For a long time, the biggest European thorns in the sides of multinational technology companies were the European Commission’s competition and tax authorities.
But a far more powerful entity has emerged quietly over the past two years. The Luxembourg-based European Court of Justice (ECJ, or, if you prefer, the CJEU) promises to reshape the business landscape, and, just as significantly, the power of governments, and not just within the EU.
When it comes to legal decisions in Europe, the euro stops at the European Court of Justice, established in 1952. The ECJ is tasked with arbitrating disputes between parties at the highest judicial level. It interprets EU-level treaties and ensures laws are applied uniformly across EU member states.
Once upon a time, the ECJ handled the practical legalities of business and governmental matters. Disputes touching on the abstractions of democracy, of human and civil rights, of privacy – the rights contained within the Council of Europe’s European Convention on Human Rights – were brought before the European Court of Human Rights (ECHR) in Strasbourg.
Or, what one legal friend tartly refers to as “the court of moral victories.”
Power
The ECHR, established by the Council of Europe in 1950, can exact fines but does not have much power to impose judicial compliance.
States can and often do simply ignore its opinions, dragging their feet on legislative response.
We’ve seen exactly that here when, in 1988, the ECHR found in Senator David Norris’s favour in his case challenging Ireland’s anti-homosexuality laws. The Irish State took a reluctant half a decade to bring in legislation to reflect that ruling.
But all has changed now thanks to the Treaty of Lisbon. When it came into force in 2009, the Charter of Fundamental Rights of the EU, which reflects the European Convention on Human Rights, became a legally binding, rather than aspirational, document. And this placed human and civil rights issues – including those involving privacy – under the remit of the ECJ, should it choose to take them.
And, it has. Oh, how it has, in several monumental opinions at a significant moment, just as privacy has come to the fore as a digital-age concern.
Starting with its April 8th, 2014 decision in a case brought by Digital Rights Ireland (DRI), the ECJ and its 28 justices have gone from being virtually invisible outside the EU to giving the US government and US tech multinationals a good, hard shake.
Judicial shift
The judgment in the DRI case – in which the court threw out the existing EU
Data
Retention Directive – was a sweeping defence of human rights, damning what the court said was effectively unwarranted, large-scale surveillance of the entire population of the EU.
That case and the specific written judgement, flagged a significant judicial shift in Europe.
It showed an ECJ ready and willing to take a firm stance on human rights, in powerful decisions that cannot be appealed, that apply to all EU states equally and demand compliance from other governments, and have immediate effect.
That case was followed closely by, first, the "right to be forgotten" decision, which requires Google and other search engines to remove links to certain types of information on individuals deemed to be outdated or incorrect.
Then, more dramatically, came the Max Schrems case, also referred from Ireland (hmmm: what could we possibly be doing wrong?). This scuppered the Safe Harbour agreement that allowed companies to process the data of EU citizens in the US.
The ECJ has appeared like a big human rights Rottweiler, baring its teeth.
Why now? The answer is complex, and uniquely European. In part, it’s because Europe’s highest court has been given a new power – the right to rule on human rights issues – which it seems eager to wield (and perhaps, take away from the ECHR).
‘Green-field’ legal area
The ECJ also is in the unusual position of ruling in what a lawyer friend terms a green-field legal area.
At this level, little case law exists in Europe relating to human rights, privacy and data protection. The ECJ is literally, laying down the law. That’s surely why the court has chosen to sit with a full panel of justices on these cases, rather than consign them, as it could, to smaller three or or five-justice panels. It knows it is making history.
And, finally, several of the justices hail from former communist countries that experienced the full impact of large-scale state-sponsored surveillance.
Perhaps the justices fear that, in between surveillance agencies on one hand and data-hungry businesses on the other, European citizens need decisions that give greater protection and bite harder than moral victories.
Whatever the ECJ’s motivation, the end result is increasingly obvious. After years of dismissing EU privacy laws as little more than annoying inconveniences, the US government and multinational tech firms (and their legal teams) gradually are realising they are dealing with a European court of the same stature, and as impossible to ignore, as US Supreme Court.
And that the buck, too, stops with the ECJ.
