Data Protection Without Data Protectionism: The Right To Protection Of Personal Data And Data Transfers In EU Law And International Trade Law

442 Pages·2023·8.576 MB·English

by  Tobias Naef

EYIEL Monographs
Studies in European and International Economic Law 28
Tobias Naef
Data Protection
without Data
Protectionism
The Right to Protection of Personal
Data and Data Transfers in EU Law and
International Trade Law
European Yearbook of International Economic Law
EYIEL Monographs - Studies in European
and International Economic Law
Volume 28
SeriesEditors
MarcBungenberg,Saarbrücken,Germany
ChristophHerrmann,Passau,Germany
MarkusKrajewski,Erlangen,Germany
JörgPhilippTerhechte,Lüneburg,Germany
AndreasR.Ziegler,Lausanne,Switzerland
EYIEL Monographs is a subseries of the European Yearbook of International
EconomicLaw(EYIEL). Itcontains scholarly worksinthefields ofEuropeanand
international economic law, in particular WTO law, international investment law,
internationalmonetarylaw,lawofregionaleconomicintegration,externaltradelaw
oftheEUandEUinternalmarketlaw.Theseriesdoesnotincludeeditedvolumes.
EYIELMonographsarepeer-reviewedbytheserieseditorsandexternalreviewers.
Tobias Naef
Data Protection without Data
Protectionism
The Right to Protection of Personal Data
and Data Transfers in EU Law
and International Trade Law
TobiasNaef
FacultyofLaw
UniversityofZurich
Zurich,Switzerland
DissertationoftheFacultyofLawoftheUniversityofZurichtoobtainthedegreeofDoktor
derRechtswissenschaft(DoctorofLaw,PhD)
ApprovedattherequestofProf.Dr.MatthiasOeschandProf.Dr.ChristineKaufmann
TheFacultyofLawherebyauthorizestheprintingofthisdissertation,withoutindicatinganopinionof
theviewsexpressedinthework.
Zurich,10March2021
TheDean:Prof.Dr.ThomasGächter
ISSN2364-8392 ISSN2364-8406 (electronic)
EuropeanYearbookofInternationalEconomicLaw
ISSN2524-6658 ISSN2524-6666 (electronic)
EYIELMonographs-StudiesinEuropeanandInternationalEconomicLaw
ISBN978-3-031-19892-2 ISBN978-3-031-19893-9 (eBook)
https://doi.org/10.1007/978-3-031-19893-9
The pre-press stage and the publication were supported by the Swiss National Science Foundation
(SNSF).
©TheEditor(s)(ifapplicable)andTheAuthor(s)2023.Thisbookisanopenaccesspublication.
OpenAccessThisbookislicensedunderthetermsoftheCreativeCommonsAttribution4.0International
License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation,
distribution and reproductionin any mediumor format, as long as you give appropriate credit to the
originalauthor(s)andthesource,providealinktotheCreativeCommonslicenseandindicateifchanges
weremade.
Theimagesorotherthirdpartymaterialinthisbookareincludedinthebook’sCreativeCommonslicense,
unlessindicatedotherwiseinacreditlinetothematerial.Ifmaterialisnotincludedinthebook’sCreative
Commonslicenseandyourintendeduseisnotpermittedbystatutoryregulationorexceedsthepermitted
use,youwillneedtoobtainpermissiondirectlyfromthecopyrightholder.
Theuseofgeneraldescriptivenames,registerednames,trademarks,servicemarks,etc.inthispublication
doesnotimply,evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevant
protectivelawsandregulationsandthereforefreeforgeneraluse.
Thepublisher,theauthors,andtheeditorsaresafetoassumethattheadviceandinformationinthisbook
arebelievedtobetrueandaccurateatthedateofpublication.Neitherthepublishernortheauthorsorthe
editorsgiveawarranty,expressedorimplied,withrespecttothematerialcontainedhereinorforany
errorsoromissionsthatmayhavebeenmade.Thepublisherremainsneutralwithregardtojurisdictional
claimsinpublishedmapsandinstitutionalaffiliations.
ThisSpringerimprintispublishedbytheregisteredcompanySpringerNatureSwitzerlandAG
Theregisteredcompanyaddressis:Gewerbestrasse11,6330Cham,Switzerland
To my parents
Acknowledgments
This book is based on my dissertation that was developed during my tenure as a
researchassociateattheLawFacultyoftheUniversityofZurichandwrittenduring
my research stays in Lund; Amsterdam; Cambridge, UK; and Washington D.C. It
wasfinalizedbackagaininZurich.Writingthisbookhasbeenanincrediblejourney
andIwishtothankmysupervisorProf.MatthiasOeschforallthesupportIreceived
overtheyears.Hisacademicguidance,diligentadvice,andencouragingwordswere
a steady constant through the ups and downs of finishing my dissertation. I would
alsoliketothankProf.ChristineKaufmannforpreparingthesecondopiniononthis
dissertation.The Faculty of Law ofthe University of Zurich acceptedmy disserta-
tionin2021withthepredicatesummacumlaude.
TheresearchforthisbookwaspartlyfundedwithscholarshipsfromtheLeague
ofEuropeanResearchUniversities,theSwissNationalScienceFoundation,andthe
Europe Institute at the University of Zurich. I am grateful for the opportunities
provided by these scholarships. I would also like to thank Prof. Xavier Groussot
for hosting me at Lund University; Dr. Kristina Irion for welcoming me at the
InstituteforInformationLawattheUniversityofAmsterdam;Prof.EyalBenvenisti
forhostingmeattheLauterpacht CentreforInternationalLawattheUniversityof
Cambridge; and Jane Harman for inviting me to the Woodrow Wilson Center for
InternationalScholarsinWashingtonD.C.
It would have been impossible for me to write this book without the support I
received from colleagues, friends, and family, some of whom I would like to
mentionhere.Prof.AnupamChanderatGeorgetownLawandDr.ThomasStreinz
at NYU Law for their inspiring discussions on data protection and trade law;
Dr. Zachary Reyna for a meticulous job editing this book; Dr. Anja Trautmann
fromSpringerforguidingmethroughtheintricaciesofthepublishingprocess,the
research associates at the University of Zurich and the Lauterpacht Centre—in
particular,Dr.RikaKochandDr.NinaHadorn—fortheircompanyonthisjourney;
myfriendsforallthedistractionsalongtheway;andmysisterforalwayshavingmy
back. A very special thanks goes to Dr. Barbara Kammermann. Her love and
patiencegavemethestrengthandcapacitytoseethisprojectthrough.
vii
viii Acknowledgments
Finally,Iwishtothank myparents. Their supportanduncompromising faithin
me have allowed me to follow a path that was not open to them. This book is
dedicatedtothem.
Zurich,Switzerland TobiasNaef
2022
Contents
1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.1 Framing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.3 Structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
1.4 Method. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
PartI EuropeanUnionDataProtectionLaw
2 TheGlobalReachoftheRighttoDataProtection. . . . . . . . . . . . . . 19
2.1 DevelopmentoftheRighttoDataProtection. . . . . . . . . . . . . . . . 20
2.1.1 EarlyDataProtectionLaws. . . . . . . . . . . . . . . . . . . . . . . 20
2.1.2 MaterializationinInternationalInstruments. . . . . . . . . . . . 22
2.1.3 HarmonizationinCommunityLaw. . . . . . . . . . . . . . . . . . 25
2.1.4 InclusionintheCharterofFundamentalRights. . . . . . . . . 27
2.1.5 Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
2.2 SubstanceoftheRighttoDataProtection. . . . . . . . . . . . . . . . . . . 31
2.2.1 FoundationalValues. . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
2.2.2 WrittenConstituentsoftheRighttoDataProtection. . . . . 38
2.2.3 RelationshipwiththeRighttoPrivateLife. . . . . . . . . . . . 42
2.2.4 LimitationsontheRighttoDataProtection. . . . . . . . . . . . 47
2.2.5 Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
2.3 TheExtraterritorialDimensionoftheRighttoDataProtection. . . . 55
2.3.1 TheRighttoContinuousProtectionofPersonalData. . . . . 55
2.3.2 TheoryofTerritorialExtensionofUnionLaw. . . . . . . . . . 63
2.3.3 Justification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
2.3.4 EssentialEquivalence. . .. . . .. . . .. . . .. . . .. . . .. . . .. 72
2.3.5 Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
2.4 TheExtraterritorialDimensionoftheRighttoDataProtection
andForeignSurveillance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
2.4.1 ForeignInternetSurveillance. . . . . . . . . . . . . . . . . . . . . . 77
ix
x Contents
2.4.2 RequirementsforEssentialEquivalenceofProtectionfrom
InternetSurveillance. . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
2.4.3 NoDoubleStandardsforForeignInternetSurveillance. . . 91
2.4.4 InternationalHumanRightsLawandInternet
Surveillance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
2.4.5 Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
2.5 Conclusion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
3 TheRestrictiveEffectoftheLegalMechanismsforDataTransfers
intheEuropeanUnion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
3.1 TheSystemofDataTransfers. . . . . . . . . . . . . . . . . . . . . . . . . . . 115
3.1.1 DevelopmentoftheRulesonDataTransfers. . . . . . . . . . . 116
3.1.2 PolicyObjectivesoftheRulesonDataTransfers. . . . . . . . 129
3.1.3 TheConceptofDataTransfers. . . . . . . . . . . . . . . . . . . . . 135
3.1.4 LegalMechanismsforDataTransfers. . . . . . . . . . . . . . . . 146
3.1.5 Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
3.2 ContinuousProtectionofPersonalDataandAdequacy
Decisions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
3.2.1 ThePoliticsofAdequacyDecisions. . . . . . . . . . . . . . . . . 156
3.2.2 LimitationsonContinuousProtectionofPersonalData
UsingAdequacyDecisions. . . . . . . . . . . . . . . . . . . . . . . . 161
3.2.3 TheValidityofAdequacyDecisionsasaLegal
Mechanism. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
3.2.4 TheEuropeanCommissionasGuardianofFundamental
Rights. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
3.2.5 Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
3.3 ContinuousProtectionofPersonalDataandAppropriate
Safeguards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
3.3.1 ThePoliticsofAppropriateSafeguards. . . . . . . . . . . . . . . 179
3.3.2 LimitationsonContinuousProtectionofPersonalData
UsingAppropriateSafeguards. . . . . . . . . . . . . . . . . . . . . 185
3.3.3 TheValidityofAppropriateSafeguardsasaLegal
Mechanism. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
3.3.4 SupervisoryAuthoritiesasGuardiansofFundamental
Rights. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
3.3.5 Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
3.4 ContinuousProtectionofPersonalDataandDerogations. . . . . . . . 204
3.4.1 ThePoliticsofDerogations. . . . . . . . . . . . . . . . . . . . . . . 205
3.4.2 LimitationsonContinuousProtectionofPersonalData
withtheDerogations. . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
3.4.3 WaiveronContinuousProtectionforPersonalData. . . . . . 214
3.4.4 TheDataSubjectsasGuardiansofFundamentalRights. . . 219
3.4.5 Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
3.5 Conclusion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222