believe that the individual concerned will be exposed to that risk because of the conditions for his detention envisaged in the issuing Member State” before refusing the execution of the EAW (Aranyosi, paras 89 and 92).

Furthermore, the possibility to refuse to surrender persons convicted for political offences – which is traditionally seen as being part of the international system of protection of refugees - has been removed from the Convention on Extradition between Member States of the European Union concluded in 1996 – which is the ancestor of the current EAW system - precisely because of Member States’ duty to trust their peers’ judicial system. Interestingly, the removal of this ground for refusal had been required by Spain when it faced difficulties to obtain the extradition of Basque independentists who were seeking for protection in Belgium. The Spanish government pleaded that the ground for refusal for political infractions constituted a hurdle to criminal cooperation within the EU which was at odds with the trust that Member States should express to each other (see E. Bribosia and A. Weyembergh, “Extradition et asile: vers un espace judiciaire européen?”, R.B.D.I., 1997, pp. 69 to 98).

In the current state of EU law, no option for refusal of execution of the EAW concerning Mr. Puidgemont seems thus to exist. It is noteworthy, however, that the EAW system may, as a whole, be suspended, when the procedure provided for by Article 7 TEU is initiated if there is a (clear risk of) violation of the values referred to in Article 2 TEU on which the Union is founded, including human rights, democracy and the rule of law. Although some people have called for the initiation of this mechanism, the reliance on Article 7 is very unlikely to happen politically: it needs at least a majority of four fifths at the Council just to issue a warning, and the substantive conditions of EU values’ violations are very high.

Nonetheless, Belgium has included in its transposing legislation (Federal Law of 19 December 2003 related to the EAW) an obligatory ground of refusal – whose validity regarding EU law can seriously be put into question -  if there are valid grounds for believing that its execution would have the effect of infringing the funda­mental rights of the person concerned, as enshrined by Article 6(2) of the TEU (Art. 4, 5°). Triggering this exception will however result, in my view, in a violation of EU law by the Belgian judge since the ECJ has several times ruled that the grounds for refusal included in the Framework Decision were exhaustive and that a Member State could not rely upon its national human rights protection to refuse the execution of a EAW which respects the conditions laid down in the Framework Decision (Melloni).  Another option for the Belgian judge will be to make a reference to the ECJ for a preliminary ruling in order to ask whether, in the case at hand, the presumption of conformity with EU fundamental rights in Spain may be put aside because of the specific situation of Mr. Puidgemont.

The Quasi-Exclusion of the Asylum Right for EU Citizens

Besides asking for the refusal of his surrender to Spanish authorities, Mr. Puidgmont could - at least theoretically – seek asylum in Belgium on the basis of the Refugee Convention of 1951, which defines as refugees people with a well-founded fear of persecution for (among other things) their political opinion (Article 1.A.2).

However, Spain also requested – besides the removal of the ground for refusal to surrender a person based on the political nature of the alleged crime in the European Extradition Convention of 1996 – the enactment of Protocol No 24, on asylum for nationals of Member States of the European Union, annexed to the Treaty of Amsterdam signed in 1997. This Protocol practically removes the right of EU citizens to seek asylum in other countries of the Union.

Founding itself on the purported trustful character of Member States’ political and judicial systems and the (presumed) high level of protection of fundamental rights in the EU, the Protocol states that all Member States “shall be regarded as constituting safe countries of origin in respect of each other for all legal and practical purposes in relation to asylum matters” (Art. 1). Any application for asylum made by an EU citizen in another Member State shall therefore be declared inadmissible, except if the Member State of which the applicant is a national has decided to suspend temporarily the application of the European Convention on Human Rights in time of emergency (Article 15 of the ECHR; note that it’s not possible to suspend all provisions of the ECHR on this basis) or if this Member State has been subject to a decision based on Art. 7.1. or 7.2. TEU establishing the risk or the existence of a serious and persistent breach by the Member State of EU values referred to in Art. 2 TEU.

A Member State may also decide, unilaterally, to take an asylum demand into consideration at the double condition that it immediately informs the Council and that that the application shall be dealt with on the basis of the presumption that it is manifestly unfounded.  This last derogation has been invoked by Belgium which has adopted a declaration stating that it would proceed to an individual examination of each asylum demand of a EU citizen lodged with it. To comply with EU law, it must however consider each application manifestly unfounded rendering the burden of the proof very heavy for the EU citizen asylum seeker.  Belgian alien’s law provides for an accelerated procedure for asylum when the individual comes from an EU country (Article 57/6 2 of the Belgian Aliens Act) but statistics nevertheless show that about twenty asylum demands from EU citizens where declared founded in 2013 and 2014 by Belgian authorities.

The EU Brought on Stage…  

In both cases, the refusal to execute the EAW or the granting of an asylum right to Mr. Puidgemont would result from the consideration that the Spanish judiciary does not present the basic and essential qualities of independence and impartiality to adjudicate the case related to Catalan independence activists. This observation would likely result in a major diplomatic dispute between the two countries and, more widely, in the EU. Indeed, the consideration made by Belgium and/or the ECJ that Spain would not respect fundamental values of the EU in treating the case of Catalonia would jeopardize the essential principle of mutual trust between Member States, which is relied upon in criminal, asylum but also in civil judicial cooperation. The Spanish constitutional crisis could thereby potentially call into question the whole system of cooperation in the European Area of Freedom Security and Justice.

Barnard & Peers: chapter 25, chapter 26
JHA4: chapter I:5, chapter II:3

Photo credit: Pinterest

Friday, 3 November 2017

Who’s responsible for what happens on Facebook? Analysis of a new ECJ opinion



Lorna Woods, Professor of Internet Law, University of Essex

Who is responsible for data protection law compliance on Facebook fan sites? That issue is analysed in a recent opinion of an ECJ Advocate-General, in the case of Wirtschaftsakademie (full title: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH, in the presence of Facebook Ireland Ltd, Vertreter des Bundesinteresses beim Bundesverwaltungsgericht).

This case is one more in a line of cases dealing specifically with the jurisdiction of national data protection supervisory authorities, a line of reasoning which seems to operate separately from the Brussels I Recast Regulation, which concerns jurisdiction of courts over civil and commercial disputes.  While this is an Advocate-General’s opinion, and therefore not binding on the Court, if followed by the Court it would consolidates the Court’s prior broad interpretation of the Data Protection Directive.  While this might be the headline, it is worth considering a perhaps overlooked element of the data-economy: the role of the content provider in providing individuals whose data is harvested.

Facts

Wirtschaftsakademie set up a ‘fan page’ on Facebook.  The data protection authority in Schleswig-Holstein sought the deactivation of the fan page on the basis that visitors to the fan page were not warned that their personal data would be collected by the by means of cookies placed on the visitor’s hard disk. The purpose of that data collection was twofold: to compile viewing statistics for the administrator of the fan page; and to enable Facebook to target advertisements at each visitor by tracking the visitors’ web browsing habits, otherwise known as behavioural advertising.  Such activity must comply with the Data Protection Directive (DPD) (as implemented in the various Member States).  While the content attracting visitors was that of Wirtshaftsakademie, it relied on Facebook for data collection and analysis. It is here that a number of preliminary questions arise:

-          Who is the controller for the purposes of the data protection regime;
-          Which is the applicable national law; and
-          The scope of the national supervisory authority’s regulatory competence?

Opinion

Controller

The referring court had assumed that Wirtschaftsakademie was not a controller as it had no influence, in law or in fact, over the manner in which the personal data was processed by Facebook, and the fact that Wirtschaftsakademie had recourse to analytical tools for its own purposes does not change this [para 28]. Advocate General Bot, however, disagreed with this assessment, arguing that Wirtschaftsakademie was a joint controller for the purposes of the DPD – a possibility for which Article 2(d) DPD makes explicit provision (paras 42, 51, 52].  The Advocate General accepted that while the system was designed by Facebook so as to facilitate a data-driven business model and Wirtschaftsakademie was principally a user of the social network [para 53]. The Advocate General highlighted that without the participation of Wirtschaftsakademie the data processing in respect of the visitors to Wirtschaftsakademie could not occur; and he could end that processing by closing the relevant fan page down. In sum:

Inasmuch as he agrees to the means and purposes of the processing of personal data, as predefined by Facebook, a fan page administrator must be regarded as having participated in the determination of those means and purposes. [para 56]

Advocate General Bot further suggested that the use of the various filters included in the analytical tools provided meant that the user had a direct impact on how data was processed by Facebook. To similar effect, a user can also seek to reach specific audiences, as defined by the user.  As a result, the user has a controlling role in the acquisition phase of data processing by Facebook. The Advocate General rejected an formal analysis based on the terms of the contract concluded by the User and Facebook [para 60] and the fact that the user may be presented with ‘take it or leave it’ terms, does not affect the fact that the user may be a controller.

As a final point, the Advocate General referred to the risk of data protection rules being circumvented, arguing that:

had the Wirtschaftsakademie created a website elsewhere than on Facebook and implemented a tool similar to ‘Facebook Insights’ in order to compile viewing statistics, it would be regarded as the controller of the processing needed to compile those statistics [para 65].

A similar approach should be taken in relation to social media plug ins (such as Facebook’s like button), which allow Facebook to gather data on third party websites without the end-user’s consent (see Case C-40/17 Fashion ID, pending).

Having recognised that joint responsibility was an important factor in ensuring the protection of rights, the Advocate General – referring to the approach of the Article 29 Working Party on data protection – clarified that this did not mean that both parties would have equal responsibility, but rather their respective responsibility would vary depending on their involvement at the various stages of processing activities.

Applicable Law

Facebook is established outside the EU, but it has a number of EU established subsidiaries: the subsidiary which has responsibility for data protection is established in Ireland, while the other subsidiaries have responsibility for the sale of advertising.  This raises a number of questions: can the German supervisory authority exercise its powers and if so, against which subsidiary?

Applicable law is dealt with in Article 4 DPD, which refers to the competence of the Member State where the controller is established but which also envisages the possibility, in the case of a non-EU parent company, of multiple establishments.  The issue comes down to the interpretation of the phrase from Art. 4(1)(a), ‘in the context of the activities of an establishment’, which according to Weltimmo cannot be interpreted restrictively [para 87].  The Advocate General determined that there were two criteria [para 88]:

-          An establishment within the relevant Member State; and
-          Processing in connection with that establishment.

Relying on Weltimmo and Verein für Konsumenteninformation the Advocate General identified factors – which are based on the general freedom of establishment approach to the question of establishment looking for real activity through stable arrangements – the approach is not formalistic. Facebook Germany clearly satisfies these tests.

Referring to Article 29 Working Party Opinion 8/2010, the Advocate General re-iterated that in relation to the second criterion, it is context not location that is important. In Google Spain, the Court of Justice linked the selling of advertising (in Spain) to the processing of data (in the US) to hold that the processing was carried out in the context of the Spanish subsidiary given the economic nexus between the processing and the advertising revenue.  The business set up for Facebook here is the same, and the fact that there is an Irish office does not change the fact that the data processing takes place in the context of the German subsidiary.  The DPD does not introduce a one-stop shop; to the contrary, a deliberate choice was made to allow the application of multiple national legal systems (see Rec 19 DPD), and this approach is supported by the judgment in Verein für Konsumenteninformation in relation to Amazon.  The system will change with the entry into force of the General Data Protection Regulation (GDPR), but the Advocate General proposed that the Court should not pre-empt the entry into force of that legislation (due May 2018) in its interpretation, as the cooperation mechanism on which it depends is not yet in place [para 103].

Regulatory Competence

By contrast to Weltimmo, where the supervisory authority was seeking to impose a fine on a company established in another Member State, here the supervisory authority would be imposing German law on a German company.  There is a question, however, as to the addressee of any enforcement measure. On one interpretation, the German regulator should have the power only to direct compliance on the company established on its territory, even though that might not be effective. Alternatively, the DPD could be interpreted so as to allow the German regulator to direct compliance from Facebook Ireland. Looking at the fundamental role of controllers, Advocate General Bot suggested that this was the preferred solution. Article 28(1), (3) and (6) DPD entitle the supervisory authority of the Member State in which the establishment of the controller is located, by contrast to the position in Weltimmo, to exercise its powers of intervention without being required first to call on the supervisory authority of the Member State in which the controller is located to exercise its powers.

Comment

The novelty in this Opinion relates to the first question is significant because the business model espoused by social media companies depends on the participation of those providing content, who seem at the moment to take little responsibility for their actions.  The price paid by third parties (in terms of data) is facilitated by them, allowing them to avoid or minimise their business costs.  Should there be a consistency of enforcement applications against such users, this may gradually have an effect on the underlying platform’s business model.  While it is harder to regulate mice than elephants, at least these mice appear to be clearly within the geographic jurisdiction of the German regulator – and will remain so even when the GDPR is in force.

The Advocate General went out of his way to explain that there was no difference between the situation in issue here and that in the other relevant pending case, Case C-40/17 Fashion ID.  This case concerns the choice by a website provider to embed third party code allowing the collection of data in respect of visitors in the programming for the website for its own ends (increased visibility of and thus traffic to the website): the code in question is that underpinning the Facebook ‘like’ button, but would also presumably include similar codes from Twitter or Instagram.

If there was any doubt from cases – for example Weltimmo – about whether there is a one-stop shop (ie only one possible supervisory authority with jurisdiction across the EU) in the Data Protection Directive, the Advocate General expressly refutes this point.  In this context, it seems that this case adds little new, rather elaborating points of detail based on the precise factual set-up of Facebook operations in the EU. It seems well-established now that – at least under the DPD - clever multinational corporate structures cannot funnel data protection compliance through a chosen national regime.

It may be worth noting also the broad approach of the Advocate General to Google Spain when determining whether processing is in the context of activities. There the Court observed that:

‘in such circumstances, the activities of the operator of the search engine and those of its establishment situated in the Member State concerned are inextricably linked since the activities relating to the advertising space constitute the means of rendering the search engine at issue economically profitable and that engine is, at the same time, the means enabling those activities to be performed [Google Spain, para 56]

Here, the Advocate General focussed on the fact that social networks such as Facebook generate much of their revenue from advertisements posted on the web pages set up and accessed by users and that there is therefore an indissoluble link between the two activities.  Thus it seems that the Google Spain reasoning applies broadly to many free services paid for by user data, even if third parties – for example those providing the content on the page visited – are involved too. 

Of course, the GDPR does introduce a one-stop shop. Arguably therefore these cases are of soon to be historic interest only.  The GDPR proposes that the regulator in respect of the controller’s main EU establishment should have lead responsibility for regulation, with regulators in respect of other Member States being ‘concerned authorities’.  There are two points to note: first, there is a system in place to facilitate the cooperation of the relevant supervisory authorities Art 60), including possible recourse to a ‘consistency mechanism’ (Art 63 et seq); secondly, the competence of the lead authority to act in relation to cross-border processing in Article 66 operates without prejudice to the competence of each national supervisory authority in its own territory set out in Article 55.  The first of these two points concerns the attempt to limit regulatory arbitrage and a downward spiral of standards in the GDPR as applied and the broad approach to establishment. The interest of the recipient state in regulating means that there may be many cases involving ‘concerned authorities’.  The precise implications of the second point are not clear; note however that it seems that the one-stop shop as regards Facebook would not stop data protection authorities taking enforcement action against users such as Wirtschaftsakademie.


Photo credit: Deccan Chronicle