The long arm of EU data protection law: Does the data protection directive apply to processing of personal data of eu citizens by websites worldwide?

International Data Privacy Law

Volumn 1, Issue 1, 2011, Pages 28-46

  Moerel, Lokke ^a,b  

^a De Brauw Blackstone Westbroek   (Netherlands)

^b TILBURG UNIVERSITY   (Netherlands)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 85071000338     PISSN: 20443994     EISSN: 20444001     Source Type: Journal    
DOI: 10.1093/idpl/ipq004     Document Type: Article

References (33)

1. European Commissioner Reding has warned in a speech that the European Commission would not shy away from taking action if behavioural targeting interfered with European citizens' privacy rights, see,www.ec.europa.eu..
2. See for a comprehensive overview of the differences Korff, 'EC Study on Implementation of Data Protection Directive, Comparative Summary of National Laws', Cambridge, September 2002, (Study Contract ETD/2001/ B5-3001/A/49).
3. Article 29 Working Party, 'Working Document on determining the international application of EU data protection law to personal data processing on the Internet by non-EU based web sites' (WP 56, 30 May 2002), at 6.
4. See Lokke Moerel, 'Back to Basics: wanneer is de Wet bescherming Persoonsgegevens van toepassing?', 3/2008 Computerrecht at 81.
5. See Recital 18 of the Data Protection Directive. This is also the position of the Article 29 Working Party, see for instance 'Working Document on non-EU Based Websites' (n 7), at fn 17.
6. The Data Protection Directive makes no reference or distinction based on theh nationality of the data subject. See Ulrich Dammann and Spiros Simitis, EG-Datenschutzrichtlinie (Nomos Verlagsgesellschaft 1997) at 127 -28;
7. Article 29 Working Party, 'Working Document on non-EU Based Websites' (n 7), at 7.
8. See Article 29 Working Party, 'Opinion 1/2008 on data protection issues related to search engines' (WP 148, 4 April 2008), at 10.
9. In the affirmative Blok, 'Privacybescherming in alle staten', 2005/6 Computerrecht, at 299.
10. Proposal for a Council Directive concerning the protection of individuals in relation to the processing of personal data, COM (1990) 314-12, 1990/0287/COD (the 'Original Proposal').
11. Amended proposal for a Council Directive on the protection of individuals with regard to the processing of personal data and on the free movement of such data (92/C 311/04), [1992] OJ C/1992/311/30) (the 'Amended Proposal').
12. See COM (92) 422 final-SYN 287, 15 October 1992, p. 13
13. Case 283/ 81 CILFIT v Ministery of Health [1982] ECR 03415.
14. Case C-64/95 Konservenfabrik Lubella Friedrich Büker GmbH & Co. KG v Hauptzollamt Cottbuss [1996] ECR, I-05105.
15. Case 76/77, Auditeur du travail v Bernard Dufour, SA Creyf's Interim and SA Creyf's Industrial [1977] ECR 02485.
16. Case 283/81 CILFIT v Ministery of Health [1982] ECR 03415, para 20.
17. See Article 29 Working Party, 'Opinion 1/2008 on data protection issues related to search engines' (n 12), at 10.
18. Case 33/78, Somafar SA v Saar-Ferngas AG [1978] ECR 02183.
19. See in detail Foss and Bygrave, 'International Consumer Purchases through the Internet: Jurisdictional Issues pursuant to European Law', 2000 International Journal of Law and Information Technology, volume 8, at 99-138
20. Oren, 'Electronic Agents and the notion of Establishment', at 8, available at,www.eclip.org..
21. Case 139/80, Blanckaert & Willems PVBA v Luise Trost [1981] ECR 00819, para 9.
22. Case 33/78 Somafar SA v Saar-Ferngas AG [1978] ECR 02183.
23. Case 139/80 Blanckaert & Willems PVBA v Luise Trost [1981] ECR 00819.
24. Mankowski, in Ulrich Magnus and Peter Mankowski (eds), Brussels I Regulation (Sellier European Law Publishers 2007) at §§ 279 and 292-5.
25. In particular the French and the Dutch DPAs. See Fonteijn-Bijnsdorp, 'Art. 4 Wbp revisited': enkele opmerkingen inzake de toepasselijkheid van de Wet bescherming persoonsgegevens', 6/2008 Computerrecht at 285-9.
26. According to Kobrin, 'The Trans-Atlantic Data Privacy Dispute, Territorial Jurisdiction and Global Governance', Working Paper Series, The Wharton School (November 2002), at 23
27. Article 29 Working Party, 'Working Document on non-EU Based Websites' (n 7), at 11.
28. Article 29 Working Party, 'Working Document Privacy on the Internet, An integrated approach to on-line Data Protection' (WP 37, 21 November 2000), at 28.
29. Article 29 Working Party, 'Working Document on non-EU websites' (n 7), at 11.
30. Bing, 'Data protection, jurisdiction and the choice of law', Privacy Law and Policy Reporter, [1999] 65, at 7.
31. European Commission, First report on the implementation of the Data Protection Directive (95/46/EC), COM (2003) 265 final.
32. See for criticism what 'targeting' means: Uta Kohl, Jurisdiction and the Internet: a Study of Regulatory Competence over Online Activity (Cambridge University Press 2007) at 76-8; and Schulz (n 83), at 818.
33. See First Report on the Data Protection Directive (n 76), at 17.