Source: https://www.utrechtjournal.org/articles/10.5334/ujiel.cu/
Timestamp: 2019-04-20 10:50:47+00:00

Document:
ing. Michiel Rhoen LLM is an external PhD-candidate at eLaw@Leiden, Leiden law school.
Big data puts data protection to the test. Consumers granting permission to process their personal data are increasingly opening up their personal lives, thanks to the “datafication” of everyday life, indefinite data retention and the increasing sophistication of algorithms for analysis.
The privacy implications of big data call for serious consideration of consumers’ opportunities to participate in decision-making processes about their contracts. If these opportunities are insufficient, the resulting rules may represent special interests rather than consumers’ needs. This may undermine the legitimacy of big data applications.
This article argues that providing sufficient consumer participation in privacy matters requires choosing the best available decision making mechanism. Is a consumer to negotiate his own privacy terms in the market, will lawmakers step in on his behalf, or is he to seek protection through courts? Furthermore is this a matter of national law or European law? These choices will affect the opportunities for achieving different policy goals associated with the possible benefits of the “big data revolution”.
Responding to declining Short Message Service (SMS) revenues, KPN announced the company had the intention to use this DPI technology to charge for the use of instant messaging (IM) applications on smartphones (apps). Use of IM apps (like WhatsApp) substituted consumers’ use of individually priced SMS messages. This dramatically reduced KPN’s profits. DPI would allow KPN to reverse this trend, as it enabled the company to distinguish IM traffic from other traffic, and charge a higher price for the IM services. Consequently, KPN would no longer provide a “neutral” network, which would treat all types of traffic equally, but would be able to distinguish between different origins of traffic (i.e. different apps) and use different policies for the corresponding services. For this purpose, KPN would analyse the user data within packets sent across its network, as well as their control information – hence the name Deep Packet Inspection. This is, to some extent, analogous to the postman reading a letter to see whether it is priority mail, instead of looking at the indication and stamps on the envelope. Although imperfect in many ways, this analogy indicates the privacy implications of DPI.
KPN’s announcement brought the net neutrality debate to Dutch Parliament. Essentially, net neutrality is about control: are network operators allowed to ‘block […] or prioritise […] certain network traffic or traffic from particular sources’?4 Should KPN be allowed to charge its subscribers a premium for their use of specific applications?
Usually, these consumer contracts offer benefits to consumers that are unrelated to their personal data. Sometimes, these contracts are unavoidable for the consumer (everybody needs banking, telecommunications and public transport). Sometimes consumers enter into these contracts to obtain a side benefit to another transaction (e.g. using a loyalty program to obtain a rebate from a retailer). Sometimes the exchange of personal data for services is an essential performance of the contract (e.g. when using a social network site) and sometimes the data only has value for the party collecting it, for example when a web site uses tracking cookies to follow the behaviour of every website visitor.
Consumers have reduced opportunities for participation in determining the contents of privacy contracts: they cannot voice their opinion on the contents, the contents are not influenced by their opinions, and not entering into the contract is often not an option. KPN’s announcement to start pricing IM apps by using DPI increased awareness among consumers and legislators that contracts about the use of telecommunication services are indeed privacy contracts, i.e. contracts pertaining to the use of personal data and its privacy implications.
First stage: after intense lobbying by interest groups including the telecoms industry,18 the aforementioned revised Telecoms package explicitly left net neutrality decisions to the market. If too many consumers refuse to enter into a contract with KPN, another provider will offer a better deal or KPN will change their offering.
Third (hypothetical) stage: Had both the market and the political process failed to sufficiently protect consumer privacy, a consumer would be entitled to involve the national courts. Article 8 of the European Convention of Human Rights (ECHR) guarantees the right to respect for one’s ‘private and family life, his home and (…) correspondence’. Article 13 of the Convention requires an effective remedy before a national court for violations of this right. However, a verdict from a court would typically affect only the contracts to which the litigants are a party.
Different institutions might offer different outcomes. Evidently, the market, the political process and the courts all offer different opportunities for effective consumer participation: the market allows for negotiations on particular contract terms; consumers can elect legislators and authorise them to impose rules to govern all contracts; courts settle disputes between consumers and their contract partners.
Participation opportunities for consumers are of interest to privacy contracts because participation is one of three traditional legitimacy requirements, together with transparency and accountability, for an act that affects a fundamental right.21 A society, such as a State or the European Union, can deliberately choose which institution decides on privacy contracts. Not deciding on how to offer participation opportunities or how to meet legitimacy requirements could unnecessarily impede efficient decision-making.
Consumer participation takes different forms in different institutions: they act as citizens, voters, litigants and participants in consumer interest groups. They are the holders of specific protections in the Charter of Fundamental Rights of the European Union (the Charter).22 The term “consumers” is used throughout this article, to easily distinguish them from their contract partners, indicated as “producers”. Producers are providers of goods and services and the controllers and processors of personal data within the market,23 whilst in other institutions they can operate as lobbyists or litigants.
When deciding on privacy contracts in the age of big data, how does institutional choice affect consumer participation opportunities and how does it affect the feasibility of policy objectives in the European multilevel jurisdiction?
Why does institutional choice matter for privacy protection?
How do the possibilities of participation for consumers and producers qualitatively compare between institutions, if decisions on consumer privacy were to be left to the market, the political process or the courts, respectively?
What does the analysis imply for different policy objectives concerning the impact of big data on ­society?
This article answers the questions set out above by performing a comparative institutional analysis between the political process, the market and the courts at both national and European Union levels. The comparison focuses on each institution’s possibilities for providing effective participation opportunities to ­ consumers.
Comparison between institutions is possible if the same individuals participate in all compared institutions. In the case of big data and privacy contracts, we assume that buyers and sellers, or consumers and producers, or litigants before the courts and voters and lobbyists are indeed members of the same mass of people. Comparison is useful, even though no single institution can be expected to perform perfectly. Institutional performance deteriorates when the number and complexity of the required decisions increase. In these cases, ‘institutions tend to move together’.26 Even the best available institutional option may leave much to be desired.
The benefits of participation are dependent on the distribution of stakes at play for the participants. This distribution is determined by the average per capita stakes within the population and by the extent to which the stakes vary within the population.
The relevance and the specifics of the application of comparative institutional analysis to the research question are addressed in section II. Section III contains the actual analysis. Section IV then applies the outcome of this analysis to a number of possible policy objectives. The final section contains some concluding remarks.
Transaction costs will rise in every institution if numbers and complexity increase. Therefore, it is of particular relevance that, as a result of datafication, both the number and the complexity of decisions on privacy contracts have increased substantially. The number of decisions is related to the rising number of privacy contracts and the number of transactions generating personal data, as indicated earlier. The complexity of privacy contracts is also increasing, particularly in terms of (a) the technology used for executing them, and (b) the number of parties involved. Technology has increased the complexity of privacy contracts: the fact that technological aspects need not be disclosed to consumers32 makes it difficult to determine whether a particular use of personal data remains within the boundaries set in the contract, or even to determine those boundaries themselves. The increasing number of parties involved increases complexity, because data will be collected from multiple sources and shared with multiple users. This may result in multilateral exchanges of personal data based on bilateral contracts.
Coase’s theory of transaction costs dictates that if an institution decides on privacy contracts, the value of these contracts plays an important part in the dynamics of participation. This presents a problem for two reasons. Firstly, privacy – as a fundamental right and an aspect of human dignity – may be considered not to have a monetary value, or even not suitable to be bought and sold.34 Secondly, many privacy contracts do not specifically put a monetary value on the personal data portion of the performance. This incompatibility manifests itself at the level of individual transactions (the microeconomic level) and at the level of privacy as a factor promoting or hindering societal prosperity or wealth (the macroeconomic level).
To facilitate decision-making, law and economic theory attach economic value to privacy in an indirect way. The law solves the microeconomic part of the problem by separating decisions on the legitimate processing of personal data from decisions on privacy. The latter lacks a precise definition. Evaluating conformity with article 8 requires judicial decisions, which are difficult to achieve, low in volume and come with high transaction costs. The Data Protection Directive simplifies this process by allowing a high volume of decisions at a low cost. It does this both by making compliance easier for producers (by setting relatively simple standards for the processing of personal data) and by authorising consumers to enter into agreements (art. 7(a-b), Data Protection Directive). This, by the way, makes the Directive an example of institutional choice.
Requiring consumers’ agreement enables them to exchange their personal data for services without money changing hands. The business model of Google is a good example. Google provides its users with an e-mail service, online document collaboration, photo and video sharing services, a searchable map of the world and a search engine to the World Wide Web. for free. Google also generates and populates databases for and from all these activities. Taken together, these are Google’s costs. The company then monetises the users’ personal data by offering targeted advertising options within its’ services to third parties (an example of a two-sided market).35 The revenues of this operation exceeded the costs by approximately a billion dollars per month in the third quarter of 2013.36 For consumers, Google’s “free” services apparently offer good value. The price they pay is the risk of losing some personal privacy. Many consumers (implicitly) decide that this is a good deal, whether or not they are aware of all the privacy implications of their contracts.
Economic theory, on the other hand, provides a concept for comparing costs and benefits at the macroeconomic level. Loss of privacy for individuals or groups can be considered a form of social cost.37 This cost does not manifest itself in individual transactions and is therefore not suitable for analysing participation in the market. It can, however, be taken into account in the political process or the courts, for example when considering admissibility of terms, taxation, bona fides or the common good.
This article compares markets, the political process and courts at the levels of Member States and the European Union. Institutions at the level of the Council of Europe (CoE) are excluded. They are not open to the same mass of participants – there is no common market in the CoE, and neither its political process nor the European Court of Human Rights (ECtHR) is accessible to consumers or producers participating at the EU or national levels. The ECtHR only handles cases against a State or between States.38 The officials taking part in the political process of the CoE are not appointed after general elections. The verdicts of the ECtHR do not bind the institutions of the EU, although the EU accepts the ECtHR’s interpretation of human rights as its own (article 6, TEU).
National courts cannot be compared to the European Court of Justice. As far as disputes over privacy contracts between consumers and producers are concerned, the latter court is inaccessible to litigants. If litigants reside in the same State, national courts have jurisdiction. If litigants reside in different Member States, the so-called Brussels I regulation decides which national court has jurisdiction.39 In all other cases, domestic law decides whether the national courts have jurisdiction. If a dispute before a national court requires a uniform interpretation of EU law, the highest national court is required to put the matter before the CJEU (art. 267, TFEU). However, this is only to interpret EU law, not to decide the case.
Comparing the European internal market to other markets is impossible because there is no equivalent institution at the national level. Where markets still have a strong national focus (e.g. telecommunications, where the ITU still allows for price differentiation based on traffic crossing national borders),40 comparison will effectively be limited to the national level.
Between the national and the EU levels: the market and the political process.
The terms and conditions of a privacy contract are usually not negotiable. As a result, the decision of the market is effectively the decision of the party who drafts the contract. In a transaction between a consumer and a producer, this will be the producer.
The dynamics of participation in this decision making process can be described as follows. As for the benefits in terms of monetary exchange, the stakes per contract are roughly equivalent for consumers and producers. The stakes per contract are supposedly symmetrical. Competition in the market will presumably cause the price the consumer pays to be near cost, so the price for the services will only be marginally different between producers for an equivalent level of service. If no money is changing hands, the “price” one consumer pays is close to the marginal cost of operating the service for one more consumer. If the number of consumers is large enough the same is probably true for the increase in profits that a producer can obtain by making the personal data of one more consumer available for personalised advertising services.
In this article the distribution of stakes over consumers and producers as a group is assumed to be close to homogenous. For consumers, this assumption is based on the idea that consumers as a group have roughly the same need for these services. For the scope of this article, this seems a safe assumption given there is no discernible group of consumers that has a lot more depending on a phone contract, a loyalty card or a Facebook account, than the average of all consumers combined.42 For producers engaging in privacy contracts, distribution of stakes is assumed to be homogenous as a starting assumption in the absence of sufficient data. Producers’ stakes are not easily determined, with some enterprises standing to gain more from privacy contracts than others; depending on their size, their business case and whether they wield specific market power. Determining the per capita stakes and distribution of stakes for producers is further complicated by the recent tendency of actors in traditionally one-sided markets, to make their market two-sided.43 To keep the comparison manageable, this subject is not explored further in this article.
All in all, when bargaining for a privacy contract in the market, consumers can be said to be at a disadvantage when compared to producers. They have only small stakes per contract and the presumed homogenous distribution of stakes makes it more difficult to organise buying power to negotiate better terms. They also tend to qualify as one-shotters, with little opportunities to gain significant experience. Producers on the other hand, have the opportunity to benefit from repeat-player status by using the same contract repeatedly. The value of all privacy contracts combined raise their stakes and costs of organisation are low because of their low numbers. This encourages them to invest larger amounts of resources into the contents of privacy contracts.
In the political process, the per capita stakes for producers are still determined by the value of all their privacy contracts combined. However, for consumers acting as a society with the ability to affect the contents of all privacy contracts at once by means of elected representatives, per capita stakes can also increase. Combining the value of all voters, the stakes are increased from the value of one privacy contract per transaction, to the social cost of privacy.48 These increased stakes encourage resource pooling for voters, which helps in levelling the playing field on the benefit side when compared to the market. Participants also take on different roles, consumers generally acting as voters and producers active as – or via – lobbyists.
Although votes usually have identical weight for all voters, the distribution of stakes in the political process is possibly less homogenous than in the market. For example, if a political party does not consider privacy contracts an issue for the past or coming elections platform, voters and legislators for this party can be said to have lower stakes in privacy contracts. Producers with large stakes in a certain outcome (or status quo) can exploit differences between political parties by concentrating their lobbying efforts, or donations, to benefit parties with favourable viewpoints. Unevenly distributed stakes will have a positive effect on the formation of pressure groups or political action committees.
Consumers may not stand to profit too much from this change in dynamics. It is not easy to attach a monetary value to privacy as a social cost. Therefore the increased stakes do not easily translate to voters’ increased willingness to spend money on participation. Producers do not have to deal with this uncertainty to determine how much they want to spend.
The costs of participating in the political process are usually the cost of gathering information, popular campaigning and influencing legislators. These processes are used to organise and spread information among voters to promote public awareness, to gather support among voters and to bring specific viewpoints across to legislators, to influence their political activities (e.g. by hiring lobbyists). These costs can be high, which – at least in theory – again works in favour of producers, who have higher per capita stakes and correspondingly larger resources at their disposal.
When compared to the market, the cost of participation in the political process for consumers is either lower or higher, depending on a number of circumstances. Their costs of organisation can be reduced if groups of voters are pre-organised in political parties or interest groups by reducing sunk costs. This lowers the cost of activities for subsequent issues.49 In the DPI/net neutrality example, the involvement of existing political parties and interest groups made all the difference, even if the parties pushing for the amendment did not form a majority in Parliament. On the other hand, if none of the political parties see privacy contracts as an important issue, the low per-capita stakes for voters work to their disadvantage as they do in the market. Producers can use this as an opportunity to lobby all parties in parliament, increasing the costs of organisation for consumers. In those cases, pressure groups or political action committees have to find another way to influence legislators, increasing the cost of organisation. Seeking press coverage is one possible way to reduce these costs. As was seen in the DPI/net neutrality example, press coverage (triggered by statements of interest groups) was the second important factor in influencing politicians. It increased awareness among legislators for privacy aspects of DPI and probably alerted a large number of voters who were unaware of KPN’s plans. This added to the effectiveness of organised lobbying from consumers’ action committees.
All in all, the dynamics of participation in the national political process are more favourable to consumers than they are in the market, due to reduced sunk costs and monitoring costs. However, producers can also have considerable clout in the legislative process, mainly as a result of their high per capita stakes.
Before a court, the dynamics of participation change once again. On the benefit side, the stakes for a producer can be significant, if the verdict can affect a large number of contracts. On the consumer side, the stakes depend on whether the case is a matter of collective redress, or a dispute over a single contract. Collective redress allows for resource pooling among plaintiffs acting as one single litigator, increasing the per capita stakes by rolling many capita into one. However, collective redress is not always available.53 Furthermore, seeking collective redress may eliminate any advantages that domestic procedural law would grant individual consumers. In an individual action, the stakes for the consumer are once more no higher than the value of the contract, putting him at a disadvantage when compared to a high stakes producer.
Costs of participation in the courts are not fixed. Both parties are free to spend as much as they want on information or organisation. Rational litigants will not spend more than the stakes of the case as spending more will result in a net loss, even if the case is won. Under this assumption, producers will generally be prepared to spend more as a result of their higher per capita stakes. The party with more willingness to spend can usually rally more influential allies and produce more expert opinions.54 Information produced by one party may still increase both parties’ costs, even if it is available to the opposing party at no extra cost. For example, if judges act as ‘passive umpires’, they may regard information that is not countered as being undisputed by the opposing party.55 In such a case, producing excessive amounts of information can exhaust the means of the lower-stakes litigant.
The costs of organisation are also in the hands of the litigants, apart from the minimum costs associated with court fees and counsel. Once more, the party with the most resources at its disposal (e.g. more lawyers) could exhaust the resources of other parties and force them to give up, by using every available legal avenue and by complicating or lengthening proceedings to the maximum extent possible. The level of proficiency in the task at hand also determines the costs of organisation.56 By this metric, repeat players are at an advantage because they can use their experience in organising their work more efficiently. Producers are more likely to be repeat players because of the large number of contracts they engage in.
All this puts consumers at a clear disadvantage before the courts. To quote Prof. Giesen on Dutch law: ‘Private law […] does not deal in affirmative action for the weaker party (rather the opposite, really)’.57 The difference in per capita stakes makes it unlikely that an individual consumer can effectively challenge a privacy contract if there is no clear-cut legislation on which the Court can easily decide the case. The individual consumer is more likely to be a one-shotter. Compared to a producer with high stakes, the consumer also qualifies as a have-not.58 Producers are more likely to be repeat players in the court system. Given their increased stakes and proportionally larger resources, they qualify as the haves in this context.
Collective redress opportunities may compensate this disadvantage: it may increase the stakes, allow for resource pooling and reduce the costs of information. In high-profile test cases, publicizing fundraising efforts may lower the cost of organisation and engage experts that will regard increased publicity as a form of compensation, thus lowering the costs of information. However, this reintroduces some of the factors we already saw working against consumers in the market. Both test cases and collective redress rely on contributions from a large class of consumers. In a large class, the benefits of participation may again be low because of the evenly distributed stakes.
Substantive and procedural law offer another way to reduce consumers’ disadvantages. For example, Dutch consumers are usually entitled to a procedure before a court that does not require legal ­representation – a measure aimed specifically at reducing their costs of organisation.59 European consumers may profit from ex officio application of EU consumer protection law. As a side effect, the cost of information may be reduced in some cases.60 The effectiveness of these measures is not explored further in this article, as it goes beyond the scope of comparative institutional analysis.
When seeking decisions on the contents of privacy contracts at the national level, participation opportunities for consumers compare unfavourably to those of producers in the market and the courts, and probably in the political process as well.
Consumer disadvantage is smallest when participating in the political process. Earlier organisational efforts lower the cost of organisation for consumers on new issues, even if these parties organise only a tiny fraction of the mass of consumers. The cost of participation can also turn out lower if privacy contracts continue to be of interest to the press. The macroeconomic aspect of the political process helps raise the stakes, from the value of a single contract to the value of privacy as a social cost of big data. The raised stakes help increase the resources available by encouraging resource pooling.
This smaller disadvantage is no guarantee for consumer success in the political process. Per-capita stakes for producers are high. The political process is therefore not immune to the lobbying force of concentrated minority interests. The results of the political process may still have a minoritarian bias.
For producers, the courts and the market are very efficient institutions to achieve their objectives. In the market, they enjoy low costs of information and organisation and the benefits of repeat player status. They are also motivated by high per capita stakes as a result of the large number of contracts.62 In court, where the stakes per decision may be higher than in the market, this difference is enhanced even further. In the political process, this advantage is reduced.
The dynamics of participation at the EU level differ from those at the national level for two reasons. Firstly the institutions themselves are different, and secondly the scope of the EU is much larger. Comparing different institutions at the EU level is therefore not easily separated from comparing their similar institutions between both levels. As a result, this section addresses both comparisons simultaneously. This subsection offers conclusions for the comparison on the EU level. Subsection C briefly summarises the comparison between institutions at the national and the EU-levels.
For consumers, the dynamics of participation on the European level are partially similar to those on the national level. The effects of being a one-shot player with stakes not exceeding the value of a single contract are the same.
Consumers’ benefits of participation are lower in the internal market. The larger number of individuals makes the distribution of stakes even more uniform.63 This again means there probably is no substantial subgroup of consumers for which the benefits of participation are significantly higher. This lowers the incentives for consumers to organise themselves. The stakes for a single consumer still don’t exceed the value of a privacy contract.
Consumers also face higher costs of participation at the European level. A penalty on participation in the market at the European level exists if cross-border transactions bear higher costs than domestic transactions, as is the case with telephone or wireless Internet contracts.64 For most consumers, the cost of information rises if this involves acquiring information in a foreign language that needs translation. This applies both to the contents of the contract and to the law of the land. Translation costs may similarly increase the cost of organisation for consumers, for example if they want to organise across these barriers. Incentives for compensating these increased costs are low because of the low per capita stakes.
Conversely, for producers the dynamics of participation on the internal market are working in their favour. The potential number of contracts a producer can enter into is increased, raising the per-capita stakes. This is the same for all producers engaging in privacy contracts. Therefore, producers can still be seen as a small, more-or-less uniform group with high per-capita stakes.
The opportunity to spread the costs of doing business over a larger number of contracts will encourage producers to participate in the market on the EU level. Trading in the internal market potentially lowers costs of participation per contract for producers, making one more contract more profitable. The internal market is one of the largest economic areas in the world, offering a large potential for additional contracts.67 As a side effect, this may enhance the benefits of repeat player status.
The per capita stakes at the EU level are larger than on the national level. EU decisions affect a much larger number of citizens and businesses, increasing their impact on privacy as a social cost. They also affect legislation in many countries, eliminating opportunities for consumers to find a better legal arrangement in another Member State. The stakes may however appear smaller to voters, because the European Parliament’s powers are less pronounced than those of national parliaments. The EP can pass a motion of censure on the entire Commission only with a two-thirds majority whereas national parliaments can usually do so with a simple majority and for single Ministers.71 Compared to national parliaments, the EP is elected for a longer period of time and it cannot be dissolved to enable voter participation in unresolved disputes between the EP, the Council and the Commission.72 Instead, the resolution of conflicts between these bodies is referred to a conciliation committee without any possibility of voter input.73 This makes voting less attractive.
The higher costs and the decreased benefits of participation at the EU level leave consumer interest groups short of money. Participation in the political process by consumer organisations requires external funding from the European Commission.76 BEUC and the national consumer associations are appointed as members of the European Consumer Consultative Group and in this capacity they are eligible for subsidies.77 The Commission decision establishing the group states that it is tasked with consumer interests in general, which means that it needs to spread itself thin over all consumer issues. BEUC is thus not a special interest privacy group. Such groups do exist, but even a group like European Digital Rights also had to rely on a grant from the European Commission of approximately 25% of their annual budget in 2013.78 Like in the market, resource pooling in the political process at the European level apparently does not sufficiently offset the higher costs of organisation at the EU level.
For producers, the benefits are quite large. The European political process is a high-stakes game because it regulates the internal market. This makes the distribution of stakes almost uniform, but at a very high level. Producers have a strong incentive to organise, even if the costs of organisation are high.
Like consumers, producers face higher costs of information and organisation in Brussels – but in accordance with their increased stakes, this appears to present no extra problems. Producers are the haves in this institution. They are able to pool and spend considerable resources and do not need EC subsidies. If lobbying efforts in the United States are any indication, spending several million on influencing legislation is an acceptable proposition to many individual companies.79 Producers have formed their own lobbying groups dedicated to data protection and privacy issues.80 Like consumers at the national level, producers can also benefit from earlier organisation efforts. Many industries that engage in privacy contracts have already formed interest groups for their core business, like the European Competitive Telecommunications Association, Digital Europe and the Euro Banking Association. When lobbying for privacy contracts legislation, this helps them avoid sunk costs.
It is therefore no surprise that high-stakes players are better represented than consumers in the Brussels lobbying circuit. In 2007, commercial and professional interests made up 63% of all permanent representations in Brussels, whilst consumer and human rights interests accounted for 13%.81 Their apparent abundance of funding puts them at an advantage over consumer special interest groups like EDRi, whilst general-interest groups like BEUC are probably already stretched thin because of their wide scope. These differences express themselves in increased opportunities to interact with officials in the EP, the Commission and comitology.
Producers are at an advantage both in the market and in the political process at the EU level. This is mainly due to the large cost of participation, combined with the large stakes for producers, giving them a bigger incentive to participate.
For consumers, participating in the market on the European level does not increase their per capita stakes but it does increase their costs. In the political process, the stakes for consumers are actually higher, but the costs of participation are raised even more: lobbying on the EU level is a very expensive undertaking. The comparatively low perceived stakes are an insufficient incentive to achieve sufficient resource pooling on this level. As a result, consumers on the EU level need financial aid to organise effectively in the market as well as in the political process.
At the national level, the market favours producers of privacy contracts – at the European level, the market favours them even more. The free movement of services, capital and personal data within the internal market can lower the cost of information and organisation significantly. These lowered costs together with the high per-capita stakes provide producers with a powerful incentive for participating in the market on the European level. These benefits offset any extra costs for organisation and information.
Consumers, on the other hand, reap no such benefits at the European level. The increased costs of participation are such that contracts in their home country are significantly more attractive, and consumer organisations need EU subsidies to participate efficiently. Their per capita stakes in privacy contracts are not raised when participating in the European market. Increased costs of information – for example, the costs of translation – make it even less attractive to look for a better privacy contract in another EU Member State.
Both for producers and consumers, shifting the political process to the European level increases costs of participation significantly. However, consumers may falsely tend to think of the EU political process as having lower stakes than their national process, because the European Parliament has less pronounced powers than the national parliaments and press coverage of other institutions and decisions is relatively scarce. Yet consumers’ stakes in the EU political process may actually be higher. A decision at the EU level decreases consumers’ opportunities to obtain a better agreement in another Member State. However, lower perceived stakes decrease active voter participation in the political process. Consumer lobbying groups need grants from the European Commission as a result.
Judging by the resources spent on lobbying efforts, producers are very well aware that the stakes in Brussels are higher than in national Parliaments. Their higher stakes, their low numbers and the homogenous nature of producers form an effective incentive to organise.
The effectiveness of consumer participation at the national level is further reduced or limited due to the fact that data protection legislation is mainly decided in Brussels. A concerted effort on behalf of all consumers at the European level could theoretically be more effective, but the lower perceived stakes and the significantly increased costs of participation in Brussels might make this an unattainable goal for the foreseeable future.
Producers seeking to influence the contents of privacy contracts can effectively achieve their goals in the market, in the national courts or in the European political process. Their advantage is arguably most pronounced in the political process at the EU level, where their stakes are highest. The high costs of participation for consumers in this forum increase the opportunities for legislators to decide against consumers’ interests, increasing the risk of regulatory capture.
Comparative institutional analysis in itself provides no guidance on which institution is best charged with deciding on privacy contracts. The goals a society wishes to achieve are equally important; not every institutional difference is equally relevant to every policy choice. This chapter explores the margins inside which national or European policy choices must remain. Subsequently it broadly categorizes two possible policy objectives and proposes matches between institutions and these objectives.
Both EU law and the European Convention on Human Rights limit the adverse effects of privacy contracts for consumers. They show significant differences, in both their scope and their available enforcement mechanisms.
The Convention requires Member States to respect private and family life.85 This makes safeguarding consumer privacy primarily a matter for the Member States, even if data protection law is mostly EU law and the EU accepts the rights guaranteed in the Convention as general principles of EU law.86 After all, the EU Charter of Fundamental Rights is only binding upon the institutions of the EU. Some issues governing privacy contracts – like the interpretation of bona fides – are beyond the scope of EU legislation.
These limits are not enforced equally. EU law has to be applied ex officio in the courts of all Member States and the Commission can employ enforcement mechanisms to guarantee compliance.89 The ECtHR cannot enforce the convention, since it has no authority to alter decisions by a State. It can only award ‘just ­satisfaction’, usually monetary compensation, if a State allows only partial reparation after a violation.90 Article 8 is stated in broad terms and the ECtHR interprets it on a case-by-case basis. This limits Member States’ abilities to predict whether legal acts are a breach of the Convention, especially in the light of new technological developments like big data.
A wider margin of appreciation is relevant in the case of privacy contracts and big data has large possible benefits. A State is allowed to weigh these benefits against the loss of privacy that these contracts can entail. Societal gains are important, and gains in expensive policy areas, such as healthcare and education, may under certain circumstances outweigh an effective loss of privacy caused by a private contract. A State may consider economic growth, jobs or investments essential for its general welfare. Even private gains may outweigh privacy, if a State counts the right to returns on investments as a property right safeguarded by article 1 of the Protocol to the Convention. All this remains speculative, since the ECtHR until now hasn’t given any verdicts on privacy contracts.
A society might want to choose to protect privacy or to promote societal or economic benefits. The analysis performed in section III indicates that institutional choices show different levels of compatibility with these objectives. In choosing institutions for privacy contracts, it is assumed that consumers have a better chance for strong privacy protection if their participation opportunities are better.
Considering the comparatively unfavourable circumstances in other institutions, the national political process offers consumers the best opportunities for achieving strong privacy protection in privacy contracts.
An important benefit of the national political process lies in the fact that national Parliaments are not subject to the scope limitations of EU institutions. The scope of EU decisions is limited by the principles of conferral, proportionality and subsidiarity.93 EU data protection law therefore cannot capture the complete scope of the right to privacy as protected in article 8 of the Convention. For example, it does not address reasonable expectations of privacy or the interpretation of contracts.
It seems reasonable to expect that the supposedly large economic benefits of the big data revolution94 will arrive more slowly if restrictions on privacy contracts are stronger. Legal restrictions increase compliance costs and the risk of noncompliance.
The EU political process will probably offer the best opportunities for maximizing the economic and societal benefits of big data. The increased scope of the internal market, when compared to the political process at the national levels, will reduce compliance costs and increase legal certainty for producers active in several Member States. This institution also offers the most benefits of participation to producers, improving the odds of the resulting legislation and not hampering their objectives. This however comes at a cost: the influence of consumers is greatly reduced.
Of course, common ground between Member States is not in itself a guarantee for compliance with article 8 ECHR. The fact that voters cannot easily hold legislators and regulators to account creates a significant risk of regulatory capture and special interest legislation. The legitimacy of EU legislation may also be significantly reduced if many consumers consider their opportunities for participation insufficient.
Privacy contracts authorise a deep insight into the personal lives of consumers. Therefore, they require sufficient legitimacy. This article has focused specifically on the participation aspect of the legitimacy requirement (transparency and accountability aspects were excluded). It has examined consumers’ participation options in decision-making processes concerning privacy contracts. Particularly, it has compared the dynamics of participation for consumers and producers in the political process and the market on the national and European levels, and before the national courts, by performing comparative institutional analysis.
Although an important factor, maximizing consumer participation opportunities will not guarantee adequate privacy protection by itself. Choosing between institutions requires both awareness of the strengths and weaknesses of each option and a clear view of the goals that a society wants to achieve. The choice is not an easy one. Optimal privacy protections for consumers may impede important societal or economic benefits, whilst maximizing these benefits may sooner or later trigger positive obligations under article 8 ECHR.
The political process at the national level offers consumers the best opportunities for participation in the decision-making process on privacy contracts. In the market, the national courts and the political processes at the EU level, opportunities for consumer participation are greatly reduced. As a result, decisions from these institutions are more likely the result of capture or minoritarian bias. The legitimacy of such decisions is possibly insufficient.
This tentatively points towards the EU Directive as the better option for regulating privacy contracts, as it leaves Member States the choice of form and methods to implement them.98 Transposing directives into national law will allow Member States to debate those aspects of privacy contracts left open due to the limited scope of EU decisions. This will enable, for example, the setting of standards for reasonable expectations of privacy, reasonable interpretation of contracts and unfair terms, within the limits imposed by EU law and the Convention.
However, the next step in EU data protection legislation will almost certainly be a regulation, directly applicable in all Member States.99 In that case, options for national political debate are limited. On the EU level consumers already have few participation opportunities. Adopting a regulation calls on the members of the European Parliament to honour their duty to their constituents. At the same time, MEP’s large amount of slack gives them an opportunity to decide against consumers’ interests without suffering any consequences.
If national or EU law insufficiently protect consumer privacy, national courts will eventually be called upon to apply article 8 ECHR to privacy contracts. This could take many years. The transaction costs for consumers before the courts are so high and individual stakes are so low, that consumers are unlikely to prevail before the courts against a large producer with high stakes. This result would be undesirable. It could effectively allow for permanent observation of every consumer in a new kind of panopticon, possibly with far-reaching effects on consumers’ personal autonomy. Such a result could very well be within the limits of data protection legislation, but it will almost certainly be a breach of article 8 of the Convention.
The low per capita stakes for consumers will likely continue to impede effective consumer participation. Altering the dynamics of participation in the market or the political process might seem an easy solution, but this requires careful consideration. For example, subsidizing organisation or lobbying efforts may introduce new monitoring costs. Consumer representatives would enjoy an amount of slack similar to members of the European Parliament. It could also distort the stakes for representatives. If subsidies are much higher than the contributions of consumers, the subsidies could effectively become the stakes. Such an arrangement does not necessarily offer more guarantees for effective consumer participation, nor does it necessarily reduce the risk for regulatory capture or special-interest legislation. Innovative new contract types may be a better choice to improve the legitimacy of big data applications. Wauters et al. have already researched a number of possible improvements.100 Other solutions may lie in optimizing transparency and accountability.
It is not yet clear whether big data will call for merely incremental adaptations to data protection law, or rather a fundamental redesign of privacy law. In any case, legal developments in response to big data need to coherently address privacy contracts, non-contractual relations, the reasonable expectation of privacy and the possible effects of datafication on human autonomy – in other words, an integrated framework for consumer privacy in the age of big data. The limits on EU decisions imposed by the principles of conferral, proportionality and subsidiarity may stand in the way of developing such a framework at the EU level.
The law has to keep up with technology to effectively continue safeguarding consumer privacy in the coming age of big data. The pace of technological developments shows no signs of slowing down. The law had better be ready.
1European Parliament and Council Directive 2009/140/EC of 25 November 2009 amending Directives 2002/21/EC on a common regulatory framework for electronic communications networks and services, 2002/19/EC on access to, and interconnection of, electronic communications networks and associated facilities, and 2002/20/EC on the authorisation of electronic communications networks and services,  OJ L 337/37 (Framework Directive); European Parliament and Council Directive 2009/136/EC of 25 November 2009 amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws,  OJ L 337/11 (Rights Directive); and European Parliament and Council Regulation (EC) No 1211/2009 of 25 November 2009 establishing the Body of European Regulators for Electronic Communications (BEREC) and the Office,  OJ L 337/1.
2Board of Management and others, ‘Group Strategy’ (KPN Investor Day, London, 10 May 2011) pt Question 5, from 3:33:00 (statement by Marco Visser) <http://pulse.companywebcast.nl/playerv1_0/default.aspx?id=12193&bb=true&swf=true> accessed 24 December 2014.
3Ralf Bendrath, ‘Global Technology Trends, Transnational Market Forces, and National Regulation: The Case of Internet Traffic Monitoring by Deep Packet Inspection’ (International Studies Association, Tuscon, Arizona 2009) 9–12 <http://citation.allacademic.com/meta/p312750_index.html>. accessed 24 December 2014.
4Paul Ganley and Ben Allgrove, ‘Net Neutrality: A User’s Guide’ (2006) 22 Computer Law & Security Review 454, 457.
6KST II 2010–2011, 24095 nr. 285, p. 8, 28 (Dutch Parliamentary documents).
8BEREC is established by Regulation no. 1211/2009, art 1(1).
9Art 7.4a Telecommunicatiewet, as amended by Act of 10 May 2012, Stb 2012, nr. 235 (Dutch National Journal); KST II 2010–2011, 24095 nr. 285, p. 29 (Parliamentary documents); Handelingen II, 8 June 2011, nr. 90, item 3, p. 90-3-36 (Parliamentary proceedings).
10European Parliament and Council Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,  OJ L 281/31 (Data Protection Directive).
11Lokke Moerel, big data Protection: How to Make the Draft EU Regulation on Data Protection Future Proof. Oratie 14 Februari 2014 (Tilburg University 2014) 9.
12Charles Duhigg, ‘How Companies Learn Your Secrets’ The New York Times (19 February 2012) MM30.
13Paul Zikopoulos and Chris Eaton, Understanding big data: Analytics for Enterprise Class Hadoop and Streaming Data (McGraw-Hill Osborne Media 2011) 5–8; Viktor Mayer-Schönberger and Kenneth Cukier, big data: A Revolution That Will Transform How We Live, Work, and Think (Houghton Mifflin Harcourt 2013) (passim).
14Neil M Richards and Jonathan H King, ‘Three Paradoxes of big data’ (2013) 66 Stanford Law Review Online (passim) and the literature referenced there.
15Eric W Verhelst, Recht Doen Aan Privacyverklaringen: Een Juridische Analyse van Privacyverklaringen Op Internet (Kluwer 2012) chap 3.
16Walter Peissl, ‘Information Privacy in Europe from a TA Perspective’, Data protection in a profiled world (Springer 2010) 251.
17Neil K Komesar, Law’s Limits: The Rule of Law and the Supply and Demand of Rights (Cambridge University Press 2001) 31.
18Yana Breindl, ‘Promoting Openness by “Patching” European Directives: Internet-Based Campaigning during the EU Telecoms Package Reform’ (2011) 8 Journal of Information Technology & Politics 346, 354.
19See n 9 above and Daphne van der Kroft, ‘Persbericht: Bits of Freedom Roept KPN-Abonnees Op Om Aangifte Te Doen Tegen Aftappen’ (Press Release: Bits of Freedom calls on KPN subscribers to file a criminal wiretapping complaint) <https://www.bof.nl/2011/05/12/persbericht-bits-of-freedom-roept-kpn-abonnees-op-om-aangifte-te-doen-tegen-aftappen/> accessed 25 December 2014.
20Similarly: Lucie MCR Guibault and others, Digital Consumers and the Law. Towards a Cohesive European Framework (Kluwer Law International 2012) 144.
21Danielle Keats Citron, ‘Technological Due Process’ (2007) 85 Wash. UL Rev. 1249, 1256–1257. Gutwirth and De Hert have pointed out the similarity between these safeguards and the concept of due process in United States law; Serge Gutwirth and Paul De Hert, ‘Een Theoretische Onderbouw Voor Een Legitiem Strafproces. Reflecties over Procesculturen, de Doelstellingen van de Straf, de Plaats van Het Strafrecht En de Rol van Slachtoffers’’ (Theoretical underpinnings for legitimate criminal procedure. Reflections on process cultures, the aims of punishment, the place of criminal law and the role of victims) (2001) 31 Delikt & delinkwent 1048, nos. 12–13.
22Charter of Fundamental Rights of the European Union,  OJ C 83/02, art 38.
23Data Protection Directive, art 2(d–e).
24Council Directive 93/13/EEC of 5 April 1993 on unfair terms in consumer contracts,  OJ L95/29 (Unfair Terms Directive), art 2b: “any natural person who, in contracts covered by this Directive, is acting for purposes which are outside his trade, business or profession”.
25See DLA Piper, ‘Legal Analysis of a Single Market for the Information Society: New Rules for a New Age?’ (European Union 2009) SMART 2007/0037 chap 4 p. 4 <http://ec.europa.eu/information_society/newsroom/cf/newsletter-item-detail.cfm?item_id=7022> accessed 5 November 2014; Gerrit-Jan Zwenne, Diluted Privacy Law (Leiden University 2013) n 3 <http://papers.ssrn.com/abstract=2488486> accessed 13 November 2014.
26Komesar, Law’s Limits (n 17) 23, 28.
28Michael E Levine and Jennifer L Forrence, ‘Regulatory Capture, Public Interest, and the Public Agenda: Toward a Synthesis’ (1990) 6 Journal of Law, Economics, and Organization 167, 171.
29Ronald H Coase, ‘The Nature of the Firm’ (1937) 4 Economica 386, 390–391.
30‘I’ll let you write the substance… you let me write the procedure, and I’ll screw you every time.’ Regulatory Reform Act: Hearing on H.R. 2327. House Comm. on the Judiciary, 98th Cong. 312 (1983) (statement of Rep. John Dingell).
31Art 13 of the Convention (right to an effective remedy); Case C-213/89 Q. v Secretary of State for Transport, ex parte: Factortame Ltd and others (Factortame I),  ECR I-02433, paras. 21-23 (availability of interim relief as a condition for effectiveness).
32Data Protection Directive, Preamble, nr. 41.
33Neil K Komesar, Imperfect Alternatives: Choosing Institutions in Law, Economics, and Public Policy (University Of Chicago Press 1997).
34Corien Prins, ‘When Personal Data, Behavior and Virtual Identities Become a Commodity: Would a Property Rights Approach ­Matter?’ (2006) 3 SCRIPT-ed 270, 275; Jerome provides numerous examples of monetary value: Joseph W Jerome, ‘Buying and Selling Privacy: big data’s Different Burdens and Benefits’ (2013) 66 Stanford Law Review Online 47.
35Jean-Charles Rochet and Jean Tirole, ‘Platform Competition in Two-Sided Markets’ (2003) 1 Journal of the European Economic Association 990.
36Bruce Schneier, ‘“Stalker Economy” Here to Stay’ CNN (26 November 2013) <http://www.cnn.com/2013/11/20/opinion/schneier-stalker-economy/index.html> accessed 18 March 2014.
37Ronald H Coase, ‘The Problem of Social Cost’ (1960) 3 Journal of Law and Economics 1; Paul Sholtz, ‘Transaction Costs and the Social Cost of Online Privacy’ (2001) 6 First Monday <http://journals.uic.edu/ojs/index.php/fm/article/view/859> accessed 10 October 2014.
39European Parliament and Council Regulation of 12 December 2012 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters (recast),  OJ L 351/1 (Brussels I Regulation).
40World Administrative Telegraph and Telephone Conference and International Telecommunication Union, ‘International Telecommunication Regulations : Final Acts of the World Administrative Telegraph and Telephone Conference, Melbourne, 1988 (WATTC-88).’ (ITU 1989) s 1.5.
42Again, the definition of “consumer” is derived from EU legislation as explained in note 24.
43Rochet and Tirole (n 35); Nick Jue, ‘ING En Het Gebruik van Klantgegevens. Open Brief van ING Aan Haar Klanten’ (ING and the use of customer data. Open letter from ING to her Customers) (17 March 2014) <http://www.ing.nl/nieuws/nieuws_en_­persberichten/2014/03/ing_en_het_gebruik_van_klant_brief.aspx> accessed 19 April 2014.
44Aleecia M McDonald and Lorrie F Cranor, ‘The Cost of Reading Privacy Policies’ (2008) 4 I/S: A Journal of Law and Policy for the Information Society 540; Rainer Böhme and Jens Grossklags, ‘The Security Cost of Cheap User Interaction’, Proceedings of the 2011 workshop on New security paradigms workshop (ACM 2011) s 2.3.2 <http://dl.acm.org/citation.cfm?id=2073284> accessed 27 December 2014.
45Marc Galanter, ‘Why the Haves Come out Ahead: Speculations on the Limits of Legal Change’ (1974) 9 Law & Society Review 95, 98.
47Digital Rights Ireland, ‘We Need Your Help to Keep Working for European Digital Rights in 2014’ (1 January 2014) <http://www.digitalrights.ie/support-us-in-2014/> accessed 26 October 2014; Marie-José Klaver, ‘Bits of Freedom Staakt Strijd Op Web; Oprichter: Digitale Burgerrechtenbeweging Harder Nodig Dan Ooit’ NRC Handelsblad (5 August 2006) 26.
49“Sunk costs are those costs that have to be incurred to enter or be active on a market but that are lost when the market is exited.” European Commission: Commission Notice – Guidelines on vertical restraints, 2000/C 291/01, Official Journal of the European Communities, C 291, 13 October 2000, par. 128.
50Levine and Forrence (n 28) 167-176; Verhelst (n 15).
51Levine and Forrence (n 28) 176.
52Komesar, Law’s Limits (n 17) 60–70.
53European Commission, Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, “Towards a European Horizontal Framework for Collective Redress” (COM/2013/0401 final), s. 1.3.
54Samuel Issacharoff, ‘Group Litigation of Consumer Claims: Lessons from the U.S. Experience’ (1999) 34 Texas International Law Journal 135, 145 and note 45.
55In common law jurisdictions Galanter (n 45) 120; for the United Kingdom, Neil Andrews, ‘Fundamental Principles of Civil ­Procedure: Order Out of Chaos’ in XE Kramer and CH Rhee (eds), Civil Litigation in a Globalising World (T M C Asser Press 2012) 29. In the Netherlands, the ‘lijdelijke rechter’; in Germany, ‘Parteibetrieb’, in France, the ‘juge passive’: Regine Genin-Meric, ‘Droit de la preuve: l’Example Français’ in José Lebre de Freitas (ed), The law of evidence in the European Union = Das Beweisrecht in der Europaischen Union = Le droit de la preuve dans l’Union Europeenne (Kluwer Law International 2004) 140–141; Cornelis H van Rhee, ‘De Ontwikkeling van het Burgerlijk Procesrecht in het Twintigste-Eeuwse Europa: Een Terugblik’ in D Heirbaut, G Martyn and R Opsommer (eds), De Rechtsgeschiedenis Van De Twintigste Eeuw. the Legal History of the Twentieth Century: Handelingen van het contactforum (Peeters Bvba 2006) 1–5.
56Eg Ivo Giesen, ‘Sommige Procespartijen Zijn “More Equal than Others”. De Macht van de Tabaksindustrie En de Nederlandse Rechtspleging’ in Nienke Doornbos, Nick Huls and Wibo van Rossum (eds), Rechtspraak van Buiten. Negenendertig door de ­rechtssociologie geïnspireerde annotaties (Liber Amicorum prof. dr. J.F. Bruinsma).
57‘… dat het privaatrecht […] niet aan “positieve discriminatie” van de zwakkere partij doet (eerder het tegendeel).’ Ibid 21.
58Galanter (n 45) 103; Giesen (n 56).
59Almost certainly applicable to privacy contract cases: art 93 a and c, Rv (Dutch law of civil procedure).
60Case C-618/10 Banco Español de Crédito SA v Joaquín Calderón Camino, ECLI:EU:C:2012:349, para 42.
62See also Rochet and Tirole (n 35), noting that not all markets are equal.
63Actually, a normal distribution: many consumers will have stakes near the mean; very few consumers will have stakes that are much higher or lower.
64World Administrative Telegraph and Telephone Conference and International Telecommunication Union (n 40) art 1.5.
65Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions: A Common European Sales Law to Facilitate Cross-Border Transactions in the Single Market (COM (2011) 636).
66BEUC, ‘Financial information’ <http://www.beuc.org/about-beuc/financial-information> accessed on 29 October 2014. Subsidies for consumer participation are part of a EU programme of 188,8 million Euros over the 2014-2020 period; European Parliament and Council Regulation (EU) No 254/2014 of 26 February 2014 on a multiannual consumer programme for the years 2014-20 and repealing Decision No 1926/2006/EC,  OJ L 84/42, art 3(1)(b).
67The EU economy is larger than that of the US. ‘Europa- The economy’, <http://europa.eu/about-eu/facts-figures/economy/index_en.htm> accessed 1 November 2014.
68Data Protection Directive, art 1(2).
69Linkedin, ‘Privacybeleid’ (in Dutch) <http://nl.linkedin.com/legal/privacy-policy> accessed 1 November 2014; Facebook, ‘Data Policy’ <https://www.facebook.com/policy.php> accessed 1 November 2014.
70Results of the 2014 European Election <http://www.europarl.europa.eu/elections2014-results/en/election-results-2014.html> accessed 2 January 2015.
73Art 294 (8)(b), (10–14) TFEU.
74Marinus PCM van Schendelen, Machiavelli in Brussels: The Art of Lobbying the EU (2nd edn, Amsterdam University Press 2005) 58.
75Levine and Forrence (n 28) 173.
76National members of BEUC may be eligible for subsidies. At least in the Netherlands, these subsidies accounted for much less of the budget (1,2% for 2012). Consumentenbond, 2012 yearly report, p. 44, http://www.consumentenbond.nl/morello-bestanden/pdf-algemeen-2013/Jaarverslag_2012.pdf (accessed on 29 December 2014).
77Commission Decision of 14 September 2009, setting up a European Consumer Consultative Group (2009/705/EC), art 3(1)(a) and annex.
78EDRi – European Digital Rights, ‘Annual Report, January 2013 - December 2013’ (EDRi 2014) 31 <http://edri.org/wp-content/uploads/2014/04/EDRi_Annual_Report_2013.pdf> accessed 2 November 2014.
79April Dembosky, ‘Facebook Spending on Lobbying Soars’ Financial Times (24 January 2013).
80James Fontanella-Khan, ‘Brussels: Astroturfing Takes Root’ Financial Times (26 June 2013).
81van Schendelen (n 74) 50.
82Levine and Forrence (n 28) 179.
83Breindl (n 18) 354; Kimberlee Weatherall, ‘Three Lessons from ACTA and Its Political Aftermath’ (2012) 35 Suffolk Transnational Law Review 575, 595.
84Komesar, Imperfect alternatives (n 33).
85Arts 1 and 8, ECHR.
86Art 1 ECHR; art 6(3), TEU.
87Art 4(3), TEU; see also note 31.
88Unfair Terms Directive; European Parliament and Council Directive 2005/29/EC of 11 May 2005 concerning unfair business-to-consumer commercial practices in the internal market and amending Council Directive 84/450/EEC, European Parliament and Council Directives 97/7/EC, 98/27/EC and 2002/65/EC and European Parliament and Council Regulation (EC) No 2006/2004,  OJ L 149/22 (Unfair Commercial Practices Directive).
89Art 258 TFEU; see also Banco Español de Crédito SA v Joaquín Calderón Camino (n 60).
91European Union and others, Handbook on European Data Protection Law (Publications Office of the European Union 2014) 16 and note 6. See also Odièvre v France App no 42326/98 (ECtHR, 13 February 2003) para 40; Jean-François Akandji-Kombe, Positive Obligations under the European Convention on Human Rights (Directorate General of Human Rights, Council of Europe 2007) 15.
92Powell and Rayner v the United Kingdom App no. 9310/81 (ECtHR, 24 January 1990) para 41; Johnston and others v Ireland App no 9310/81 (ECtHR, 18 December 1986) para 55.
94‘The new oil of the internet’? Moerel (n 11) 20.
95Rasmussen v Denmark App no 8777/79 (ECtHR, 28 november 1984) para 40.
96European Parliament and Council Directive 2006/24/EC of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC,  OJ L 105 (Data Retention Directive), art 4.
97BVerfG 2 March 2010, 1 BvR 256/08 vom 2.3.2010, Absatz-Nr. (1–345); Joined Cases C-293/12 and C-594/12 Digital Rights Ireland v Minister of Communications and Kärntner Landesregierung v Seitlinger and others, ECLI:EU:C:2014:238.
99John Bowman, ‘EU Data Protection Regulation: A Tipping Point Has Been Reached’ <https://privacyassociation.org/news/a/eu-data-protection-regulation-a-tipping-point-has-been-reached/> accessed 8 November 2014.
Michiel Rhoen LLM is an external PhD-candidate at eLaw@Leiden, Leiden law school researching the effects of big data on consumer privacy by means of contracts and torts. This research is conducted in the Research Programme “Securing the Rule of Law in a World of Multilevel Jurisdiction”, Sub-programme 4: “Protection of fundamental rights in an integrated Europe”.

References: CJEU 
 art 1
 art 38
 art 2
 art 2
 art 93
 art 1
 art 3
 art 1
 art 3
 art 6
 art 4