The Extraterritorial Reach of EU Animal Welfare Rules

By Jessica Lawrence, PhD student, VU University Amsterdam

In an interesting judgment in Zuchtvieh-Transport, the CJEU has ruled that Regulation 1/2005 on the protection of animals during transport applies outside of EU borders to transport taking place in third states, if that transport began on EU territory. This is a novel ruling that is expected to have important positive impacts on animal welfare. However, it can also be seen as an example of the CJEU’s tendency in recent years to read the EU’s jurisdiction expansively, stretching traditional international law notions of ‘territorial jurisdiction’ to permit the regulation of conduct taking place in third states.

Facts and Judgment

The case at hand concerns the refusal of Stadt Kempten, a municipality in Bavaria (Germany), to issue an export permit to animal transport company Zuchtvieh-Export. In 2012, Zuchtvieh-Export planned to transport 62 cattle from Kempten to Andijan (Uzbekistan), a journey of some 7000 km. The trip would take approximately 9 days, during which time only two 24-hour long rest stops were planned. During these rest stops, the cattle would be fed and watered, but not unloaded. Stadt Kempten refused customs clearance for the cattle because this schedule was not in accordance with the provisions of Regulation 1/2005, which sets EU standards for animal welfare during transport.

Zuchtvieh-Export objected to this decision, and filed a claim at the Bayerischer Verwaltungsgerichtshof (Higher Administrative Court, Bavaria). During its proceedings, that court asked the CJEU for a preliminary ruling on the question whether, with respect to animal transport involving a long journey that begins in the EU but ends far outside of its borders, Regulation 1/2005 applies only to the portion of the transport taking place within the EU, or also to those parts of the transport taking place outside of EU territory.

The CJEU came down firmly on the side of extraterritorial application, stating unambiguously that Regulation 1/2005 “does not subject the transport of animals with a point of departure within the territory of the European Union and a destination in a third country to any particular approval scheme, different from that applicable to transport taking place within the European Union” (para. 47). The only nod the Court makes to the limits of EU authority is the following:

“Should it nevertheless be the case that the law or administrative practice of a third country through which the transport will transit verifiably and definitely precludes full compliance with the technical rules of [Regulation 1/2005], the margin of discretion conferred on the competent authority of the place of departure empowers it to accept realistic planning for transport which, in the light inter alia of the means of transport used and the journey arrangements made, indicates that the planned transport will safeguard the welfare of the animals at a level equivalent to those technical rules.” (para. 54)

In finding that Regulation 1/2005 also applies to those parts of animal transport taking place outside of the EU, the Court went against the opinion of Advocate General Bot. The AG was indeed of the opinion that the scope of the Regulation was limited to the EU, and that applying it to transport outside of EU borders would essentially deputize the authorities of other countries, requiring them to “check to ensure compliance with the rules laid down by the regulation” (AG’s opinion, para. 54). As Advocate General Bot pointed out, this would be inconsistent with the rules regarding the transport of animals into the EU, according to which transit companies must meet EU animal welfare standards only once they enter EU territory (AG’s opinion, para. 82).

Comment

It is particularly interesting to see Zuchtvieh in light of the Court’s other recent case law on the extraterritorial application of EU rules. Traditionally speaking, international law frowns upon extraterritorial regulation, instead deferring to state sovereignty and its corollary, the principle of non-interference in the affairs of other states. Extraterritorial rules are thus only permissible where there is a solid jurisdictional reason for enacting them (for example, because the actors involved are nationals, or the behaviour abroad has domestic territorial effects). In recent years, however, the CJEU has seemed quite willing to use the ambiguity inherent in these jurisdictional terms to permit the application of EU rules that have legislative effects in third states. It has justified the application of such rules outside its borders using what Joanne Scott has helpfully termed “territorial extension”: the practice of using a (potentially quite limited) territorial connection with the EU to justify the regulation of conduct taking place in third states.

In the Air Transport Association case, for example, an association of American air transport companies challenged the EU’s decision to apply its carbon emissions trading scheme to emissions by non-EU planes that took place outside European territory, if those flights landed in the EU. The CJEU found that this was permissible, and should not be seen as violating the prohibition of extraterritorial regulation under customary international law. (ATA para. 157). In the Court’s view, the emissions trading scheme was not ‘extraterritorial’, because it was applied only at airports within EU jurisdiction—regardless of any effects on extraterritorial behaviour. For other examples of broad readings of regulatory jurisdiction by the CJEU, one might look to earlier cases such as Minin, Poulsen, and Ebony Maritime.

Similarly, in Zuchtvieh, the CJEU found that there was no extraterritorial regulation because the permit for transporting the animals in question was issued within the EU. While Advocate General Bot expressed his concern regarding the effects such an interpretation would have on the conduct of transporters and customs officials in third states, the CJEU clearly did not find these issues relevant to its determination.

The Zuchtvieh ruling is expected to have positive effects on animal welfare, improving conditions for the millions of animals transported from the EU to third states every year. In addition to these concrete effects, however, the judgment also demonstrates the increasing tendency of the CJEU to expand the permissible reach of EU legislation to conduct taking place on third state territory.

It remains to be seen whether this trend will continue, and at what point the CJEU will consider that the extraterritorial reach of EU law has reached its limit. One may indeed question the impact of this case on the so-called ‘external dimension’ of EU law, which is one of the key concerns nowadays for EU policy-makers. Is the EU entitled to export its rules/values/fundamental rights standards to other countries? At what point does ‘territorial extension’ become an illegal or illegitimate exercise of EU authority? EU ‘territorial extension’ definitely encounters quite some resistance from the international community. Despite the CJEU’s approval of the emissions trading scheme in Air Transport Association, for example, international backlash against the rule was so strong that the EU agreed to suspend its operation so long as international negotiations on a more global rule were underway. Although Zuchtvieh has thus far not generated a similar protest, it does change the standard international legal conversation about jurisdiction, pushing an expanded understanding of who can and should regulate the behaviour of cross-border economic activities.

Originally published on EU LAW BLOG

Barnard & Peers: chapter 24

Photo credit: www.ciwf.org.uk

Read More

Towards a Web 3.0? The impact of the Google Spain judgment on social networks and Wikipedia

Steve Peers

If its age could be measured in ‘Internet years’, the EU’s data protection Directive would be prehistoric. This can easily be demonstrated by comparison with the age of Facebook. The Directive was adopted seven years before the virtual panty raid on Harvard students’ privacy that ultimately launched Facebook. Indeed, when the Directive was adopted in 1995, Mark Zuckerberg was eleven years old, and attending primary school. He turns 30 today.

That’s a significant birthday – but is there anything in the Google Spain judgment that would ruin the party? This blog post looks in detail at the possible application of the judgment to two well-known features of the Internet: social networks and Wikipedia.

Long ago (in Internet years), the Internet shifted to a ‘Web 2.0’ model, dominated increasingly by user-generated content such as social networks and Wikipedia (along with blogs and many other forms of such content). The question I want to pose here is whether the Google Spain judgment could launch a ‘Web 3.0’: an Internet dominated by data subjects’ control of their personal data?

Applying the Google Spain judgment to social networks and Wikipedia

Material scope of EU law

First of all, the information placed on social networks and Wikipedia certainly constitutes personal data, at least as far as it concerns living natural persons. It’s an interesting question as to whether the legislation also applies to dead persons: this conjures up the image of the supporters and critics of (say) Ronald Reagan or Margaret Thatcher using data protection law to litigate over the reputation of their heroes (or villains). But the exclusion of legal persons means that data protection law cannot be a vehicle for companies (or other legal persons such as NGOs, political parties, charities or governments) to attempt to remove all traces of criticism of their actions.

As the CJEU has made clear several times, it isn’t relevant that the data was initially (or subsequently) made available elsewhere. This point is relevant to Wikipedia in particular, given the sources it links to for most of its information.  

Placing information on the Internet amounts to ‘data processing’, at least where it is available to the general public. This is particularly relevant to Wikipedia, but it’s also relevant to those social network profiles which are accessible to the outside world. In both cases, the personal data would also be accessible by means of search engines, which means that Google (or other search engines) would be separately liable for securing data protection rights under the conditions set out in the Google Spain judgment.

However, where a social network profile is genuinely closed to the outside world and made accessible only to persons selected by the data subject, the EU’s ‘Article 29’ working party on data protection (a body made up of national data protection supervisors, which gives non-binding advice on the application of EU data protection law) has suggested that the so-called ‘household exception’ in the Directive might apply. This would mean that, since the data could only be seen by a closed circle of (presumably) friends and family, the EU law wouldn’t apply at all. Obviously, though, that exception wouldn’t apply to any processing of the personal data in question by the company which established the social network itself, for direct marketing or other purposes.

Who is the ‘data controller’, ie the person with greater liability for application of EU data protection legislation, as regards social networks and Wikipedia? On this point, there is a clash between the nature of Web 2.0 and the putative Web 3.0, to the extent that the content of the personal data is generated by the users. In principle, each individual chooses how much personal data to place online and who has access to it, and similarly the editors of Wikipedia generate its content. The liability of the social network provider or Wikipedia might arise, however, to the extent that they alter the privacy settings, or could be regarded as controlling (as in Google Spain) the systematic presentation of the data to the outside world.  We can’t forget that in that judgment, the CJEU ruled that there has to be a ‘broad definition of the concept’ of a data controller.

Territorial scope

Back when the Internet was (in Internet years) a teenager, the CJEU ruled in Lindqvist that the special rules on external relations in the data protection Directive should not, by means of the nature of the Internet, become a general regime applicable to the entire world. But in Google Spain, the Court conversely was anxious to ensure that the general rules of the Directive were applicable to companies based outside the EU.

However, this doesn’t mean that all social networks, or Wikipedia, are necessarily subject to the Directive. They are certainly subject to it if they are in the same situation as Google: with a subsidiary in a Member State, which is selling advertising connected to the Internet-related activities of the parent body. But this is surely not the only scenario when the Directive applies to companies based outside the EU. As the CJEU said in Google Spain, the Directive has ‘a particularly broad territorial scope’ and the relevant rules ‘cannot be interpreted restrictively’. So while it is an oversimplification to say that the Directive applies to any entity ‘doing business in the EU’, it probably applies at least where there is a significant local activity (certainly in the form of a branch, possibly in the form of an agent or licensee) by the parent entity, that has some link to its Internet activities.

It is also still open to argue (since the Court did not address the issue) whether a parent company can be regarded as ‘established’ or using equipment on the territory due to its use of domain names, storage of data, and use of crawlers or robots on the territory, or whether the EU Charter of Fundamental Rights imposes broader criteria as regards the territorial scope of the rules.

Of course, there will be practical difficulties enforcing the Directive where a non-EU entity does not have assets in the EU. However, in such cases there might be possibilities to enforce the Directive’s rules by seeking to enforce a court ruling in a non-Member State, or more directly by means of obtaining an injunction to block access to the information which infringes data protection rules. Undoubtedly, such an injunction could be sought against Google, where the data is accessible by means of its search engine, and arguably (by analogy with copyright law) against an Internet service provider.

Personal scope

One interesting question which the Court did not have to deal with in Google Spain was the personal scope of data subjects. For instance, could a celebrity based in America, who finally gets tired of stories about her enormous backside, try to use EU data protection law to prevent access to such stories?

There is no requirement in the Directive that the data subject must be a national of a Member State, and/or domiciled in the EU. Nor do the rules on the territorial scope of the Directive mention this factor. So it must follow that non-EU citizens who are not resident in the EU can rely upon the Directive to assert their data protection rights within Member States. So in principle, at least, the supporters and detractors of Barack Obama or Vladimir Putin could bring their disputes, in the context of editing Wikipedia entries, to the courts and data protection supervisors of EU countries.

While this might sound absurd, in fact there are other reasons which would stand in the way of the application of EU data protection law to such disputes – to which we now turn.

Responsibility of data controllers

Data controllers must ensure that the data quality rules in the Directive are satisfied, and that data was processed in accordance with one of the legal grounds for processing.

On the latter point, one of the crucial factors in the Google Spain case was that Google could only rely (as regards its search engine) on its ‘legitimate [commercial] interest’ in processing personal data, in accordance with Article 7(f) of the Directive. The same provision refers to the interests of third parties, namely freedom of expression. However, the Court held that such interests were overridden by the data subject’s rights in that case, due to the huge invasion of his privacy due to the use of search engines.

Two issues arise here: the balancing test, and the grounds for processing. The first issue is particularly relevant for Wikipedia, since (like Google, as regards its search engine) it must rely on this balancing test in order to justify its processing of personal data, in the absence of other possible grounds to justify it.  

Applying the balancing test, the CJEU ruled on both Google’s interest and the public interest in freedom of expression. As regards Google, the Court stated that its ‘merely economic’ interests were outweighed by the data subject’s. This suggests that a non-profit body like Wikipedia would arguably have a greater claim to assert its interests than a profit-making entity.

As regards the public interest, the Court listed the factors to be considered as ‘the nature of the information’, its ‘sensitivity for the data subject’s private life’, and the public’s interest in the data, which could ‘vary, in particular’, on the data subject’s ‘role…in public life’. It should be recalled that the concept of ‘private life’ usually includes data concerning a person’s activity in public, but here the Court does suggest that there might be a distinction between public and private activities. So the balance tips in favour of freedom of expression the more that the person concerned is a public figure, and the more that the information concerns his or her public activities. So certainly Wikipedia could contain a record of public criticism of a politician; but the sordid details of his intern’s (postponed) dry-cleaning might possibly be another matter.

The crucial question here is whether the test can be regarded as severable: ie can it be argued that even if a person is a public figure, his or her public and private activities can be distinguished? In any event, his or her mistress or children are data subjects in their own right, so would have a data protection right to assert independently of the politician, and are unlikely to be public figures. But of course, some spurned mistresses are very keen indeed to waive their data protection rights.

But who is a public figure in the first place? Presumably the concept has an autonomous meaning in EU law, so it is not up to Wikipedia (or the persons concerned) to determine what it means by themselves. But surely the nature of Wikipedia is a significant factor to take into account when developing and applying such a definition.

As regards the nature of the personal data, what if the information in question reflects very badly upon the person concerned? The CJEU did not address this issue expressly in Google Spain. But it could be argued that it depends on the public interest in receiving that information. So while past financial difficulty does not raise a public interest issue, there is a better case for arguing (say) that a woman who has been groped by a particular car mechanic has every right to warn other women against him via means of social networks.

Another crucial element in the Google Spain judgment was the journalist exception in the Directive. It didn’t apply, because Google itself was not a journalist, and the Court disregarded the use that journalists make of search engines. But where content is user-generated, such as Wikipedia and on blogs, surely the exception must apply, given the Court’s broad approach to it in previous judgments such as Satamedia and Lindqvist. So in that case it could be argued that the exception should be applied in practice by the national courts. Indeed, perhaps the only reason why the CJEU undertook the task of applying the balancing test between privacy and freedom of expression itself in Google Spain was because the journalist exception did not apply.

As for the second issue, social networks will usually be able to point to other grounds justifying the processing of personal data: namely unambiguous consent, and necessity to perform a contract. This raises important questions of how to interpret these grounds for data processing, but these are clearly different issues not addressed at all by the Google Spain judgment.

That judgment would only be relevant as regards the processing of personal data about third parties in social networks, for instance a man ranting about his ex-girlfriend on his Facebook page. The way to resolve situations such as these is for social networks to adopt and apply robust privacy policies, but the Google Spainjudgment can only be an indirect source of inspiration for such policies.  

The right to be forgotten

Finally, what of the ‘right to be forgotten’? The Court derived such an implicit right from the rules in the Directive on the relevance of data (one of the data quality principles), given that it might cease to be relevant over a long period of time.  While this can be seen as a positive right for data subjects, conversely it suggests that if information is accurate (and complies with all other rules in the Directive), there is not much of a right for a data subject to object to its dissemination as long as it is relatively fresh.

Conclusion

Is there good reason for Mark Zuckerberg's own knickers to be in a twist, following the Google Spain judgment? The CJEU does suggest that the territorial scope of the Directive is relatively broad, and as such is more likely to apply to social networks and other well-known Internet services than might otherwise have been thought. But it is not yet certain whether and when the Directive does apply to entities whose situation differs from Google’s. Equally the judgment confirms that the material scope of the Directive is broad, and it seems clear enough that its personal scope is broad too.

However, the judgment is unlikely to lead to a ‘Web 3.0’ as regards Internet services besides search engines, because there are basic differences in the substantive data protection law of the EU as it applies to the bodies offering such services. These differences concern in particular: the very nature of user-generated content (arguably changing who is the ‘data controller’); the existence of privacy or editing policies; the public figure exception; the possible application of different, additional grounds for processing personal data; and the Google Spain judgment itself – since it provides for an alternative, more effective means of blocking access to the personal data concerned.

Barnard & Peers: chapter 9

Read More