The English Court of Appeal has recently issued a landmark judgment against Google which could open the door to data privacy litigation in the EU.
The case concerned the collection by Google of Safari users’ browser information, allegedly without their knowledge or consent. In its opinion, the Court of Appeal held that four individuals who used Safari browsers can bring a claim for breach of privacy and that the damages claimed can include distress – even in circumstances where there is no financial loss, as this had been the intention of the EU’s Data Protection Directive. To reach this result, the Court relied on EU legal authorities to override and displace limitations on recovery under the UK Data Protection Act.
On May 4, 2015, an intermediate appellate court in California held that the Song-Beverly Credit Card Act of 1971 (Song-Beverly), Cal. Civil Code § 1747.08, does not apply to online transactions involving the sale of merchandise that the buyer chooses to pick up at a retail store.
A few key takeaways shape the contours of litigation in these areas over the past 14 months.
California has been experiencing a wave of putative class actions under the California Invasion of Privacy Act (“CIPA”). A decision this week by a federal court judge in California could halt new case filings and lay the groundwork for the dismissal of pending actions.
Consumer class actions under California’s Song-Beverly Credit Card Act have been shaped by significant case law developments over the last few years. Friday’s Ninth Circuit decision in Sinibaldi v. Redbox is a decisive victory for retailers of rented goods which will allow them wide latitude to collect personal information, such as zip codes, when using credit cards as a form of security.
A recent judgment of the highest court in the European Union announced that search engines within the court’s jurisdiction must respond to “right to be forgotten” requests. This authoritative interpretation of the existing data protection laws may create significant issues for Internet intermediaries and exacerbate the differences between the European privacy-based “right to be forgotten” and the United States’ free-speech based “right to remember.” This judgment will have a significant impact not only on search engine companies and publishers, but also on many other industries, including financial services and life sciences, that need to maintain data on individuals for legitimate business reasons, often for lengthy periods.
The official proposal for an EU Regulation on Data Protection was released in Brussels on Wednesday 25 January 2012 (the “Regulation”). The Regulation, which will replace the existing EU data protection regime, will have a significant impact on almost every business either established in the EU or that has EU customers. The proposed Regulation will now be discussed in detail over the next few months as it goes through the European legislative process and is set to be adopted in 2014. The main implications of the proposed Regulation are summarised below.
- Greater Enforcement – fines can be imposed of up to 2% of the annual worldwide turnover of a business for failure to comply with the proposed Regulation. In addition, supervisory authorities will be able to impose a temporary or definitive ban on processing personal data, enter premises and suspend data flows to a recipient in a third country or to an international organisation.
- Class Actions – any organisation which aims to protect the data protection rights of individuals, such as consumer organisations, can make complaints to supervisory authorities and bring class actions on behalf of individuals for non-compliance, even without the consent of those affected.
- Application to Non European Businesses – the proposed Regulation will apply to businesses established in the EU and importantly to non-European businesses that process personal data of individuals residing in the EU where the processing activities are related to offering goods or services to such individuals or the monitoring of their behaviour.
- Accountability – businesses will be required to adopt policies and implement measures to demonstrate compliance with the requirements in the proposed Regulation. This will include keeping a detailed record of all forms of data processing and carrying out data protection impact assessments. This will lead to significant compliance costs for affected businesses. Privacy by design measures must also be implemented to ensure, for example, that data is not collected or retained beyond the minimum necessary.
- Data Protection Impact Assessments – the proposed Regulation introduces a new requirement for impact assessments to be conducted where the processing is likely to present specific risks, such as the processing of health data. As part of the assessment the views of the individuals whose data are being processed need to be obtained.
- Data Protection Notifications – while the requirement in some EU Member States for data controllers to notify their Data Protection Authority in respect of their data processing activities will be abolished, businesses will be required to consult the relevant supervisory authority prior to the processing of personal data where a data protection impact assessment is required. Where the supervisory authority considers that the assessment insufficiently identifies or mitigates risks it can prohibit the intended processing. Where a data controller or processor is established in more than one EU Member State then the competent authority is where the controller or processor has its main establishment.
- Information Security – the proposed Regulation requires data controllers and processors to implement appropriate technical and organisational security measures after having carried out an evaluation of data privacy risks. Moreover, data security breaches will have to be notified to the relevant supervisory authority without undue delay and “where feasible” no later than 24 hours after having become aware of it. The proposed Regulation specifies that when the breach notification is not made within 24 hours a reasoned justification must be provided to the relevant supervisory authority. The breach will have to be communicated to the individual without undue delay when the breach is likely to adversely affect the protection of the personal data or the privacy of the individual.
- Consent – the proposed Regulation places the legal burden on the data controller to prove that the individual has given consent and gives an individual a right to withdraw their consent at any time. The Regulation also significantly restricts reliance on consent “where there is a significant imbalance between the position of the data subject and the controller.”
- Data Protection Officers – businesses with over 250 employees will be required to appoint a data protection officer who will have to have “expert knowledge” of data protection law and practices. The appointment which must be for a term of at least two years should be notified to the relevant supervisory authority and the public. The proposed Regulation also provides that businesses may appoint a single data protection officer for a corporate group.
- Increased Rights of Individuals – businesses must have transparent and easily accessible data protection policies and provide information using clear and plain language. An individual also has a right to correct his or her personal data and, importantly for social media, a right to data portability (i.e. to transfer his or her personal data to another provider) and will have a right to be forgotten (i.e. to have his or her personal data erased) which will be complex to apply in practice.
- Transfer of Personal Data from the EU – the proposed Regulation maintains the restriction under the current Data Protection Directive of transferring personal data to countries outside the EU that are not considered to provide an adequate level of protection including the United States. The Regulation provides that one of the main solutions to permit such international transfers is the adoption of Binding Corporate Rules, which are a set of data protection rules adopted by an international corporate group that meet EU requirements and must be approved by a lead supervisory authority. Significantly, the proposal confirms that that specific sectors of a country could be deemed adequate – perhaps paving the way for recognition of the United States health, communications and financial sectors.
The proposed Regulation will certainly be subject to lengthy discussion and revision by the Council of Ministers and the European Parliament before it is finally adopted and becomes law. However, it is clear that whatever the final form of the Regulation it will have a significant impact on businesses worldwide, increase compliance costs and enforcement actions and will therefore require a new approach to data protection.
If you have any questions regarding this update, please contact:
+44 20 7360 3739
+44 20 7360 2061
+1 (202) 736 8010
+1 (202) 736 8477
This Sidley update has been prepared by Sidley Austin LLP for informational purposes only and does not constitute legal advice. This information is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this without seeking advice from professional advisers.
Attorney Advertising – For purposes of compliance with New York State Bar rules, our headquarters are Sidley Austin LLP, 787 Seventh Avenue, New York, NY 10019, 212.839.5300 and One South Dearborn, Chicago, IL 60603, 312.853.7000. Prior results do not guarantee a similar outcome.
A draft of a new EU Regulation on Data Protection to replace the existing EU Data Protection Directive was released un-officially earlier this week. The draft Regulation once adopted will have a significant impact on virtually all businesses established in the EU, or who carry on business with the EU, introducing significant internal compliance requirements and fines that range up to 5% of worldwide turnover.
In an article published by the Bureau of National Affairs, John Casanova and William Long of the London office of Sidley Austin and Alan Raul and Ed McNicholas of the Sidley Washington office provide their initial analysis of this significant new EU development. For further information on this development and other EU data protection requirements please contact John Casanova or William Long and for counseling in relation to US privacy issues please contact Alan Raul or Ed McNicholas.
Reproduced with permission from Privacy & Security Law Report, Vol. 10 PVLR No. 48, 12/12/2011. Copyright 2011 by The Bureau of National Affairs, Inc. (800-372-1033) http://www.bna.com
The global nature of the Internet means that any business trading online is opening itself up to the possibility of trading with other businesses or customers based abroad. This is one of the enormous attractions of the Internet. However, the introduction of a foreign element to a business’s activities exposes it to issues of conflict of laws. Regardless of the business’s choice of law governing its activities and choice of court for handling any disputes, it may find that the laws of other countries apply or that the courts of other countries claim jurisdiction. So, it is important that any business engaged in e-commerce considers the implications of a global marketplace on its activities. This briefing note examines which courts have jurisdiction over a contract resulting from e-commerce and which law will be applied.