We actually lost the crypto wars

Dr. Christopher Kuner is Director of the Brussels Privacy Hub at the Vrije Universiteit Brussel (VUB) and an Honorary Professor at the University of Copenhagen, an Honorary Fellow of the Centre for European Legal Studies, University of Cambridge, and Senior Privacy Counsel in the Brussels office of the international law firm Wilson Sonsini Goodrich & Rosati. He is also editor-in-chief of the journal International Data Privacy Law published by Oxford University Press. In this post he looks at the crypto wars of the 1990s and argues that the Snowden revelations have shown that when it comes to the Internet, we can never be sure we have won privacy battles

The Court of Justice of the EU judgment on data protection and internet search engines

In Case C-131/12 Google Spain v. AEPD and Mario Costeja Gonzalez, issued on 13 May 2014, the Court of Justice of the European Union made several important pronouncements about EU data protection law, and in particular recognized a right under the EU Data Protection Directive 95/46 for individuals to suppress links generated by Internet search engines (popularly referred to as the “right to be forgotten”). The Court’s holdings leave many important questions open, both in regard to technical legal issues and more high-level issues of general jurisprudential and societal importance. The Court also failed to take the significance of the case for the Internet into account. The judgment suffers from the Court’s traditionally minimalist style of argument and reluctance to adopt a more open and discursive style. The material and territorial scope of the right to suppress Internet search engine results are potentially much wider than the ability to implement the right effectively, suggesting that a way must be found to define the scope of the right in a way that is proportionate to the ability to implement it, if the judgment is to provide real protection in practice

The internet and the global reach of EU law

EU law has significant influence on the Internet and parties outside the EU’s territorial boundaries that use it and are affected by it. The Internet has enabled the EU to extend to third countries the application of its fundamental values, including the autonomy of EU law, the rule of law, and fundamental rights. There are many examples of the EU exerting its global reach regarding the Internet, particularly in data protection law, but also in areas such as Internet governance, international agreements, and private international law. This occurs through a variety of mechanisms, including emulation and learning; international negotiation; coercion and conditionality; and blocking recognition of third country legal measures. The EU’s actions in exercising its global reach implicate important normative issues, such as distinguishing between the furtherance of core EU legal values and the advancement of the EU’s political interests; promoting the principles of EU law as universal values; ensuring that EU legal values are upheld in practice; and determining the territorial boundaries of EU law. The influence exercised by the EU carries responsibilities towards third countries, particularly those in the developing world. The Internet may also be influencing EU law, as is shown by the changing role of the Court of Justice