Thread by @gabrielazanfir

@winfriedveil @PrivacyMatters @WieseSvanberg @hartzog It is not me or you who ultimately say #EUDataP is about control or not. We are not talking about an intellectual construct here, but about a fundamental right distinct than privacy, protected at constitutional level in the European Union. A constitutional order which 1/14

@winfriedveil @PrivacyMatters @WieseSvanberg @hartzog is guaranteed by the Court of Justice of the EU, which beautifully laid out in several of its cases what this right is and is not. Look for example at para 48 in Nowak, where the Court explains that data protection principles are “reflected” 2/14

@winfriedveil @PrivacyMatters @WieseSvanberg @hartzog in accountability obligations of the controller & in the rights that are conferred to the person to know about the processing, see the data, to request correction and even to object. Speaking of the right to object, it’s one of clearest manifestations of control in #EUDataP 3/14

@winfriedveil @PrivacyMatters @WieseSvanberg @hartzog since on its ground the data subject can oppose a perfectly lawful processing of personal data. Remarkable. Another manifestation of control that doesn’t actually stem from the rights of the data subject is withdrawal of consent. 4/14

@winfriedveil @PrivacyMatters @WieseSvanberg @hartzog The person can withdraw consent at any time, without any justification. But the rights of the data subject do represent the quintessential #EUDataP “control”. The CJUE pointed this out in Google Spain, at paras 96 & 97 where 5/14

@winfriedveil @PrivacyMatters @WieseSvanberg @hartzog it makes it clear that the data subject can manifest his or her control over what personal data are in the public space about them even if there is absolutely no prejudice caused to them. 6/14

@winfriedveil @PrivacyMatters @WieseSvanberg @hartzog The Court then simply states that the data subject *may request* (aka control) that personal data no longer be made available to the general public “in the light of his fundamental rights under Articles 7 and 8 of the Charter”. 7/14

@winfriedveil @PrivacyMatters @WieseSvanberg @hartzog But the rights of the data subject are only a part of “control”. Another part is the individual cause of action and the right to submit complaints to specialized supervisory authorities. I’m starting to include them in “control” since I moved to the US and I discovered 8/14

@winfriedveil @PrivacyMatters @WieseSvanberg @hartzog I don’t enjoy an individual cause of action for violations of informational privacy and if I don’t feel deceived by a company about their practices I also don’t have any right to complain to an authority (be it not specialized or independent). 9/14

@winfriedveil @PrivacyMatters @WieseSvanberg @hartzog It felt I’m stripped of control and it made me realize that control in #EUDataP is also very much about the individual legal remedies and the right to complain. The CJEU said it in Schrems better than anyone else, though. 10/14

@winfriedveil @PrivacyMatters @WieseSvanberg @hartzog And it linked access to legal remedies to request access to personal data/rectification/erasure to touching the *essence* of a fundamental right protected by the EU Charter. But the CJEU is not alone in defining control as fundamental for protection of personal data. 11/14

@winfriedveil @PrivacyMatters @WieseSvanberg @hartzog The German Constitutional Court was the first champion at that, in the ‘83 Census Decision, establishing 12/14

@winfriedveil @PrivacyMatters @WieseSvanberg @hartzog the “authority of the individual to decide himself, on the basis of the idea of self-determination, when & within what limits information about his private life should be communicated to others” 13/14

@winfriedveil @PrivacyMatters @WieseSvanberg @hartzog Challenging control as being fundamental to data protection means challenging the EU Charter of fundamental rights, EU secondary law, CJEU case-law and history of data protection in Europe, including some constitutional traditions of Member States. Just wanted to clarify that FIN