Source: https://www.jipitec.eu/issues/jipitec-8-3-2017/4624
Timestamp: 2019-04-25 19:50:02+00:00

Document:
Disputes concatenating privacy, speech and security through the right to anonymity are particularly hard cases to adjudicate. The traditional paradigm, according to which anonymity plays a double role – protecting fundamental rights, as well as potentially threatening them – continues to drive policies that, in turn, emphasise the risks and downplay the opportunities of anonymity in the online world. The content/metadata distinction is a residue of such ambiguous views, persistent in the Court of Justice of the European Union’s (CJEU) approach towards the right to anonymity in ISP liability cases. The article initially explores the argumentative grounds behind the CJEU’s recent McFadden judgment (part 2.). Against the backdrop of the theory of balancing of interests, this paper critically examines the Court’s reductionist position. Our critique suggests a method of avoiding the disproportionately narrow scope of analysis that accompanies this position. For this purpose, we establish the right to anonymity at the periphery of both the freedom of expression and information, and the right to private life and data protection, while contesting the right to anonymity as a right sui generis. We proceed with three key points. By inspecting the nature of the right to anonymity, we unveil the interconnectedness between the right to freedom of expression and information and the right to private life and data protection (part 3.). Chilling effects represent an often understated evidence of this relationship. In addition, we see that affecting certain means of exercising a particular fundamental right, such as is its anonymous exercise, brings forward important extra-legal considerations, facilitating the discernment of chilling effects in any analysis of human rights. It is argued that regulating anonymity could pose a significant obstacle to the exercise of a fundamental right as a whole, and consequently impact upon the core of that right (part 4.). Harmonisation-driven attempts to develop human rights guarantees, framed in seemingly robust procedures established by the CJEU, at the level of data collection or retention as well as data disclosure by an ISP, have the potential to be derailed by nation-specific considerations. Taking such considerations seriously can reverse the imminent impact upon the core of the fundamental rights in question, which the narrow scope of traditional human rights analysis easily discounts. This requires diverting from the “targeting by dissuasion” argument as a mere technical exercise, and acknowledging the subtle subterranean relationship of the fundamental rights being considered (part 5.).
Between 19 and 21 October 1905, uncontrollable violence spread over the city of Odessa. In the wake of the October Manifesto, and anti-imperialist propaganda flooding Russian cities, violent clashes with the Jewish population engulfed the city. For many involved, the cause of the Russian decline preceding these turbulent events became instantaneously self-evident and needed to be eradicated. Around 400 Jewish perished in the hands of unnamed crowds in just two days. A number of police and military officers benefited from the anonymity conveyed by pogroms, and disguised in civilian clothes participated in the massacre, instead of maintaining law and order. Likely, the perpetrators of these atrocities will never be identified.
Although the above examples demonstrate that the question of anonymity has long been considered both crucial and contested in terms of ensuring both societal order and individual liberty, this paper aims to add a contemporary perspective to the debate concerning the frictional relationship between anonymity and the protection of fundamental rights and freedoms. Such an intervention is warranted by the seemingly novel, but perhaps quite analogous, circumstances of modern society: online anonymity, enabled by technological advancements and endorsed by billions of indistinguishable Internet users, provides for similar risks and opportunities. On the one hand, anonymity diminishes accountability: it gives “license” to depart from the limits of legality in the sense of positive law, and permits individuals to escape accountability for the possible ramifications of their actions. On the other hand, anonymity empowers individuals in terms of their autonomy and personhood,  and protects them from unjustified interference with certain fundamental rights. Human experience has shown on countless occasions that an additional “shield” reinforcing the freedom of expression, such as a speech act made in anonymity, can be of existential importance to its exercise. If history is characterised by a continuous narrative of civilisation, anonymity, in turn, becomes instrumental, so that marginal discourses are not excluded from the conversation. This is often the case with regard to the expression of ideas that offend, shock or disturb, and call for more protection than information and ideas that are favourably received.  Since the Internet has now become one of the principal means by which individuals exercise their right to freedom of expression, enabling participation in political and societal activities and discussions, even a minor disruption within the Internet’s architecture bears the risk of significant collateral damage.  Recalling the real-world situations of political expression of the past essentially brings the problem closer to the everyday experience of today: pervading online real-name policies attach identity more strongly (visibly and permanently) to every act of online expression than almost any real-world situation has ever done before;  and available technologies significantly facilitate the ways in which one’s identity can be revealed,  such as data mining. A modern judge adjudicating hard cases at the intersection of privacy, speech, and security must thus become increasingly aware of the importance of users’ individual preferences regarding identity disclosure when they exercise their freedom of expression.  At the same time, acknowledging the importance of anonymity and confidentiality on the Internet must not lead the same modern judge to refuse to protect the rights of others.  We will show in our account that in adjudicating the hard cases, it is especially his or her local knowledge of users, their preferences and behaviour, and possible causes of chilling effects in the local environment, that would have a particularly instructive force in the analysis.
The right to data protection and the right to private life benefit from anonymous exercise on similar terms. The anonymization of data provides for the ultimate protection of an individual, in the sense that anonymised data are not considered personal data as long as the data subject is not identifiable. Processing anonymized data can, in theory, never violate subject’s right to privacy. Per Article 32(1)(a) of the General Data Protection Regulation (GDPR), anonymization (or pseudonymization) of personal data is considered necessary for ensuring data security when such data processing, in accordance with Article 6(1)(f) GDPR, is of legitimate interest to a controller.  Anonymization is further not only required under the current Directive 2002/58/EC on privacy and electronic communications as a lex specialis (E-Privacy Directive) with regard to traffic data (e.g. routing, duration of communication, location of terminal equipment, IP address), but is also explicitly upheld in Recital 9 of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data (DPD) as a measure minimising the risks associated with data processing.
In order to contextualise criticism of the right to anonymity in legal terms, the dual character of anonymity must be further stressed throughout the article, as a grey zone between illegality and legality, as a tenet of protected fundamental rights, as well as a potential source of interference with other fundamental rights, which renders any kind of conflict involving a purported right to anonymity especially difficult to balance. For the purposes of understanding anonymity deontologically in online communication networks, we should consider the right to anonymity particularly with respect to two fundamental rights; namely, the right to private life and protection of personal data (Articles 7 and 8 of the Charter and Article 8 of the ECHR, with the latter conceived of solely as a right to privacy), and the right to freedom of expression and information (Article 10 ECHR, Article 19 UDHR, Article 11 of the Charter).
The right to anonymity was once again contemplated at the highest level of the European judiciary structure. In its recent judgment,  the Court of Justice of the European Union (CJEU or Court) concluded that Article 12(1) and (3) of Directive 2000/31 (the E-Commerce Directive) and Directives 2001/29 and 2004/48 did not preclude the grant of an injunction, requiring a provider of access to a communication network allowing the public to connect to the Internet to take a measure consisting in password-protecting the Internet connection, provided that users were required to reveal their identity in order to obtain a password and could not therefore act anonymously, so to prevent third parties from making a particular copyright-protected work available to the general public. In its analysis, the CJEU refrained from even briefly considering the protection of personal data. The balancing of interests test exclusively concerned the right to property versus the right to conduct business and the right to freedom of information. For the purposes of this article, the Mc Fadden judgment serves as a point de départ towards a critical assessment of the CJEU’s piecemeal approach in adjudicating the right to anonymity. The critical analysis shows that framing matters. The way in which the right to anonymity is shaped, differs when considered in what we call pure data protection cases (recently, e.g. in re Breyer and Tele2), and when balanced against other rights in mixed cases, in which the frame of adjudication is dictated by these other rights (e.g. in IP and ISP liability cases, in re Promusicae and Scarlet Extended). This article does not plan to defend the right to anonymity. It rather reveals that, while being unable to outlaw anonymity as such on the one hand, and facing increasing difficulties in justifying certain indiscriminate identification measures on the other, the Court engages in soft behavioural techniques of effectively nudging (incentivising) users out of the anonymous space, so as to eliminate the risky grey zone in which anonymous Internet users operate. Marginally, it also points to a differentiation between users’ content and metadata, and to the fact that while this differentiation is becoming less and less visible in data protection cases, its remnants retain a certain degree of relevance in mixed cases where the risks accompanying anonymity arise.
Secondly, the injunction imposes a duty to process certain personal data on the part of the ISP. The ISP may choose not to provide a space for consent with data processing to its users. Consent is only one of several legal grounds for the processing of personal data, and it does not exclude the possibility that other legal grounds may be appropriate to consider in a given case.  In that instance, Article 7(c) DPD prescribes that if national law enables the imposition of a specific obligation (here, for example, storing users’ IP addresses and external ports), the data processing can be said to be necessary for compliance with a legal obligation to which the controller is subject. An ISP is forced by law to implement certain identification measures, which triggers the scrutiny of its legitimate interests in the balancing test, especially the freedom to conduct business. The Court holds that where a measure consists of marginal changes to the exercise of the ISP’s activity, such a measure does not impact upon the essence of this freedom,  even if the ISP cannot choose between multiple options to terminate or prevent infringement. Yet, noticeably, in re UPC Telekabel,  if that ISP is left with more than one technical means to comply with an injunction (in addition to identification measures, the Court could, for example, consider limiting the type of communication passing through the Wi-Fi network), a domestic court must be able to exercise a secondary judicial review of a measure imposed on or implemented by the ISP. This leaves the balancing test interestingly unsettled, because the proportionality of a particular technical measure is assessed by a national court only a posteriori and only incidentally, with likely diverging outcomes. In our opinion, re Mc Fadden could be read in a similar fashion. The domestic court should ascertain whether revealing a user’s identity in order to obtain a password to access a communication network would prevent the users acting anonymously and dissuade them from infringing copyright via peer-to-peer platforms.  At its core, given the differences in the identification measures contemplated, the national judge is supposed to assess the effectiveness (or the proportionality) of the relevant measure. The Court suggests that the eradication of users’ anonymity may ensure genuine protection of the fundamental rights at issue,  and the national judge shall, in his or her turn, consider whether a particular identification measure is indeed capable of achieving the stated aim.  This includes answering the question as to whether the implemented measure goes beyond what is strictly necessary. It seems that in the case, it is possible to pursue the second step of the proportionality analysis in the proceedings before the national court, ergo re-open the aspects of privacy protection, and in particular data retention, in the legal analysis. In the final part of the article, we propose a guideline by which a national judge can consider approaching this dimension and re-join the human rights analysis in his or her part.
In the proportionality analysis, the question of whether the measure is strictly targeted, and does not impact upon a fundamental right more than is necessary, is only answered vis-à-vis the right to freedom of information. No other rights are considered. This has much to do with the European courts’ view of the role of the Internet as a facilitator of the dissemination of information,  which enhances new forms of social interaction and revolutionizes the public’s access to news.  Therefore, the measure should, above all, not affect the possibility of Internet users to lawfully access information using the provider’s services,  a goal which should, in principle, be satisfied by not terminating the connection or blocking any Internet site as a source of information.  The right to information carries the risk of sharing or allowing others to share proprietary material of a third party or information of personal character; therefore, it necessarily involves a risk of fundamental conflict with the right to property,  or the right to privacy. Such a conflict must be resolved in accordance with the idea of achieving a fair balance.  This requires, in essence, assessing the problem of necessity, which the Court epitomizes through the notion of a targeted measure. If a measure does not block the transmission of lawful communication (e.g. due to the implementation of a system that inadequately distinguishes between unlawful and lawful content), the requirement of a strictly targeted measure is fulfilled.  In view of the foregoing, the fact that the injunction does not restrict access to available online sources appears a critical point. The implementation of the identification measures can change many aspects of such service – from unprotected to protected, from secure to insecure, from anonymous to non-anonymous network – but does not block the transmission. One cannot know beforehand what a user’s true preference is,  e.g. to log into an anonymous network. Each default situation carries the possibility of untargeted side effects,  excluding one group from the use of the network. There may be users who would, in principle, never log into an anonymous or public network. Therefore, reversal of the situations does not necessarily interfere with the user’s freedom to choose (here, to use a particular service).  The injunction is supposed to fulfil a dissuasive function  of unlawful use of the provider’s services, and the Court appears to suggest that only secure and non-anonymous networks target such illicit use, and ergo, are proportionate to the aim pursued. In so doing, the Court pre-arranges the ground for testing the basic proportionality (see above). The acceptance that dissuasion does not in principle interfere with the lawful user’s autonomy of will could explain why the Court addressed only the right to freedom of information and the right to conduct a business. In our conclusion, we will debate how the lack of harmonisation concerning data disclosure rules and the dissuasive function, which the injunction assumes, leads the analysis to its denouement by a national court, possessing nation-specific information.
Outlining the arguments that we believe might underline the Court’s reasoning, reveals one notable argumentative lacuna that draws us away from the reductionist position. This lacuna is found in the Court’s failing to consider so-called chilling effects. The lacuna will have to be filled by the reasoning of a national judge. Chilling effects bring into the legal analysis what is, in part, an extra-legal consideration (the same way a lack of legal certainty,  extensive interpretation of derogations, or the severity of punishment  affect human behaviour), and can sometimes become more problematic from a human rights perspective than direct infringements or interferences. A deterrent effect manifests itself as a shared negative human feeling regarding the lawful exercise of a fundamental right and can amount to an unwarranted abrogation of that right, with respect to particular individuals, sensitive groups, or the general population.
Chilling effects only become visible if the analytical focus is detached from the direct unlawful interference  and the letter of law. This requires a deeper understanding of: (i) the (meta)normative dimension of the interdependence of the relevant fundamental rights; and (ii) psychological, sociological, economic, and other factors that can influence the factual exercise of a particular fundamental right. Any understanding of the interdependencies is subject to the scope of analysis – what rights a judge is prepared to consider. It is a problematic, often perilous, trait of the balancing test to rightly identify the competing interests, not only of the litigants themselves, but also the broader interests that the litigants represent  and those that they can further advocate. It does not always become explicit, which fundamental rights should be placed onto the balancing scale and weighed against each other; for instance, in re Delfi v Estonia, the landmark case concerning the role of the ISP in regulating anonymous speech on the Internet, the ECtHR did not deal with the ISPs’ freedom to conduct business, or in re Google Spain, notoriously known as the “right to be forgotten” case, the CJEU did not refer to a publisher’s right to freedom of expression,  and denied any particular weight to Google’s freedom of entrepreneurship. Furthermore, as regards point (ii), the widely accepted understanding of law as a system of rules prescribing and governing human behaviour  reveals why such factors matter in the analytical discussion: if a person comports with one rule, however, simultaneously, his behaviour thwarts the anticipated objective pursued by a second rule, the contradiction demands a resolution. The more limited the scope of the analysis is, the more difficult it is to detect the relevant impact on the other, co-existent, legitimate objectives. Sometimes only first exploring the extra-legal considerations (societal dimensions) reveal what fundamental rights it is specifically germane to address.
Two-thirds of stock market investors believe that all Eurozone countries will stay in the monetary union for the next 5 years.
Happy people; basic income; Finland.
Edward Snowden – Is Edward Snowden a Hero or Traitor? - Obama Says Snowden is Not a Patriot.
The frame employed by a user, or the links the user clicks, can reveal much about his own interests, constituting a significant component of privacy. An aggregation of the imparted or accessed information can generate a representative overview of the individual’s political and other opinions.  The right to freedom of expression is not more susceptible to be affected by the chilling effects prompted by lawful interferences with privacy than the ‘mere’ right to information. Although more empirical data is needed as regards users’ browsing behaviour, similar observations were made with respect to decreasing traffic to or avoidance of several Wikipedia articles that raised privacy concerns in the post-Snowden era, such as those containing words like “jihad”, “al-Qaeda”, “suicide attack”, “Islamist”, or “Dirty Bomb”.  Clearly, the ability to freely access information is as intrinsically linked to privacy as holding one’s opinions and expressing them. As the freedom of expression and right to information are both indispensable for “uninhibited, robust, and wide-open”  debate and communication,  understanding that chilling effects can occur with respect to each right equally is essential for future analytical purposes. In order to ensure the human rights dimension of the online environment, the right to freedom of expression and information should not be arbitrarily separated. It is perhaps only encouraging that the CJEU is not always oblivious to potential behavioural effects that an interference with the right to privacy might provoke. In DRI, it noted that: “the fact that data are retained and subsequently used without the subscriber or registered user being informed is likely to generate in the minds of the persons concerned the feeling that their private lives are the subject of constant surveillance”.  It remains germane to ask what primary interferences with the right to privacy may trigger these effects. In legal terms, does an entitlement to exercise a particular fundamental right anonymously exist, and if so, under what conditions may such an entitlement be abridged?
The core, as opposed to the penumbra, of a fundamental right, is generally constructed as an absolute limit to balancing.  It customarily refers to certain important elements  that together constitute the very substance of the right.  If the core of a fundamental right is to be preserved, the balancing test should not touch upon these elements. However, the situation with the right to data protection and right to private life is rather more entangled. One can sense a certain paradox in stating that a freedom to choose whether to be identifiable, identified or to remain in anonymity, does not constitute the core of the right to privacy, notably if one concedes that: (i) anonymization is the strongest form of data protection (anonymised data are not considered personal data); and (ii) Article 7 of the Charter centres around personal autonomy,  i.e. freedom largo sensu, including making decision about whether to remain anonymous or what information concerning an individual should be anonymised. However, these points appear mutually self-reinforcing, and if they should validate the position of the right to anonymity within the core of the right to privacy, the tautology would deprive the latter of any specific essence or periphery with respect to data protection (a contrario to Article 52(1) of the Charter, and ad absurdum all personal data could belong to the core of the right to privacy and any de-anonymization of any data would violate the core of the right). The Court’s earlier jurisprudence suggests that the object of the right to privacy is, inter alia, a bundle of personal data, of which some belong to its core and some do not. Both rulings in res DRI and Schrems  upheld the classic metadata/content distinction. Balancing per Article 8(2) of the Charter, guided by the Member States’ discretion (Article 5(2) DPD),  could determine which data belongs to which category. An individualised approach is required,  while in particular, data sensitivity and the public interest in obtaining specific information must be taken into account.  In this respect, the essence of the right to private life has, inter alia, been found in the impermissibility of such derogations and limitations to the protection of personal data that would allow for accessing the content of electronic communications on a generalised basis in light of the objective of securing public protection.  More recent judgements, however, seem to depart from this position. The Court started to recognise that just because particular data processing concerns metadata (such as the name or IP address of a user, information on the periphery of the right to privacy) as opposed to content, it cannot be automatically concluded that such processing is permissible.  In re Tele2, the Court noted that the relationship could be far more complicated and meaningful. This accompanied a realisation of the potential for data identification that is accessible in today’s Internet architecture (re Breyer). If ISPs are required to trace and identify the source of a communication and its destination, to identify the date, time, duration and type of a communication, to identify users’ communication equipment and its location, the retained data has the potential to describe with precision the private life of individuals concerned (“everyday habits, permanent or temporary places of residence, daily or other movements, the activities carried out, the social relationships of those persons and the social environments frequented by them”).  It follows that metadata, or at least in bulk, is no less sensitive than the actual content of communications.  As such, it is the authors’ view that the core or periphery of the right to privacy can be determined upon evaluation of the relationship between nature of the information relating to a person and the exercise of that person’s autonomy in relation to that information.
In re Coleman, AG Maduro posited that the value of personal autonomy (underlying the principle of equality) dictates that “individuals should be able to design and conduct the course of their lives through a succession of choices among different valuable options”. As such, the exercise of autonomy requires an array of relevant options from which to choose.  To be anonymous is certainly an expression of personal autonomy; it is a means of exercising a particular fundamental right. Indeed, there are other (equivalent) means of such exercise, each arising from the personal autonomy of individuals and protected under the principle of equality, unless such would amount to an abuse of law or would constitute an interference with other fundamental rights. The word “means” is key here. Means do not operate alone, but their character and importance must be determined with regard to upon what actions or information they are exercised. Any such means, expressions of autonomy, including anonymity, could be then found on the periphery of a fundamental right. However admittedly, interfering with some means could pose a significant obstacle to the exercise of a fundamental right as a whole, and consequently impact upon the core of that right. To verify the impact, the wording of Article 52(1) of the Charter would dictate that any limitation, for example, of the right to anonymity, must be provided for by law, be proportionate, necessary and genuine objectives of general interest recognised by the EU or by the need to protect the rights and freedoms of others.  In this sense, the autonomy of some could trump the autonomy of others (as was the case, for example, in re Österreichischer Rundfunk, where it was held that public access to information must be accorded priority over contractual freedom,  or in re Google Spain, where it was held that the data subject’s rights override, as a general rule, the interest of Internet users to access information).
(iv) finally, the Court held an injunction permissible, which dissuades the users from wrongdoing by identifying them.  As follows from (ii) and (iii), such a measure is targeted, if no communication content is directly analysed or blanketly monitored by an ISP. Again, in this instance users’ interest in privacy has not been taken into account.
These phases indicate that ISP liability cases continue to be pre-occupied with the “old” content/metadata differentiation, making it relatively easier for a judge to place a final relational operator within the confines of the balancing test. Disabling anonymity certainly represents a viable alternative to enhanced content monitoring,  and as such, can eliminate certain doctrinal troubles with human rights dimensions. However, if a judge pursues the analysis through the unbecoming content/metadata dichotomy, and starts considering metadata (identification data) as something “merely” on the periphery of the fundamental rights, he or she becomes less concerned with the potential risk of neglecting related privacy and autonomy issues in a given case. There is a subsequent danger that the scope of the court’s analysis is disproportionately narrow.
To justify the interference with the right to information, the Court notes that a Wi-Fi network is only one of the possible ways to access the Internet. Nonetheless, in AG Szpunar’s view, Wi-Fi networks are special in the sense that they offer “great potential for innovation”.  It is therefore at least debatable whether an open public Wi-Fi or a home VDSL are equally valuable options for the exercise of the freedom of expression and information. Yet, if the main concern of personal data protection is a large-scale processing by mechanical, digital means, in all its varieties,  the analysis of the chilling effects should also be confined to this frame. Hence, while the Mc Fadden ruling and the national judgment that followed suit, thus far represent the only cases concerning such identification measures, the availability of choices (secured vs. unsecured networks) will eventually depend on how frequently copyright holders protect their rights via such means, and how many ISPs are forced to discontinue their services due to the costs of compliance with data protection requirements. The important implications of that are that a single infringement occurring within a particular communications network is sufficient enough to justify an injunction per Article 8(3) of Directive 2001/29, or Article 12(3), of the E-Commerce Directive.
However, from the perspective of chilling effects, it could appear more dangerous to impose an obligation upon an ISP to identify all of the network’s users without the consent of the latter, following Article 7(c) DPD. For such an obligation to apply, it must be imposed by a law that unequivocally allows for its imposition and which, on its own, complies with data protection requirements, including the requirements of necessity, proportionality and purpose limitation.  Post re Mc Fadden, the proportionality of the legal obligation to collect and retain certain personal data must be tested by the judiciary, otherwise non-consensual automatic processing is inconceivable. The Court does not consider which data in particular should be collected and retained. As such, a question must be posed in relation to the principle of data minimisation per the DPD.  In this respect, it is important to note again that the contemplated identification measures should accomplish a dissuasive function. Dissuasion should be effective to such an extent as to ensure that fundamental rights would no longer be violated.  From the view of basic proportionality, this could only be done by requiring such identification data as would be strictly necessary for the purposes of initiating a judicial proceeding.  Only such identification measures, which substantially facilitate and enable the enforcement of infringed rights, would effectively dissuade potential infringers from future infringements. Because the data required to initiate court proceedings differs among the Member States, the national court must establish that the identification measure does not go beyond these data requirements. As such, assessing basic proportionality could be a mere technical issue, devoid of further judicial considerations. Further, it is important to note, as the Court did in re Promusicae, that the E-Privacy Directive, the E-Commerce Directive and Directives 2001/29/EC and 2004/48/EC do not oblige the Member States to impose an obligation to disclose in order to ensure effective protection of copyright. Hence, in the proportionality analysis, the obligation to identify Internet users, i.e. to collect and retain personal data, must be decoupled from the obligation to disclose, as a potential secondary legal obligation imposed upon an ISP.
Although the obligation of confidentiality of personal data can be restricted under the E-Privacy Directive for the protection of the rights and freedoms of others  (such as in the context of civil proceedings),  it is a matter of national law to provide a legal basis for a data disclosure.  In this framework, data disclosure  functions in the same manner as any other data processing; it must comply with the robust procedural scheme applicable to the obligation to process personal data in general. This means a fair balance must be struck  between multiple competing interests  by taking due account of the principle of proportionality. A fair balance cannot be struck, if a request for data disclosure is not substantiated and does not follow a legitimate interest. In addition to this, further safeguards must be provided: evidence of an infringement must clearly exist, information must be deemed important for the investigation, and due process must be guaranteed.  Undoubtedly, an interest of a (IP) right holder to sue an infringer for damages can be qualified as legitimate.  If a national law allows for data disclosure to protect right holders’ interests in effective law enforcement, and such disclosure follows the prescribed procedural framework, which is appropriately balanced, EU law does not preclude such national legislation (re Bonnier). This multiple (though repetitive) procedural reasoning (at entry – data collection, data retention and at exit – data disclosure) should, in principle, guarantee that any interference with the right to privacy would bring a meaningful result after balancing. Nonetheless, if the effectiveness of identification measures is evaluated only on the basis of the inevitability of prosecution and punishment of infringement of third parties’ rights, assessing basic proportionality, although repetitive, appears to be an a priori solved problem. Secondly, there is the problem of data retention period. The idea is that personal data should in principle not be retained for longer than necessary in relation to the purpose for which they were collected or for which they are further processed. The period for which personal data can be stored must be limited to a strict minimum, and systems should be designed by default to minimize the retention period of personal information (Recital 39 of the Preamble and Article 25 of the GDPR). If the purpose of the data processing is to deflect the users from potential wrongdoing, by giving an effective possibility of initiating criminal proceedings, then the data retention period should in theory last until time for such initiation objectively lapses under national law. The data retention period is not tailored in accordance to the severity of wrongdoing, if an objective limitation period applies. However, an obligation to disclose data is not limited to a particular type of wrongdoing – let’s say copyright infringement. If the permissible data retention period is not proportionately limited to the severity of the wrongdoing, but it is set objectively in accordance with the dissuasive function of the injunction – as considered by the Court – there is a risk of unjustified interference with the right to data protection. In ten years’ time, new technologies can make use of current data, mandatorily stored by and ISP, in a way no one can predict. Consider only that a few years ago, that facial recognition technology was in many ways a vision of a distant future. Today, for example, every photo ever stored on a social media platform has the potential to be used for face recognition purposes. Such foresight and risk assessment of potential data uses should appear in the balancing exercise.
what role open Wi-Fi networks play in meaningful local civic participation, and could a fragmentation of political and social discussions occur?
These aspects differ dramatically from one Member State to another. Although the analysis of the national court will proceed with strong influence from the CJEU, significant room is left for a fully-fledged nation-specific contextual  examination. The Court acknowledged on a previous occasion that putting a complete end to the infringements of rights is an impossible goal to attain; in re Mc Fadden, the Court perhaps believed that by switching the default rules, there would be less space to circumvent the law in one way or another and achieve the stated goal.  However, targeting by dissuasion and chilling effects are very difficult, perhaps impossible, to reconcile. Dissuasive techniques are designed to constrain people’s choices; mutadis mutandis, personal autonomy would have difficulties in finding its place in the analysis.
Arguments have long been heard that chilling effects represent an overstated legal argument,  an ephemeral phenomenon,  and that the procedural guarantees developed by the CJEU are sufficiently strong to protect both the interest in privacy (autonomy) and the interest in open communication and discussion. However, a stream of cautionary cases arose out of specific political and economic circumstances, for example, during the Cold War period. More recent examples include the Schrems case. These moments will come again, in a different form. To preserve the guarantees developed by the procedural scheme of human rights, relying on the habitual insensitivity developed by users as a justification for the reductionist analytical frame, does not seem the correct road to travel in this regard. Nor is the blind search for maximising security and efficiency in the online world.
Turning away from the reductionist position, any analysis should acknowledge that at the confluence of the right to private life and freedom of expression, the right to anonymity plays a role in the “cartelization” of the two rights in the online environment. It means that, under certain factual circumstances, concurrent interference and remedies could be envisaged with respect to the two rights in question. Hence, strengthening or weakening anonymity in the online world affects the right to private life and freedom of expression and information simultaneously, and in the balancing exercise, these rights reinforce each other. Reductionism does not accommodate human rights in their full breadth. Therefore, one must not only recall that upholding anonymity, legally and technologically, bears the risk of unaccountable free speech, and renders the protection of the rights of third parties ineffective. To the same extent, curbing one’s privacy by imposing mandatory real-identity measures, outlawing end-to-end encryption, and proliferating surveillance technologies, can severely deter an individual from the legitimate exercise of his or her right to freedom of expression and information. One must also recall that, with respect to the balancing test, the ECtHR has held that the diversity in practice among Member States as to the weighting of competing interests of respect for private life and freedom of expression calls for a wide margin of discretion, a doctrine embodying the proportionality principle,  and the national judge should be rightly called upon to exercise such discretion. This article argued against a purely technical reasoning, bound to lead to dismissive stance concerning extra-legal considerations, and suggested taking chilling effects seriously. Multi-level analysis of the interdependence of human rights against the backdrop of individual Member State particularities may constitute a starting point in any attempt to guide national judges in the latter direction.
* Prof. Dr. Ciarán Burke is a Professor of International Law, Friedrich Schiller University Jena, Germany, ciaran.burke@eui.eu, Mgr. Alexandra Molitorisová is a Research Assistant to Prof. Dr. Ciarán Burke, Friedrich Schiller University Jena, Germany, alex.molitorisova@gmail.com.
 Harari, Y. N., Homo Deus: A Brief History of Tomorrow, Harvill Secker London, 2016, pp. 135-137.
 Moyakine E., Online Anonymity in the Modern Digital Age: Quest for a Legal Right, Journal of Information, Rights, Policy and Practice, Vol 1, No 1 (2016), p. 4.
 Handyside v United Kingdom, Merits, App No 5493/72, A/24,  ECHR 5, (1976) 1 EHRR 737, (1979) 1 EHRR 737, IHRL 14 (ECHR 1976), 7th December 1976, ECtHR, para 49.
 Ahmet Yildirim v Turkey, Merits, App No 3111/10, 18th December 1976, Second Section, ECtHR para 54.
 Madrigal A., Why Facebook and Google's Concept of 'Real Names' Is Revolutionary, in The Atlantis, 5 August 2011, available at: https://www.theatlantic.com/technology (accessed on 10 March 2017).
 Zingales N., Virtues and perils of anonymity: should intermediaries bear the burden?, TILEC Discussion Paper, DP 2014-025, July 2014, available at: http://ssrn.com/abstract=2463564 (accessed on 10 March 2017).
 Delfi v Estonia, Merits, App No 64569/09, Chamber Judgment  ECHR 941, 10th October 2013, ECtHR, para 92.
 Esayas S. Y., The role of anonymisation and pseudonymisation under the EU data privacy rules: beyond the 'all or nothing' approach, in European Journal of Law and Technology, Vol 6, No 2, 2015.
 Judgment of the Court (Third Chamber) of 15 September 2016, Tobias Mc Fadden v Sony Music Entertainment Germany GmbH, C-484/14, ECLI:EU:C:2016:68.
 Judgment in Mc Fadden, ECLI:EU:C:2016:68, para 90.
 Husovec M., Holey Cap! CJEU Drills (Yet) Another Hole in the E-Commerce Directive’s Safe Harbors Holey Cap!, Forthcoming, Journal of Intellectual Property Law & Practice (JIPLP), published as draft at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2843816 (accessed on 15 March 2017).
 Opinion of Advocate General Szpunar delivered on 16 March 2016, Mc Fadden, C-484/14, ECLI:EU:C:2016:170, para 146.
 Cholasta R., Korbel F., CJEU's judgment is opening the way for limiting anonymous access to the Internet http://www.lexology.com/library/ (accessed on 15 March 2017) or Stalla-Bourdillon S., The CJEU rules on free access to wireless local area networks in McFadden: The last(?) shudder of Article 15 ECD, the vanishing of effective remedies, and a big farewell to free Wi-Fi!, available at https://peepbeep.wordpress.com/2016 (accessed on 28 July 2017).
 For criticism of balancing test, see McFadden P. M., Balancing Test, Boston College of Law Review, Vol 29:585, May 1988, p. 644.
 See in the context of German constitutional debate, Schweizer M, Nudging and the Principle of Proportionality, in Mathis K., Tor A. (eds.), Nudging, Possibilities, Limitations and Applications in European Law, Springer (2016), p. 114.
 Judgment in Mc Fadden, ECLI:EU:C:2016:68, para 82 and 83.
 Judgment in Mc Fadden, ECLI:EU:C:2016:68, para 92.
 For some types of cookies the consent is not mandatory. Those cookies include any technical information or information necessary for the provision of services. Under the proposed Regulation on Privacy and Electronic Communications no consent will be required for non-privacy intrusive cookies (e.g. the history of shopping cart).
 Article 29 Working Party, Opinion 15/2011 on the definition of consent (WP 187), 13 July 2011.
 Notably, Recital 37 and Article 9 of the DPD.
 Judgment of the Court of 6 November 2003, Bodil Lindqvist, C-101/01, ECLI:EU:C:2003:596, para 82.
 To criticism of human rights inflation in the online environment, e.g. De Hert, P., Kloza, D., Internet (access) as a new fundamental right. Inflating the current rights framework?, European Journal of Law and Technology, Vol. 3. No. 3, 2012.
 Article 29 Working Party, “Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC”, WP 217, 9 April 2014.
 Judgment in Mc Fadden, ECLI:EU:C:2016:68, para 91.
 Judgement of the Court (Fourth Chamber) of 27 March 2014, UPC Telekabel Wien, Case C‑314/12, ECLI:EU:C:2014:192, para 57.
 Judgment in Mc Fadden, ECLI:EU:C:2016:68, at 96 and 10.
 Husovec M., supra note xii.
 Times Newspapers Limited v the United Kingdom, App Nos 3002/03 and 23676/03,  EMLR 14, 10th March 2009, ECtHR, para 27.
 Opinion of Advocate General Jääskinen delivered on 25 June 2013, Case C‑131/12, Google Spain, ECLI:EU:C:2013:424, para 121.
 Judgment in Mc Fadden, ECLI:EU:C:2016:68, para 93.
 Ahmet Yıldırım v. Turkey, Cengiz, App No, ECtHR and Others v. Turkey, App No, ECtHR, and further in Judgment in Mc Fadden, ECLI:EU:C:2016:68, para 92.
 See e.g. Ashby Donald et Autres c France, App No 36769/08, 10 January 2013, ECtHR.
 Judgment in Mc Fadden, ECLI:EU:C:2016:68, para 98.
 Judgement of the Court in UPC Telekabel Wien, ECLI:EU:C:2014:192, para 56, Judgment in Mc Fadden, ECLI:EU:C:2016:68, para 93, and similarly, from Judgment of the Court (Third Chamber) of 24 November 2011, Scarlet Extended, ECLI:EU:C:2011:771, C-70/10 para 52.
 Schweizer M, supra note xvi, pp. 100-101.
 Insecure public networks leave the Internet user to deal with several inherent risks (e.g. data theft), and discourage lawful exercise of the right to information.
 Schweizer M., supra note xvi, pp. 100-101.
 Judgement of the Court in UPC Telekabel Wien, ECLI:EU:C:2014:192, and Judgment in Mc Fadden, ECLI:EU:C:2016:68.
 See Cumhuriyet Vakfı and Others v Turkey, App No 28255/07, 8th October 2013, ECtHR.
 Mosley v the United Kingdom, App No 48009/08, 10th May 2011, ECtHR or Morice v. France [GC], App No 29369/10, ECHR 2015, ECtHR (“where fines are concerned as a moderate type of sanction, it would not suffice to negate the risk of chilling effects on the freedom of expression”, para 176).
 In this case, affecting the possibility of using the ISP’s services to access information lawfully. See Judgment in Mc Fadden, ECLI:EU:C:2016:68, para 94.
 McFadden P. M., supra note xv, p. 586.
 Fomperosa Rivero Á., Right to Be Forgotten in the European Court of Justice Google Spain Case: The Right Balance of Privacy Rights, Procedure, and Extraterritoriality, Stanford-Vienna Transatlantic Technology Law Forum, European Union Law Working Papers, No 19, p. 21.
 Kelsen H., General Theory of Law and State, translated by Wedberg A., Harvard University Press, 1945, p. 3.
 See Scharsach and News Verlagsgesellschaft mbH. v Austria, App No 39394/98, ECHR 2003-XI, ECtHR, para 30. Also as Frank La Rue, former Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression stated in his 2013 Report to the Human Rights Council noted: “Privacy and freedom of expression are interlinked and mutually dependent”.
 E.g. seminal Schauer F., Fear, Risk, and the First Amendment: Unraveling the “Chilling Effect,” 58 B.U. L. REV. 685, 730 (1978).
 See Article 11(1) of the Charter.
 See, i.a., Jersild v Denmark, App No 15890/89, 24th September 1994, ECtHR (GK), para 31; 24.2.1997, De Haes and Gijsels v Belgium, App No 19983/92, 29th March 2001, ECtHR, para 48; Thoma v Luxembourg, App No 38432/97, 12th September 2001, ECtHR para 45, Palomo Sánchez v Spain, App No 28.955/06, 28th October 2014, ECtHR, para 53.
 Murat Vural v Turkey, App No 9540/07, 21st October 2014, ECtHR, para 52.
 See Open Door and Dublin Well Woman v Ireland, App Nos 14234/88 u 14235/88, 29th October 1992, ECtHR.
 Recommendation CM/Rec(2014)6 of the Committee of Ministers to member States on a guide to human rights for Internet users Explanatory Memorandum, available at: https://search.coe.int/cm/Pages/result_details , p. 40 (accessed on 8 March 2017).
 Lynskey O., Deconstructing data protection: the “added-value” of a right to data protection in the EU legal order, 63 International & Comparative Law Quarterly (2014), p. 577.
 Article 7 of the Charter (Respect for private and family life) prescribes that everyone has the right to respect for his or her private and family life, home and communications.
 Explanations relating to the Charter of Fundamental Rights. Official Journal of the European Union C 303/17 - 14.12.2007.
 See Jozwiak M., Balancing the Rights to Data Protection and Freedom of Expression and Information by the Court of Justice of the European Union. The Vulnerability of Rights in an Online Context, 23 MJ 3 (2016), p. 419.
 According to AG Jääskinen in Google Spain, ECLI:EU:C:2013:424, search processes constitute an important concretisation of the freedom of expression.
 Ohm P., Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization, 57 UCLA Law Review 1701 (2010).
 Penney J. W., Chilling Effects: Online Surveillance and Wikipedia Use, 31 Berkeley Tech. L.J. 117 (2016).
 New York Times v Sullivan, 376 U.S. 967 84 S. Ct. 1130 12 L. Ed. 2d 83 1964 U.S., U.S. Supreme Court.
 Wachter S., Privacy: Primus Inter Pares Privacy as a precondition for self-development, personal fulfilment and the free enjoyment of fundamental human rights, available at https://papers.ssrn.com/sol3/ (accessed on 8 March 2017).
 Judgment of the Court of 8 April 2014, Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources, Minister for Justice, Equality and Law Reform, Commissioner of the Garda Síochána, C‑293/12, ECLI:EU:C:2014:238, para 37.
 Moyakine E, supra note ii.
 Nickel, James. Making Sense of Human Rights: Philosophical Reflections on the Universal Declaration of Human Rights, (Berkeley; University of California Press, 1987), pp. 561-2.
 Per AG Maduro’s opinion in case C‑303/06 S. Coleman v Attridge Law and Steve Law, on 31 January 2008, ECLI:EU:C:2008:61, personal autonomy and human dignity are values underlying the principle of equality, para 8.
 Pretty v the United Kingdom, App No 2346/02, 29th April 2002, ECtHR, para 62.
 Judgment of the Court of 5 October 1999, Kingdom of Spain v Commission of the European Communities, Case C-240/97, ECLI:EU:C:1999:479, para 99.
 See Marshall J., Personal Freedom through Human Rights Law? Autonomy, Identity and Integrity under the European Convention on Human Rights, Martinus Nijhoff Publishers, Leiden, 2009.
 Goodwin v the United Kingdom, App No 28957/95, 11th July 2002, ECtHR (GC), para 90.
 E.g. Judgment of the Court of 19 October 2016, Case C‑582/14, Patrick Breyer v Bundesrepublik Deutschland, ECLI:EU:C:2016:779 and Judgment in Mc Fadden, ECLI:EU:C:2016:68.
 See e.g. Report of the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Frank La Rue, available at: http://www.ohchr.org/Documents/ , pp. 88 and 89 (accessed on 7 March 2017).
 Proposal for a Directive of the European Parliament and of the Council amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing and amending Directive 2009/101/EC (COM(2016) 450 final).
 Directive (EU) 2016/681 of the European Parliament and of the Council of 27 April 2016 on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.
 EPSC Strategic Notes, 11 January 2017, available at: https://ec.europa.eu/epsc/sites/ (accessed on 6 March 2017).
 von Bogdandy A., Kottman M., Antpöhler C., Dickschen J., Hentrei S., et altri, Reverse Solange – Protecting the Essence of Fundamental Rights against EU Member States, Common Market Law Review, 49.2 (Apr 2012), pp. 489 to 519.
 On the essence of fundamental rights, see Brkan M., In search of the concept of essence of EU fundamental rights through the prism of data privacy, Maastricht Faculty of Law Working Paper 2017-01, pp. 13 to 15.
 See Commentary of the Charter of Fundamental Rights of the European Union. ECtHR too places personal autonomy under the scope of the right to privacy per Article 8 ECHR (Kalacheva v. Russia, App No 3451/05, 7th May 2009, Tysiac v Poland, App No 5410/03, 20th March 2007, para 107 or Munjaz v the UK, App No 2913/06, 17th July 2012, para 80).
 For a long time, other scholars have argued that systematic collection of traffic data affects the inviolable core of the right to privacy (e.g. LIBE Committee Inquiry on Electronic Mass Surveillance of EU Citizens Hearing, European Parliament, 14 October 2013, Statement by Professor Martin Scheinin (EUI), former UN Special Rapporteur on human rights and counter-terrorism).
 See e.g Judgement of the Court of 29 January 2008, Promusicae, Case C‑275/06, ECLI:EU:C:2008:54, para 70. The Court insisted on the need to interpret the DPD and E-Privacy Directive so as to allow a fair balance to be struck between the various fundamental rights protected by the EU legal order.
 Judgment of the Court of 24 November 2011, ASNEF, Cases C‑468/10 and C‑469/10, ECLI:EU:C:2011:777, para 47.
 Judgement of the Court (Grand Chamber) of 13 May 2014, Google Spain, C-131/12, ECLI:EU:C:2014:317, para 81 and similarly Delfi v Estonia, App No 64569/09, 16 June 2015, ECtHR, para 132 and Opinion of AG Bobek, delivered on 26 January 2017, C‑13/16, Rīgas satiksme, ECLI:EU:C:2017:43, para 69.
 Judgment of the Court (Grand Chamber) of 6 October 2015, Schrems, C-362/14, ECLI:EU:C:2015:650, at 94.
 Also, in the words of ECtHR: “[A]lthough freedom of expression and confidentiality of communications are primary considerations and users of telecommunications and Internet services must have a guarantee that their own privacy and freedom of expression will be respected, such guarantee cannot be absolute and must yield on occasion to other legitimate imperatives, such as the prevention of disorder or crime or the protection of the rights and freedoms of others.” K.U v Finland, App No 2872/02, 2nd December 2008, ECtHR, para 49.
 Judgment in Tele2 Sverige, ECLI:EU:C:2016:970, para 98 and 99.
 Opinion of AG Maduro in Coleman, ECLI:EU:C:2008:61, para 9.
 Judgment of the Court (Grand Chamber) of 21 December 2016, Tele2 Sverige, C-203/15, ECLI:EU:C:2016:970, para 94.
 Judgment of the Court in Österreichischer Rundfunk u.a., ECLI:EU:C:2003:294, para 66.
 Judgment of the Court in ASNEF, ECLI:EU:C:2011:777, para 48.
 Joined App No 23927/94 and 24277/94, Sürekand Özdemir v. Turkey, 8 July 1999, ECtHR (GC), para 46.
 Judgment of the Court in Schrems, ECLI:EU:C:2015:650, para 89.
 Judgment of the Court in Promusicae, ECLI:EU:C:2008:54, para 65 and 66, and Judgment of the Court in Lindqvist, ECLI:EU:C:2003:596, para 85.
 Neij and Sunde Kolmisoppi v Sweden, App No 40397/12, 19th Febraury 2013, ECtHR, part D.
 Judgement of the Court of 12 July 2011, L’Oréal, C-324/09, ECLI:EU:C:2011:474, para 135, 136 and 144.
 Also see similarly K.U v Finland App No 2872/02, as discussed in Zingales N, supra note vi, p. 20.
 Judgment of the Court in SABAM, ECLI:EU:C:2003:294, para 49.
 Judgment of the Court in Scarlet Extended, ECLI:EU:C:2011:771, para 51.
 Judgement of the Court in UPC Telekabel Wien, ECLI:EU:C:2014:192, para 42.
 Judgment of the Court in Mc Fadden, ECLI:EU:C:2016:68.
 Zingales N., Virtues and Perils of Anonymity Should Intermediaries Bear the Burden?, JIPITEC (2014), p. 162.
 See also joint dissenting opinions of Judges Sajó and Tsotsoria in Delfi AS v Estonia, ECtHR judgment, notably para 3 and 14.
 PEN’s survey, Chilling Effects: NSA Surveillance Drives Writers to Self-Censor, 2013.
 See Preibusch S., Privacy Behaviour After Snowden June Revelations, 58 Communications of the ACM.48; pp. 48-52 (2015).
 Zuiderveen Borgesius, F. J., Improving privacy protection in the area of behavioural targeting (2014), available at: https://pure.uva.nl/ws/files/2141324/154447_05.pdf (accessed 15 April 2017).
 Opinion of AG Maduro in Coleman, ECLI:EU:C:2008:61, para 11.
 Opinion of AG Szpunar in Mc Fadden, ECLI:EU:C:2016:170, para 149.
 Opinion of AG Bobek in Rīgas satiksme, ECLI:EU:C:2017:43, para 95.
 Article 29 Working Party, "Opinion 15/2011 on the definition of consent" (WP 187), 13 July 2011.
 Article 6(1)(c) and recital 28 of the DPD require that personal data must be adequate, relevant and not excessive in relation to the purposes for which they are collected, but also when further processed.
 Judgment in Mc Fadden, ECLI:EU:C:2016:68.
 In this regard, also Opinion of AG Bobek in Rīgas satiksme, ECLI:EU:C:2017:43, para 89.
 Judgment of the Court in Promusicae, ECLI:EU:C:2008:54, para 53.
 See also Zingales N., supra note cvi.
 E.g. following an order served upon an ISP to give a copyright holder an information revealing identity of a particular subscriber (an alleged infringer) per Directive 2004/48, to whom the ISP provided an IP address. Judgment of the Court (Third Chamber) of 19 April 2012, Bonnier Audio and Others, C-461/10, ECLI:EU:C:2012:219, para 36.
 Judgment of the Court in Bonnier Audio and Others, ECLI:EU:C:2012:219, para 60 and Order of the Court of 19 February 2009, LSG-Gesellschaft, C‑557/07, para 29.
 Judgment of the Court in Bonnier Audio in Others, ECLI:EU:C:2012:219, para 58.
 Judgment of the Court in Promusicae, ECLI:EU:C:2008:54, para 70.
 By analogy, Opinion of AG Bobek in Rīgas satiksme, ECLI:EU:C:2017:43, at 65. At the stage of initiating legal proceedings, “[t]he disclosure in itself would therefore not even bring about any immediate change to the legal situation of the data subject”, para 81.
 See also Rosatti E., Intermediary IP injunctions in the EU and UK experiences: when less (harmonization) is more?, p. 17, available at https://ssrn.com/abstract=2891042 (accessed on 7 March 2017).
 Judgment of the Court in Patrick Breyer v Bundesrepublik Deutschland, ECLI:EU:C:2016:779, para 46 and 48.
 Recommendation CM/Rec(2011)7 of the Committee of Ministers to Member States on a new notion of media (adopted on 21 September 2011) or Opinion of Advocate General Szpunar in Mc Fadden, ECLI:EU:C:2016:170, para 131.
 Opinion of Advocate General Szpunar in Mc Fadden, ECLI:EU:C:2016:170 and Husovec M., supra note xii.
 Opinion of Advocate General Szpunar in Mc Fadden, ECLI:EU:C:2016:170, para 143.
 Opinion of Advocate General Jääskinen in L’Oréal, para 115.
 Article 18 of the E-Commerce Directive and Judgement of the Court of 12 July 2011, L’Oréal, C-324/09, ECLI:EU:C:2011:474, para 133.
 Judgment of the Court in Coty Germany GmbH v Stadtsparkasse Magdeburg, ECLI:EU:C:2015:485, para 28.
 Proposal for a Directive of the European Parliament and of the Council on copyright in the Digital Single Market (COM(2016) 593 final), Article 13(2) also emphasizes the right of redress: “Member States shall ensure that the service providers referred to in paragraph 1 put in place effective mechanisms, including for complaint and redress, that are available to users in case of disputes over the application of the measures referred to in paragraph 1.”.
 See Giovanella I. F., de Rosnay M. D., Community wireless networks, intermediary liability and the McFadden CJEU case, Communications Law, Bloomsbury, Wiley, 2017, 22 (1), p. 17.
 Foucault M., Discipline and Punish, Vintage Books, 1995, p. 19.
 Rodrıguez-Priego N., van Bavel R., Monteleone S., The disconnection between privacy notices and information disclosure: an online experiment, Econ Polit (2016) 33, pp. 433–461.
 Ohm P., supra note lix, pp. 1762 to 1764 and Nissenbaum H., Privacy as Contextual Integrity, 79 WASH. L. REV. 119, 154 (2004).
 Judgement of the Court in UPC Telekabel Wien, Case C‑314/12, ECLI:EU:C:2014:192, para 60.
 Judgment of the European Court of Human Rights, Mosley vs UK, paras 108-110.
Ciarán Burke, Alexandra Molitorisová, What Does It Matter Who is Browsing? ISP Liability and the Right to Anonymity, 8 (2017) JIPITEC 238 para 1.
The Intermediary Conundrum: Cyber-Regulators, Cyber-Police or Both?

References: sui generis
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 v. 
 v. 
 v. 
 v. 
 v. 
 CJEU