The Development of the European Union Legal System

by Jack Barkstrom - Attorney, CPA

The General Data Protection Regulation (GDPR)

In April 2016 the European Parliament adopted the General Data Protection Regulation (GDPR), which came into force in May 2018. When word began to get out in the U.S., it seemed so terrifying, that there were stories of companies refusing to accept credit cards with a number indicating that they were from somewhere in Europe. Many of the terms and concepts had been around for awhile, but what seemed to add an element of terror was the threat of a fine of possibly 4 percent of worldwide income, even for activities or data processing which took place outside of Europe.(1)

In addition to the 4 percent fine, there was also the requirement that an organization's controller or data controller, had 72 hours to notify the supervisory authority after they "became aware of" a data breach. That prompted a debate about when someone became aware of a data breach. As soon as it happened? As soon as their system was showing indications of suspicious activity? Or only after they had completed an investigation? And when did the 72 hours begin? There was also the question of whether an organization, however small, had to appoint a data controller, and when, and whether a failure to appoint one, was itself a violation.(2)

As if the GDPR wasn't bad enough, it served as a model for legislation in U.S. states. Soon many states decided that they needed to have their own GDPR. If an organization experienced a data breach, failure to notify the state data protection authority was considered a violation of state law, regardless of, or in addition to, violations of European Union law.(3) It prompted similar jurisdictional questions across the US. Could the state of California prosecute a company in Nebraska or Alabama for a cyber breach if just one California resident had bought something in either of those states. The jurisdictional question was not limited to the Internet and computer security. It was an issue in the tax area as well. Did a state have the right to collect sales tax in one state, such as Colorado, for an online purchase by someone buying in Illinois, or any other state, who had not been in Colorado? It was definitely easier to collect taxes if someone was actually physically present in a state when the purchase was made.

Can they do that - Really??

The question of whether a state or country can enact laws which apply outside its territorial boundaries falls under the term, or concept, called extraterritoriality. Under international law, the primary basis of jurisdiction is the "subjective territorial principle" under which a state has jurisdiction to prescribe law with respect to conduct that takes place within its territory. While it is true that a citizen of the European Union, or of any country, will suffer the injury primarily where they live, providing some territorial connection for any activity. However, given the global reach of the Internet, and the use of electronic communications by different countries, it is not clear where the conduct takes place - where the information is stored, where it is processed, or where it ends up?(4)

Solving credit card debt - Maybe bankruptcy would work better.

For those encountering the GDPR for the first time, one of the more intriguing and memorable ideas is the "Right to be Forgotten." At one after-hours event I attended, someone asked whether the Right to be Forgotten meant you could request a credit card company or credit reporting agency to remove your name, credit record, and debt owed. It sounded like a great idea. The answer seemed to be that yes, you could probably use the GDPR to take care of your credit problems. The only problem was that there is nothing in the GDPR, or any of the twenty-six or twenty-seven versions enacted by the EU member states, which contains GDPR language dealing with credit card or debt removal. It might have helped if someone in the room had had a copy of the GDPR - or bothered to read it. In addition, there was the question of whether it would be available to non-EU citizens. Just because the GDPR claimed authority to levy fines on companies and to require action in countries outside the EU, did it specifically say that it had the authority to allow people living in other countries to take action. It's doubtful if anyone at the event was visiting from the EU, although there might have been, so it's a little unclear whether EU law, even the GDPR would apply to most people in the room. What we were trying to do sounded more like a bankruptcy procedure.

What about bankruptcy? No one there thought to bring up the subject of bankruptcy. It was a valid question, since trying to eliminate debt by erasing creditor records is a function of bankruptcy law. Most of the member states, or countries, of the EU have their own bankrupty laws, but before even getting to those, most of the people in the meeting might have checked U.S. bankruptcy laws. Very likely those would apply first. The EU itself has discussed trying to harmonize bankruptcy laws with the thought of a uniform EU directive or regulation, but has not found the political support for taking action.(5)

While the "Right to Be Forgotten" sounds like the ideal solution for credit card debt, it's a little dangerous to write your own version of a law based on news headlines, popular names, what a phrase can suggest about legislative language, or what you wish it would do. What is known as the "Bank Secrecy Act," a US federal statute deals more with disclosures, bank record keeping, and reporting by banks, than trying to keep their activities secret. Passed in 1970, its official title is the "Currency and Foreign Transactions Reporting Act." It was designed to help identify the source, volume, and movement of currency and other monetary instruments transported or transmitted into or out of the United States or deposited in financial institutions. Its real, or main purpose, was to deal with money laundering, tax evasion, and financial crimes by providing a better record of transactions, the individuals involved, and a paper trail.(6)

The "Right to be Forgotten," the "Bank Secrecy Act," and writing your own version of any other named legislation - Nice try but kind of a waste of time. Maybe, maybe not. It may serve as a learning experience in writing legislation. You can also compare your version to the actual law. Maybe your version was better (or worse). As for our attempt to write, re-write, or add a new section of the law - the European Parliament or any of the member state parliaments probably wouldn't need (or want) our help.

The Right to be Forgotten.

Members of the European Parliament were certainly aware of the Right to be Forgotten, or at least the basic concept. At the same time, the term Right to be Forgotten did not actually make it into the final version of the GDPR, which means it was not officially part of the Regulation. To be sure, if you look up the complete text, you will see, at the very top, or start of, Article 17, that the specific term "right to be forgotten" appears. However, depending on which version you are looking at, the top consists of a short paragraph, with the heading Recital 66.(7) Recitals may be helpful to an understanding of what was intended, but they are legally non-binding. They are included more as guides to what legislators were thinking about what the legislation was intended to do. Depending on the version being looked at, recitals may be grouped together, such as 1 to 173, before the official "articles" or provisions of legislation actually begin. Articles are the final versions of the text which actually make it into law. Another clue to deciding whether any paragraph or text is a recital or an article, is that recitals are introduced by the word "whereas". Normally "whereas" will be found at the start of a numbered group of recitals, rather than individually with each recital, unless there is only one recital.(8)

The Right to be Forgotten is said to have come into widespread use with the 2014 decision by the European Court of Justice in "Google Spain," considered a landmark case. If there was a "right," it had to be inferred from the case, since the Court did not actually use the term "right to be forgotten." The case involved a Spanish national resident in Spain whose name kept appearing was more of an observation or comment rather than a holding. Although the data subject might want his name links appearing on web pages removed because '...he wishes it to be 'forgotten' after a certain time...', the Court's phrasing fell short of a "right to be forgotten." When the final version of the GDPR was released, the "right to be forgotten" had been replaced by the in a Google search for a debt action some twelve years earlier. He wanted Google to remove the links. What the Court did say "right to erasure."(9)

The term which made it into Article 17 in the final version, in place of the Right to be Forgotten, is the Right to Erasure. The right is clearly granted by Article 17, although Article 17 does not specify how the right to erasure can be exercised. There have been suggestions about the process, even forms or formats which might be used. GDPR.EU, a website operated by Proton Technologies AG and not an official EU website, has offered a "Right to Erasure Request Form" which a data subject can complete and submit.(10)

Best Legal Advice - Hire someone who lives there

Reading the GDPR is helpful to an understanding of European Union law, but it can be tricky. At the same time, without experience and familiarity with EU law, reading alone may not produce the desired result. There are some questions which come to mind. Is what you are reading up-to-date? Have recent court decisions invalidated some sections? Are there changes, amendments, or replacement laws being debated or enacted? Similar questions could be expected of any unfamiliar field. If anyone is bewildered by the rules for GDPR and EU law, they should try looking at US tax law which has its own complexities. The US Internal Revenue Service (IRS) Code starts with a reading of the Code itself, which must be followed by a reading of the Regulations, as well as a review of any court rulings. It also requires a familiarity with the underlying transactions, including the accounting theory, as well as the specific area covered, such as real estate, property transactions, possibly industry-related rules, or international transactions. That's why most people hire CPAs to do their taxes and why CPAs (who hate taxes) work in auditing - or any alternative which doesn't involve taxes.

Because European Union law is one of those areas which requires familiarity with at least two subject areas - EU law and international law - the best legal advice when confronted with an EU law question is to hire someone who lives and works there. It should be kept in mind that there are twenty-seven member countries, each with their own laws, so finding a legal expert living in all twenty-seven is unlikely. At the same time, there are European firms with experience in more than one country, or which have contacts in different countries. It should also be kept in mind that, apart from legal advice, marketing is a separate field entirely, which may require the expertise of one or more specialists, not only with country knowledge, but also product or industry knowledge. Foods, such as pasta or coffee, may require different packaging and promotion, which will likely be different from products, such as watches, which will, in turn, be different from services, such as tourism-related offerings or computer services.

Finding someone - Just a phone call away

The European market is not for everyone. Like the American or Asian markets, it depends on what the product is, what the competition might be, and whether there is any demand for the product or service. For those thinking about entering the market for the first time, one of the first questions which will come up - but I don't know anyone there. The simple answer is that finding someone is just a phone call away. You can call companies in your own country who do business in Europe and see if they can recommend someone. You can also look them up yourself. There is no obligation to hire the first person or firm contacted. You can also hire them on a limited basis in the form of a report. Tell them what you want to do and pay them to prepare a report, keeping in mind that you don't want to waste money unnecesarily, but also that 'you get what you pay for.' There are limits to the amount of free information you can get, and whether it will prove useful. A report, depending on the effort put into it, can provide an indication of what someone knows, how much time they will devote to you and your product, and the overall quality of their work. It also does not commit you to hiring them on a long-term basis.

The GDPR isn't the only thing to worry about

The GDPR, as terrifying as it seems, may not be the only, or even the biggest threat, to doing business with, or in, the European Union. An example may serve to illustrate just some of the risks. You own a wine and liquor specialty store in Colorado which provides shipping of gift packages. You receive an order from Germany for a single gift package, with a price of around $50. There is a risk, though limited, in keeping any record of the transaction, that it may fall within the rules of GDPR. The reason for the order may be quite innocent. The buyer may simply like the idea of being able to order from an address in the U.S. or may have visited your shop or had a friend or relative visit and liked your service. What happens if the next order is for $500 from the same buyer? What if the next order is for $10,000, and what happens if there are several orders from different countries, such as Belgium, France, or Spain, for over $10,000 each?

When the transactions reach $10,000, the first alarm bell should be the thought of money laundering. Banks or financial institutions must report single-day transactions of more than $10,000, with a Currency Transaction Report (CTR), under the Bank Secrecy Act (BSA), if you deposit the $10,000. In addition, financial institutions may file a Suspicious Activity Report (SAR), if they suspect money laundering. Trying to evade reporting by using multiple deposits of less than $10,000 each, a process known as structuring, does not avoid the reporting requirements imposed on financial institutions. The US Treasury Department has overall responsibility for compliance, while the Financial Crimes Enforcement Network (FinCEN), a bureau of the US Treasury, the delegated administrator of the BSA.(11)

A second problem relating to the $10,000 (or even lesser amounts), is whether you need an export license. Do wine or liquor exports require any special export licenses from the US? What is the minimum volume or amount when you will need a license? Is a single $20 gift basket enough? What about 50 baskets, totaling $1,000 in sales, or 100 baskets, with a value of $2,000? What if the product is watches? What if the product is machine parts, or computer chip components?

A third problem is import requirements in the European Union (or any receiving country). Are there restrictions on alcohol, or special taxes? Are import duties the same across the EU or different for each country? What is the procedure for paying them? Can you handle this on your own or do you need an agent? Do you have to worry about a VAT (value added tax). A VAT tax is an indirect percentage tax levied on products or services at various stages of production and distribution.

What about hiring an individual or business to promote, distribute, or carry your product? Do you have to worry about labor laws if someone is considered an employee, or payroll taxes? There are any number of problems associated with a business arrangement, such as a partnership or contract with an existing company.

Schrems I and II - Background

Privacy and the Right to be forgotten, as well as the GDPR, seemed to receive a boost with what are considered the "landmark" decisions known as Schrems I and Schrems II.(12) Article 25 of Directive 95/46, the 1995 directive, states, as a principle, that personal data which is intended to be processed in a third country, can only be transferred if the third country "ensures an adequate level of protection." In addition, if the third country did not ensure an adequate level of protection, member states were authorized to take whatever steps were necessary to prevent the transfer.(13)

The "adequacy" requirement worried the U.S. Department of Commerce. In 1998 it began negotiations with the EU Commission, to formulate a "safe harbor" agreement which would provide sufficient compliance to allow US businesses to transfer and process data. In July 2000 the agreement was finalized. The EU Parliament did not consider the safeguards adequate, and voted against it by 279 to 259, although the vote was a non-binding resolution. On July 26, 2000, the EU Commission, which had final say, nevertheless approved it, formally issued as Commission Decision 2000/520/EC.(14)

Operationally, the agreement involved a voluntary commitment by US companies, which were required to publicly declare their compliance on a Department of Commerce website. They were only required to apply the Safe Harbor Principles to the personal data of Europeans, although they were free to apply their European standards compliance to data processing involving U.S. citizens. The US compliance was considered by some in the EU as a watered-down version of EU requirements, but initially found acceptance there. Over 5,000 U.S. companies agreed to participate.(15)

In 2012 the Commission and the Commerce Department began consideration of improvements to the Safe Harbor agreement, hoping to create an updated "Safe Harbor 2.0." The adequacy of the first Safe Harbor provisions came into question with the Edward Snowden revelations, beginning in June 2013. The leaked documents revealed widespread collaboration by American companies with the NSA. While the full extent of the cooperation was unknown, the assumption was that the NSA had accessed protected personal information in violation of privacy norms and the EU Privacy Principles.(16)

Some two years after the Snowden revelations, in 2015, the European Court of Justice would find that the 2000 European Commission decision approving the Safe Harbor Agreement was invalid - the Schrems I decision. In the context of the General Data Protection Regulation (GDPR), it may be helpful to understand where this fits on the timeline of legislation. The GDPR would be adopted on April 27, 2016, and would go into effect on May 25, 2018. At the time of the 2015 decision, the GDPR was still under discussion and had not been finalized.(17)

The Schrems I decision was issued on October 6, 2015. Officially it could be cited as CJEU (Grand Chamber), Case C-362/14, Judgment of 6 October 2015, Maximillian Schrems v. Data Protection Commissioner.(18) Max Schrems is an Austrian national who was residing in Austria, although his complaint involved Facebook Ireland, a subsidiary of the U.S. Facebook Inc. and was directed at the Data Protection Commissioner of Ireland. Max Schrems had been a user of the Facebook social network ('Facebook') since 2008. Some or all of the personal data of Facebook Ireland's European Union users ended up in servers belonging to Facebook, Inc. located in the United States, where it would undergo processing. Mr. Schrems objected to the transfer of his personal data to the United States and so, on June 25, 2013, he made a complaint to the Irish Data Protection Commissioner, arguing that the Commissioner had the power to prohibit Facebook Ireland from transferring his data to the United States. Mr. Schrems complaint came shortly after the Edward Snowden revelations, (almost simultaneously in real terms), which also came out in June 2013. Mr. Schrems referenced the Snowden revelations, particularly the activities of U.S. National Security Agency ('the NSA') within the broader context of the U.S. intelligence services. The law and practice in force in the U.S., in light of the revelations about the extent of the surveillance activities, were not sufficient to ensure protection of the personal data held in the U.S.(19)

Mr. Schrems complaint was in response to a ruling by the Commissioner against him. There was, the Commissioner determined, no evidence that Mr. Schrems personal data had been accessed. The Commissioner decided that the European Commission Decision 2000/520, which had found the Safe Harbor Agreement adequate, was controlling.(20)

Schrems I

The European Court of Justice would not come out with the Schrems I decision until October 2015, over two years after the Irish High Court Data Protection Commissioner ruling. The Court invalidated Decision 2000/520,the basis of the Safe Harbor Agreement, finding that it failed to provide an 'adequate level of protection' of fundamental rights relating to the privacy and protection of personal data. The decision came out on October 6, 2015, officially published as CJEU (Grand Chamber), Case C-362/14, Judgment of 6 October 2015, Maximillian Schrems v. Data Protection Commissioner. The final version of the General Data Protection Regulation (GDPR) would not be formally adopted until April 27, 2016.(21)

On its surface, the Schrems I decision seemed a clear-cut victory for EU privacy principles. If nothing else it suggested a strong commitment to individual rights while giving the the soon-to-be released GDPR an aura of moral legitimacy beyond merely a letter-of-the law interpretation. At the same time the Court of Justice decision was almost arbitrary, more swayed by emotion rather than legal analysis.

The Schrems I decision dealt with the 1995 directive (Directive 95/46/EC), not the GDPR. At the same time, both laws contained similar, although not identical, provisions carving out an exemption from, or exception to, privacy rights when it came to national security, criminal investigations, and the conduct of police and intelligence services. In very simplistic terms, both cases involved only two issues: 1) the boundaries of an individual's privacy rights and 2) the limits, if any, on an intelligence service's or police intelligence unit's ability to conduct surveillance activities.

Article 25(6) of the 1995 directive, the basis for the Commission's approval of the original Safe Harbor Agreement required a finding by the Commission that, before data could be transferred to a third party, that the third party provided an adequate level of protection for the "private lives and basic freedoms and rights of individuals." The Court decided that the Commission had been wrong in its Decision 2000/520. The Commission had decided that US national security objectives did not require the US to place any limits on its activities.(22)

The Commission, in its 2000 decision, had argued that 'national security, public interest, or law enforcement requirements' had primacy over privacy rights, where there was a conflict. Article 13 of the 1995 Directive provided that Member States could enact safeguard measures when it came to '1.(a) national security; (b) defence; (c) public security; (d) the prevention, investigation, detection and prosecution of criminal offences...'(23)

The Court of Justice in the 2015 (Schrems I) decision discussed the Commission's reliance on Article 13 and also summarized Article 13, but largely dismissed it, even as it invalidated the Commission's Decision 2000/520 and the Safe Harbor Agreement.(24) Instead it based its decision on Articles 7 and 8, and 25(6) of the 2000 Charter of Fundamental Rights. Article 7 reads: 'Everyone has the right to respect for his or her private and family life, home and communications.' Article 8, which focuses on personal data and data processing, reads: '1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 3. Compliance with these rules shall be subject to control by an independent authority.' Article 25(6) allows data transfers to a third country, only if that country ensures an 'adequate level of protection' when processing data, for the protection of 'private lives and basic freedoms and rights of individuals.'(25)

The Charter of Fundamental Rights (CFR) or the European Charter of Fundamental Rights, originally was a proclamation of the Presidents of the European Commission, the Council of the European Union, and the European Parliament issued at the Nice summit meeting of the European Council in December 2000. It was only a proclamation or proposal at the time, since it was not formally adopted until the Treaty of Lisbon in 2007. It became legally binding on the member states when the Lisbon Treaty came into force in December 2009. Under the Lisbon Treaty, it was officially Article 6 of the Treaty of European Union (TEU).(26)

The Charter of Fundamental Rights should not be confused with the European Convention on Human Rights (ECHR), adopted by the Council of Europe in 1950, or the Charter of Fundamental Social Rights of Workers, the Social Charter, adopted in 1989. The Council of Europe, while made up of most of the countries of the European Union, is not an EU body.(27)

At the time of the Schrems I decision (October 2015), the Safe Harbor Agreement had been in place for some fifteen years, seemingly having 'stood the test of time.' With EU approval and 5,457 U.S. countries entering into it, it was also a popular agreement. Nevertheless, there were discussions about improvements, with the expectation that any revisions would only be minor. That was the expectation, until the June 2013 Snowden revelations began making headlines. They would certainly ignite outrage and public discussion, although for different reasons. On one side, there was outrage that US intelligence secrets had been disclosed. Edward Snowden had committed an act of treason. He needed to be prosecuted and sent to jail. On the other side, he was considered a hero. There was outrage that the intelligence net had spread far beyond spies and now collected information on everyone.(28)

The European Court of Justice in Schrems I focused on the US' failure to provide an 'adequate level of protection' of fundamental rights and freedoms. That the US National Security Agency (NSA), as a spy agency, was involved in covert intelligence gathering, would not have surprised, or even shocked, the Court. Nor would the intelligence gathering on US soil, however extensive, come as a surprise. That would have been assumed, almost condoned. What may have antagonized the justices on the Court was the spying which took place in Europe. The cell phone of German chancellor Angela Merkel had been targeted. In 2009, the NSA had spied on G20 leaders attending the London summit. Other reports revealed a major listening operation run out of the US embassy in Berlin, as well as US military bases throughout Germany. There were also reports that similar activities had been carried out in France. Reports in Le Monde indicated that NSA activities had been carried out with the cooperation of French intelligence services. In one sense, the cooperation of intelligence services, even to the extent of internal surveillance could be seen as a necessity. Eavesdropping on a German chancellor was a little outside normal expectations, as would spying on the G20 summit leaders, said to have been done with the help of the British GCHQ, the UK's equivalent of the NSA.(29)

The Court of Justice could state as its rationale for Schrems I the failure to provide adequate safeguards for privacy concerns, when it came to data processing outside the European Union. Article 13 of Directive 95/46/EC (the 1995 Directive) provides an exemption for restrictions based on '1.(a) national security; (b) defence; (c) public security,' which served as the basis for Decision 2000/520. The Court did discuss the issue in its ruling, although it rejected it in its decision. The Court of Justice is within its rights to interpret EU law as it sees fit. However it might be argued that the decision was intended more as a political statement about the EU's commitment to privacy. In contrast to the United States the European has principles when it comes to the privacy of individuals. At its most extreme, it could be seen as an attempt to punish US companies for involvement in the European Union.(30)

The General Data Protection Regulation (GDPR), adopted on April 27, 2016, became effective on May 25, 2018. It contains language creating an exception to privacy protection rules when it comes to public security, defence, State Security, and criminal investigations, language which is similar to that found in the 1995 directive. However, by the terms of Article 2 of the GDPR, such matters have been removed from the GDPR and placed under a separate special regime, commonly known as the Law Enforcement Directive (LED) under Directive 2016/680. Transferring responsibility from the GDPR and placing it under a different directive may have limited the scope of the GDPR. It did not do away with the question of how conflicts between state security issues and privacy matters are to be resolved. It was further confused when read in conjunction with Article 4(2) of the Treaty on European Union (TEU). Article 4(2) required the European Union to respect "essential state functions, including...maintaining law and order and safeguarding national security." "national security" remained "...the sole responsibility of each Member State."(31)

One other directive relating to the security versus privacy question further muddied the waters, or added fuel to the fire. From its title, the e-Privacy Directive, Directive 2002/58/EC, adopted in 2002, suggested a definitive answer in favor of privacy. Yet, it also contained a provision which allowed for surveillance and spying if national security, defence, public security, or crime prevention were involved. Article 15.1 of the e-Privacy Directive allowed member states to restrict privacy rights when it came to matters of national security, defence, public security, and criminal investigations. The Court of Justice would attempt another reconciliation (or refinement), in March of 2021 when it would discuss Article 15.1 in the context of privacy.(32)

Schrems II

In 2020 the Court of Justice would revisit the data processing and privacy protection issues raised by its 'Safe Harbor' decision when it had to look at its replacement, the 'Privacy Shield' agreement. On a timeline, the Schrems I decision came out on October 6, 2015. Max Schrems resurrected his challenge almost immediately with a reformulated complaint lodged on December 1, 2015. His central claim was that U.S. law required data transferred to the U.S. to be available to U.S. authorities, such as the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI). The European Commission sought to replace the invalidated 'Safe Harbor' agreement with what would be called the 'Privacy Shield Decision' - Decision 2016/1250, issued the following year. In what became known as Schrems II, which was released on July 16, 2020, the Court found the 'Privacy Shield' agreement also inadequate and invalidated it. Following this setback the U.S. came up with a new agreement, along with with a new name, the 'Data Privacy Framework.' This agreement survived, receiving an adequacy decision by the European Commission on July 17, 2023.(33)

The Schrems II decision did little to resolve the national security/privacy question. The Court looked at Article 2 of the GDPR - the Law Enforcement Directive - which assigns data processing activities related to national security or criminal activities to another law. In other words, the Law Enforcment Directive, and not the GDPR, was intended to have jurisdiction over those matters. The Court nevertheless decided that, since the data was being transferred between two economic operators for commercial purposes, it was still covered by the GDPR. The stated justification was that, so long as the initial transfer was for commercial purposes, what happened later, even governmental access for national security purposes, was not relevant. But, wasn't that the very issue which Max Schrems had raised in his reformulated complaint? His claim was that United States law required Facebook Inc. to make the data transferred to the U.S. available to United States authorities. The initial data transfer by Facebook seemed to be for the commercial purposes which the Court now approved of.(34)

Almost as puzzling, was the part of the Schrems II Court decision approving Standard Contractual Clauses (SCC), which were contracts allowing private parties to transfer data to third countries. Since, according to the Court, they were contracts between private parties and governments were not parties to the contracts, the governments, as represented by their supervisory authorities, were not bound by the contracts. What was going on here? The basis for Schrems I seems to have been that a contract between private parties - Facebook and the user - did not provide adequate protection from government involvement. Contract law was not sufficient to protect individual rights. In Schrems II, contract law rules now governed data transfers. Contracts, so long as they took the form of Standard Contractual Clauses, were binding only on the contracting parties and not third parties, like government bodies, who had not been party to the contract. The "standard data protection clauses" included in those SCCs should be sufficient. Schrems I found contract rules inadequate protection. Schrems II now found them controlling - privacy protection would have to take a back seat. The Court acknowledged that there might be situations where Standard Contractual Clauses were not sufficient to provide protection for personal data against government involvement. In such situations, the Court reasoned, there might have to be supplemental restrictions - but that was something which could be done, or decided, at some future time.(35)

The reasoning behind the two Court of Justice rulings seems confusing, even contradictory, on its face. At the same time, Schrems II did increase privacy protections by reinforcing the power of the European Data Protection Board (EDPB). Article 64(2), together with Article 65(1)(c), of the GDPR, provided the authority to determine the adequacy of data protection measures.(36) The temptation is to read Schrems II narrowly from an American perspective as an attempt to limit American options. There is criticism of U.S. surveillance law and practices, since there is an extensive discussion of the inadequacy of US protections. On the other hand, it could be that the real target audience was not the U.S. intelligence community or American businesses, but that of the European Union and its member states. The member states needed to improve their own practices. Schrems II could be seen as an attempt to strengthen due process measures within the European Community, if not immediately, then in the future.

As the Schrems I and II decisions illustrate, trying to reconcile issues of privacy protection with national security requirements can involve lengthy discussions and difficult legal interpretations. If the Court of Justice took extreme care to explain why the GDPR covered data processing, it may have to do with other GDPR processing categories providing clear-cut answers and simpler legal analysis. Far easier to include a category summarized in one word, than to spend two pages trying to justify an answer. If nothing else, the GDPR categories were easier to understand. The GDPR rules for data processing of personal data fall into three categories: 1) Principles of processing - seven in total (six general plus an enforcement principle); 2) Legal grounds for processing - there are six listed; and 3) Special categories of data, containing ten exceptions where processing is allowed.(37)

Seven Principles

The 'Principles relating to processing of personal data' (GDPR Article 5) may sound like general platitudes, but actually contain some concrete rules of conduct rather than generalities. Article 5 provides 1. Personal data shall be: a. processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency'); b. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes ('purpose limitation'); c. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimization'); d. accurate and, where necessary, kept up to date ('accuracy'); e. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ('storage limitation'); f. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures ('integrity and confidentiality').(38)

The seventh, and last, principle - accountability - seems to have special significance since it has its own section within Article 5. Paragraph 2 states that 'The controller shall be responsible for, and be able to demonstrate compliance with paragraph 1 ('accountability'). The controller is essentially the individual with overall responsibility for processing personal data. One interpretation of Paragraph 2, compliance coupled with the ability to demonstrate compliance, is that failure to comply with the compliance requirement(s) may trigger the administrative sanctions - fines up to EUR 20,000,000 or 4% of worldwide annual turnover. Administrative sanctions are found in Articles 83(5) and 58(2).(39)

Six Legal Grounds for Processing

The overriding basis for processing personal data is a legal basis. It is essential, under Article 6, that every processing of personal data have a 'legal basis.' Article 6(1) of the GDPR provides, as a starting point, that 'Processing shall be lawful only if and to the extent that at least one of the following [legal grounds] applies:' Article 6(1) then lists the six grounds for legally processing personal data: a. consent has been given by the data subject; b. performance of a contract to which the data subject is a party; c. when the processing is necessary for compliance with a legal obligation to which the controller is subject; d. processing is necessary to protect the vital interests of the data subject or another person; e. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; f. processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party.(40)

Consent (Article 6(1)a) is the most easily understood and, for that reason, perhaps the most famous of the GDPR requirements. Article 11 of the GDPR provides a very concise definition: '('consent') of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement of by clear affirmative action, signifies agreement to the processing of personal data...' It has also proved to be one of the most contentious, partly because, with computer technology, consent can be assumed, or not, from the click of a mouse. Other than the user, there are few witnesses to testify. Did the user click because they agreed to the processing terms or simply because they click automatically on everything? Another issue is which party is responsible, the user or the organization, which can be tricky when a minor has access to a computer.(41)

The second ground, performance of a contract (Article 6(1)b), is somewhat basic contract law. It requires a valid contract to which the data subject is a party. The third requirement is that the 'processing is necessary for the performance...' of the contract. If someone orders something online, their delivery address and credit card details are necessary. If the merchant collects other data, such as preferences for shoe or clothing styles or vacation locations, which may be required to complete an order, is that information necessary for performance of the contract?(42)

The third legal ground is compliance with a legal obligation (Article 6(1)c). It applies to both public and private sector controllers. It would apply to banks or financial institutions, in situations requiring compliance with anti-money laundering legislation which involves the verification of customer information. Another example relates to employer obligations to report salary data to social security and tax authorities. Governmental agencies may also be required to maintain records and share information with other agencies.(43)

The fourth legal ground, Protection of Vital Interests (Article 6(1)d) might be called a 'medical emergencies' exception. Vital interests of an individual include those involving health, physical integrity, or the life of a data subject or another person. In cases where a person has lost consciousness and needs medical treatment but cannot give consent then data related to that person's medical history may be allowed. It also may have broader application when public health authorities may need to use individual health data to prevent the spread of disease in an epidemic.(44)

The fifth legal ground, Performance of a Public Interest Task or Exercise of Official Authority (Article 6(1)e), seems to overlap both the fourth legal ground, which covers medical emergencies or public health issues and the third legal ground, compliance with a legal obligation. However, it does provide addtional grounds, such as when city administrators must make decisions involving city planning, zoning, or permit approvals. Another example would be local law enforcement use to protect public safety.(45)

The sixth legal ground, Legitimate Interests (Article 6(1)f), offers seemingly contradictory guidance, in relation to acceptable use allowed. On the one hand, it recognizes processing for direct marketing (as well as fraud prevention purposes) as a 'legitimate interest' of a controller or a third party, where the collection of personal information is allowed. Customer preferences may help a direct marketer to reduce marketing activities to goods or services the customer is interested in while avoiding unwanted promotions. On the other hand it places some restrictions on what data is collected. What is known as a 'balancing test' is used, which, depending on the situation, requires the controller to balance its legitimate interests against the rights and interests of the data subjects.(46)

Ten Exceptions for Special Categories of Data

The GDPR has established a separate category of personal data where data processing is prohibited. It has then listed eleven exceptions, ten exceptions under Article 9 plus one under Article 10. Some of the exceptions duplicate the legal grounds for processing listed under Article 6, although some are different. (There are also exceptions, where processing is allowed, under Article 17.) The special categories are: 1) personal data revealing racial or ethnic origin; 2) personal data revealing political opinions; 3) personal data revealing religious or philosophical beliefs; 4) personal data revealing trade union membership; 5) genetic data; 6) biometric data, when processed for the purpose of uniquely identifying a person; 7) data concerning health; 7) data concerning a natural person's sex life or sexual orientation.(47)

The ten special category exceptions are:
1) Explicit Consent by the Data Subject (Article 9(2)a);
2) Processing necessary to carry out obligations in the field of Employment, Social Security, and Social Protection Law (Article 9(2)b);
3) Processing necessary to to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent (Article 9(2)c);
4) Processing is carried out by a Foundation, Association or any other Not-for-Profit Body with a Political, Philosophical, Religious or Trade Union Aim in the Course of its Legitimate Activities (Article 9(2)d);
5) Processing relates to personal data that have manefestly made public by the the data subject (Article 9(2)e);
6) Processing is necessary for the establishment, exercise or defence of legal claims or for courts acting in their judicial capacity (Article 9(2)f);
7) Processing is necessary for reasons of substantial public interest (Article 9(2)g);
8) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systema and services (Article 9(2)h);
9) Processing is necessary for reasons of public interest in the area of public health (Article 9(2)i);
10) Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (Article 9(2)j);

11) Processing of personal data relating to criminal convictions and offenses or related security measures (Article 10)
There are two restrictions:
- Processing is allowed only if it is conducted under the control of official authority; or
- when the processing is authorized by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.

It should be noted that language allowing for processing '...for the purposes of the prevention, investigation, detection or prosecution of criminal offenses...including the safeguarding against and the prevention of threats to public security...' was left out of Article 10. That language is used by Directive 2016/680, the Law Enforcement Directive.(48)

Simple and Understandable categories versus complex legal analysis

There is something to be said for legal rules which take the form of simple commands - like the Ten Commandments. The six categories of data processing allowed under Article 6 of the GDPR and the eleven categories allowed under Articles 9 and 10 seem overly structured, regulatory, and 'by the book' set of rules. They do have one advantage. They avoid in a sense, the difficulties of explaining legal rulings which, by their nature, involve complexities of legal analysis.

The Concept of Privacy in the Computer Age

Privacy concepts run the gamut of meanings. At the top end, with connotations of a mythical, even sacred meaning, they are given an elevated status. At the bottom end they fall to the level of nothing more than being free from irritating intrusions on our private space - about the level of a nuissance. Short of turning off your computer, the concept of privacy seems more a question of convenience versus aggravation, rather than life-threatening or serious disruptions. When we want to purchase something, it's convenient to be able order on-line, even to have pop-ups provide suggestions about selections available. At least that seems great, until we get suggestions about everything, even in areas we weren't looking at. Searching for shoes turns into suggestions for winter clothes or luxury cars or vacation spots.

The European Union Legal Structure - TEU, TFEU, TEC

By way of background, or fundamentals, there are three treaty terms which will be encountered at some point: 1) Treaty on European Union (TEU); 2) Treaty on the Functioning of the European Union (TFEU); and 3) Treaty Establishing the European Community (TEC). The treaty terms, by themselves, seem simple to understand, except for the EU practice of retroactively renaming treaties every so often. The Treaty on European Union (TEU) was the official name of the treaty, which did not come into use, until 2009, when the Treaty of Lisbon was adopted. It began as one of the treaties of Rome, back in 1957. So, in 2009, the Treaty of Rome, became the Treaty on European Union. At the same time, the European Union is considered to have been established in 1993. In general, the TEU created the structure of the EU institutions, such as the European Commission, the European Parliament, and the Court of Justice, as well as the procedural formalities related to their duties. In order to distinguish between the versions, the Treaty on European Union (TEU) prior to the Lisbon Treaty, is referred to as "old TEU," while the TEU which emerged after Lisbon is known as "new TEU."(49)

The Treaty on the Functioning of the European Union (TFEU), also officially named with the 2009 Treaty of Lisbon, had originally been the European Economic Community or European Community (EC) Treaty. Like the Treaty on European Union, it was part of the Treaty of Rome of 1957. The 2009 Lisbon treaty also retroactively renamed the European Community and named it the European Union (EU). In contrast to the TEU, the TFEU deals more with the relationship between individuals and the EU, such as the goals and purposes of legislation. Not quite a bill of rights, it serves to set out the rights of individual citizens in a variety of areas and how legislation complies with and serves those purposes. Workers are considered to have certain fundamental rights and environmental laws are designed to protect citizens.(50) If the TFEU provides EU citizens with rights, in most cases, it does not provide them with an individual cause of action - i.e., they cannot bring a law suit to enforce their rights.

The Treaty Establishing the European Community (TEC), was one of the treaties established by the treaties of Rome in 1957. (The other organization was the European Atomic Energy Community, established by a separate treaty signed in Rome at the same time.) The TEC had formerly been known as the Treaty establishing the European Economic Community (EEC), which had, as its predecessor, the European Coal and Steel Community (ECSC), formed in 1951, made up of the Six European states (Belgium, France, the Federal Republic of Germany, Italy, Luxembourg, and the Netherlands.) (The European Coal and Steel Community (ECSC) continued to exist as a separate body until 2002, when it was disbanded.) The European Economic Community (EEC) was the official title of the organization established by the 1957 Treaty of Rome. The administrative netework of the European Economic Community (EEC) was merged into what became known as the European Communities or European Community (EC) in July 1967. The European Communities or European Community were somewhat interchangable terms, although the abreviation EEC remained in common usage to describe the Communities. The term European Community was replaced by (or renamed) the European Union by the Treaty of Lisbon in 2009 and in its final form, it became the Treaty on the Functioning of the European Union (TFEU).(51)

Extraterritoriality - Who makes the laws for other countries?

It might be helpful to pose an international law question in terms of traffic laws. Can Germany impose a speed limit of 60 miles per hour on drivers of the US state of Iowa? In a reverse situation, could the state of Illinois pass a law providing that the speed limit for drivers in France on rural roads be 65 miles an hour? The question and answer may seem rediculous when it comes to traffic laws. How could they think they could do that? Jurisdiction over driving and the reach of traffic regulations seems a far cry from laws aimed at protecting privacy and restricting access to or use of personal data. At the same time, there are two major sections of the General Data Protection Regulation (GDPR), which touch on those issues.

The first involves the assertion that the GDPR has territorial jurisdiction over data processing activities which take place outside the European Union. In furtherance of that claim, the GDPR imposes twin requirements on organizations, mandating the establishment of specific positions within an organization, as part of a structure to deal with data control, together with the establishment of procedures to be followed in the event of a breach. The second is the assertion that the European Union has the power to impose fines based on worldwide revenue (annual turnover), not just revenue earned within the European Union.(52)

Extraterritoriality, by way of background, is a concept in international law that essentially limits legislative powers of a state to activities which take place within its territory. It starts with the principle known as the "subjective territorial principle." .... Under international law, the primary basis of jurisdiction is the "subjective territorial principle," under which "a state has jurisdiction to prescribe law with respect to...conduct that, wholly or in substantial part, takes place within its territory." Restatement (Third) of the Foreign Relations Law of the United States Section 402(1)(a) (1987). (53)

The subjective territorial principle may be the primary basis of extraterritoriality of jurisdiction. International law recognizes five other principles of jurisdiction which allow a state to reach conduct outside its territory: (1) the objective territorial principle; (2) the protective principle; (3) the nationality principle; (4) the passive personality principle; and (5) the universality principle.Restatement (Third) of the Foreign Relations Law of the United States Section 402(2) (1987).(54)

The objective territorial principle provides that a state has jurisdiction to prescribe law with respect to "conduct outside its territory that has or is intended to have substantial effect within its territory" Restatement Section 402(1)(c). The protective principle provides that a state has jurisdiction to prescribe law with respect to "certain conduct outside its territory by persons not its nationals that is directed against the security of the state or against a limited class of other state interests." Restatement Section 402(3). The nationality principle provides that a state has jurisdiction to prescribe law with respect to "the activities, interests, status, or relations of its nationals outside as well as within its territory" Restatement Section 402(2). The passive personality principle provides that a state "may apply law - particularly criminal law - to an act committed outside its territory by a person not its national where the victim of the act was its national." Restatement Section 402, cmt. g. The provides that "[a] state has jurisdiction to define and prescribe punishment for certain offenses recognized by the community of nations as of universal concern, such as piracy, slave trade, attacks on or hijacking of aircraft, genocide, war crimes, and perhaps certain acts of terrorism, regardless of the locus of their occurrence." Restatement404.(55)

In most cases, data transfers and processing outside a country would not be considered acts of terrorism, so they would not fall under the universality principle. Similarly, the protective principle would likely not apply, since the protective principle, on the surface, looks to deal more with national or state security matters. The passive personality principle focuses on criminal conduct and so, would not be a category which would apply to data processing.

The nationality principle would seem to support the jurisdictional claim that a state or country can enact laws for the protection of its nationals both within its territory and outside its territory. The problem with this argument is that principles of law are only principles, or summaries of how laws have traditionally been interpreted, and not actual treaties or statutes, which have been enacted by legislative bodies. An example of this is in the tax area. While China and the United States have major political differences, there actually is a tax treaty between China and the US, which deals with the treatment of certain tax benefits. It does require nearly identical tax laws and systems, but within the area of taxation, it provides specific rules and treatments. Principles, in contrast, are not a substitute for the specific language of an enacted law. As a practical matter, principles are more often used to support or justify an argument within a judicial decision.

Extraterritoriality - Who decides corporate structure, titles and actions?

There are really two jurisdictional questions posed by the General Data Protection Regulation (GDPR). The first relates to the general issue of whether the EU has jurisdiction over data transfers and processing outside of the EU. The second relates to jurisdiction over the internal decisions and structure of organizations outside the EU. Related to, or a part of, this question are a number of requirements involving discovery and notifications of security breaches, who was to be notified, along with timeline requirements.

The GDPR, as part of its definitional section, contains the terms "controller," "processor," "data subject," and "supervisory authority." The controller (data controller) is the individual "...natural or legal person, public authority, agency or other body which...determines the purposes and means of the processing of personal data..." (GDPR, Article 4 7.) "Processor [data processor] means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller." (GDPR, Article 4 8.) Data subject is not included in the definitions section, although it is referred to in the context of personal data. Personal data means any information relating to an identified or identifiable natural person ("data subject"); "an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factores specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person..." (GDPR, Article 4 1.) Supervisory authority "means an independent public authority which is established by a Member State..." (GDPR, Article 4, 21.)(56)

The GDPR, within the structure or responsibilities section, expands on the definitions of controller, processor, and supervisory authority, and, in addition, provides more detailed instructions about their duties. The controller has responsibility for implementing organizational measures which comply with GDPR regulations. (GDPR, Art. 24) The controller and processor are under a duty to cooperate with the supervisory authority. (GDPR, Art. 31) They are also required to designate a data protection officer in certain cases. The GDPR is a little ambiguous about the data protection officer position, since it suggests they are to serve more in an advisory role - they are "to provide advice where requested" and they are to "cooperate with the supervisory authority." (GDPR, Art. 37, 38, 39) In the event of a data breach the controller has 72 hours to notify the supervisory authority. There is some allowance within the 72 hour requirement for delays, since it includes language such as "without undue delay" and "where feasible" and "having become aware of it," as well as an exception "...unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons." (GDPR, Art. 33) The question of when a controller becomes aware of a breach, as well as the question of whether a breach is unlikely to pose a risk involve judgement calls. As a practical matter companies and systems are now under constant attack and intrusion detection systems can sometimes give false alarms, or provide alerts about increased activity. Does this mean there has been a breach? Even if there has been a breach, does every breach pose the same risk? That may depend on the intent and activity of the attacker. Some attackers may simply be testing a system looking for vulnerabilities, while others may be looking to steal data. Even if they gain access to the system, they may not have accessed to sensitive data areas.(57)

It should be noted that, while many organizations in the U.S. were terrified of violating the GDPR breach notification requirements, they should have already been familiar with similar requirements in U.S. Law. The Health Information Technology for Economic and Clinical Health (HITECH) Act was passed in 2009. It contained the first federal data breach notification requirement. The state of California had passed the first, in 2002. HIPAA requires notification of individuals affected by the breach "without unreasonable delay" and not later than 60 days after discovery of the breach. Since it mainly applied to hospitals or the health care industry, perhaps it was easy to overlook or dismiss as irrelevant to other segments of the economy. Familiarity, as they say, breeds contempt, (or complacency). Reports of hospital or health organization breaches may have made the headlines, along with fines, but why worry about something that didn't apply to me.

Organizational positions or titles, such as President, Treasurer, Chief Executive Officer (CEO), Chief Operating Officer (COO), are more a matter of tradition than a legal requirement. Depending on the size of the organization, they may be established, or not. Their duties can overlap or be combined, in some organizations, or be quite distinct. Generally, businesses are required by state or governmental laws, to designate an individual to act as their agent, at least insofar as receiving legal notices. They also must provide an address. The GDPR seems to be mandating the creation of specific job titles and positions within an organization, with the requirement of appointing a controller, processor, and data protection officer and assigning them specific responsibilities. (GDPR Art. 24, 37, 39) It then urges them to cooperate. Are these legal requirements or just suggestions? Is the EU clearly stating what constitutes a violation of law or is it just trying to micromanage organizational affairs? A little confusing, to say the least.(58)

The GDPR, once the privacy community in the US made the general legal community aware of its existence, created a kind of panic. Not wanting to be left behind, many states began enacting their own versions of the GDPR, with some adopting identical definitions and breach notification requirements. As a practical matter, it might be asked which has priority? Does the EU and the GDPR have first shot if a visitor to the US from Belgium claims injury under the GDPR, and can they bring the claim in a Belgian court? Or, does a Colorado law dealing with a breach take precedence, requiring the injured individual to sue in Colorado? Or, can they bring a suit under both? Does a form of double jeapardy, the criminal law term which prevents a second trial, once a defendant is either convicted or acquitted, apply in this case, preventing a second claim? In that case, would claimants be forced to chose whether a claim be brought in the EU or in the US?

Complying with GDPR requirements, once at the top of the list of Cyber Security legal concerns, now seems to have moved down the list of priorities. The GDPR may have inspired states to pass security and breach notification laws, creating an international competition to see who would be considered at the forefront. Following this, US federal agencies took notice - and wanted to get into the act. Not wanting to be left behind, they began drafting new regulations, or enforcing old ones. The Federal Trade Commission (FTC), concerned with consumer protection, the Department of Health and Human Services (HHS), with oversight of hospital and healthcare services, and the Treasury Department, with responsibility for enforcement of the Bank Secrecy Act, among others, found reasons to increase security requirements. There seemed to be no industry sector which could not be reached. When cyber attacks were making daily headlines, the urgency of compliance with GDPR legal notification requirements suddenly seemed further down the list.

Extraterritoriality - administrative fines on worldwide income

The headline-grabbing GDPR assertion that it could impose fines based on either 2 percent or 4 percent of worldwide income (turnover) made people sit up and take notice. (GDPR Art. 83) It was less clear on the mechanism for determining worldwide income involved. Did it need access to an organization's books to determine worlwide income? If it claimed jurisdiction over an organization's data processing activities, could it compel an organization to turn over its books? Did it have to take into account various tax laws? Was an organization entitled to reduce its reported income through the use of credits? Finally, could the EU require an audit and, as a practical matter, did it have the staff to conduct a worldwide audit even on one company? There are other ways to estimate worldwide income based on similar industries, but would an organization be able to challenge that process as not providing due process?(59)

While the GDPR has made demands about the control of data, in a sense, on the technical side, it has been less clear about the rules governing the legal side, such as the appeals process, legal protections, and location. Has the EU established any kind of special court to decide data protection cases? Where does a hearing or trial take place? Does it have the authority to compel testimony or to seize evidence, such as organization records or even computers?On the other hand, the GDPR might provide opportunities for the EU tourism industry. Countries or cities could offer GDPR tours, such as travel package to see where the Treaty of Rome was signed, or attending a meeting of the European Parliament. Perhaps Max Schrems might provide a lecture in Vienna, on the GDPR, along with a visit to the Vienna opera.

Extraterritoriality - A foregone conclusion?

Because there is an inherent conflict between the jurisdictional claims of the GDPR and those of the US, it might be assumed that any decision is likely to be determined on the basis of location. Claims brought in the EU will be decided in favor of the EU, while claims brought in the US will be decided against the EU. That is not always the case. A 1995 case brought in Texas found that German privacy law was controlling over Texas' rules, when it came to discovery (rules relating to evidence which must be produced prior to trial in a court proceding). The case of Volkswagen, A.G. v. Valdez, 909 S.w. 2d 900 (Tex. 1995) involved a products liability case brought against Volkswagen of America and its German parent company, Volkswagen A.G. (VWAG). The Texas plaintiffs sought production of VWAG's current corporate telephone book in order to identify individuals who might have relevant information concerning defects in the automobile's door latches. The book contained the names and phone numbers of more than 20,000 employees, as well as the private home numbers of individuals in management positions. The German Federal Data Protection Act prohibited the dissemination of private information without the consent of the individuals. The Texas trial court ordered the production of the phone book.(60)

The Texas appeals court reversed the trial court, relying in part on the Restatement (Third) of Foreign Relations Law,§ 442(1)(c) (1987) which suggests a balancing of interests test between the interests of the domestic court or agency against those of the foreign sovereign. It was also found that there were alternative means of finding the information, including the identification of a witness involved in the design of the Volkswagen model. German privacy laws, at least insofar as discovery requirements were concerned, took precedence over the Texas discovery rules.(61)

• 1) General Data Protection Regulation from EUR-Lex https://eur-lex.europa.eu/legal-content/EN/TXT, 75, accessed June 10, 2024; see also David Zetoony, The EU GDPR General Data Protection Regulation Answers to the Most Frequently Asked Questions, 10, 145, 306 (Chicago, Illinois: American Bar Association, 2018).
• 2) General Data Protection Regulation from EUR-Lex https://eur-lex.europa.eu/legal-content/EN/TXT, 75, accessed June 10, 2024; see also Zetoony, The EU GDPR General Data Protection Regulation, 195, 256.
• 3) Charlotte A. Tschider, International Cybersecurity and Privacy Law in Practice, 281, 389-392 (The Netherlands: Kluwer Law International BV, 2018) see also Daniel J. Solove and Paul M. Schwartz, Information Privacy Law, 40, 970-973, Seventh Edition, (New York: Walters Kluwer, 2021).
• 4) Tschider, International Cybersecurity and Privacy Law in Practice, 390-392; see also Solove, Information Privacy Law, 1260-1262; see also Stephen Dycus, Arthur L. Berney, William C. Banks, Peter Raven-Hansen and Stephen I. Vladeck, National Security Law, 249, 240-252, Sixth Edition, (New York: Wolters Kluwer, 2016).
• 5)Issam Hallak, BRIEFING EU Legislation in Progress Harmonising certain aspects of insolvency law in the EU, EPRS|European Parliamentary Research Service (European Parliament, 2023) EP Parliament website: www.europarl.europa.eu/thinktank, accessed February 7, 2025.
• 6)FFIEC - Federal Financial Institutions Examination Council, Bank Secrecy Act/Anti-Money Laundering Examination Manual, 3, (2014 Edition).
• 7) Zetoony, The EU GDPR General Data Protection Regulation, 188, 243; see also Recital 66 - Right to be Forgotten - General Data Protection Regulation (GDPR) at https://gdpr-info.eu/recitals/no-66/, accessed January 27, 2025.
• 8) Jasper Krommendijk and Frederik Zuiderveen Borgesius, EU Law Analysis: How to read EU legislation, 4; at https://eulawanalysis.blogspot.com/p/how-to-read-eu-legislation.html, accessed January 27, 2025; see also Recital (EU)|Practical Law, at https://uk.practicallaw.thomsonreuters.com/w-009-6368, accessed February 3, 2025; see also Maarten den Heijer, Teun van Os van den Abeelan, and Antanina Maslyka On the Use and Misuse of Recitals in European Law, at https://papers.ssm.com/sol3/papers.cfm?abstract_id=3445372, accessed February 3, 2025.
• 9) Solove, Information Privacy Law, 1230, 1227-1236, 1247; see also Dycus, National Security Law, 401-404, 441-444; see also Jos Dumortier, Pieter Gryffroy, Ruben Roex, and Yung Shin Van Der Sype, European Privacy and Data Protection Law, 294-298 (The Netherlands: Kluwer Law International BV, 2022); see also CJEU, Case C-131/12, Judgment of 13 May 2014, Google Spain, ECLI:EU:C:2014:317, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62012CJ0131.
• 10) Ben Wolford, Editor in Chief, GDPR EU, Everything you need to know about the "Right to be forgotten", GDPR.EU (Proton AG, 2022).
• 11) FFIEC Federal Financial Institutions Examination Council, Bank Secrecy Act/Anti-Money Laundering Examination Manual", 1-5, 68-81 (2014 Edition).
• 12) Solove, Information Privacy Law, 1265-1292.; see also Dumortier, European Privacy and Data Protection Law, 67-68.
• 13) Directive 95/46 (Official Journal L281, 23/11/1995 P. 0031-0050) from EUR-Lex - 31995L0046 - EN from EUR-Lex https://eur-lex.europa.eu/LexUriServ.do?uri=CELEX:31995L0046:en:HTML, 10-11, accessed February 17, 2025.
• 14) Solove, Information Privacy Law, 1266.; see also Dumortier, European Privacy and Data Protection Law, 67.
• 15) Solove, Information Privacy Law, 1266-1267.
• 16) Solove, Information Privacy Law, 1267.
• 17) Solove, Information Privacy Law, 1267; see also Zetoony, The EU GDPR General Data Protection Regulation, 161-315; see also Dumortier, European Privacy and Data Protection Law, 67.
• 18) Solove, Information Privacy Law, 1267; see also Dumortier, European Privacy and Data Protection Law, 67-68.
• 19) Solove, Information Privacy Law, 1267-1268.
• 20) Solove, Information Privacy Law, 1268.
• 21) Solove, Information Privacy Law, 1267; see also Dumortier, European Privacy and Data Protection Law, 68; see also Zetoony, The EU GDPR General Data Protection Regulation, 314.
• 22) Solove, Information Privacy Law, 1270-1271.
• 23) Directive 95/46 (Official Journal L281, 23/11/1995 P. 0031-0050 ) from EUR-Lex - 31995L0046 - EN from EUR-Lex https://eur-lex.europa.eu/LexUriServ.do?uri=CELEX:31995L0046:en:HTML, 8, accessed February 17, 2025.
• 24) Solove, Information Privacy Law, 1270-1272.
• 25) Solove, Information Privacy Law, 1269, 1271-1272, 1216-1217.; see also Dumortier, European Privacy and Data Protection Law, 62-63; see also Toni Haastrup, Lee McGowan and David Phinnemore, A Dictionary of the European Union 62, 10th ed., (London and New York: Routledge, 2021); see also William McGeveran, Privacy and Data Protection Law, 506, (USA: University Casebook Series William McGeveran, 2016)
• 26) Solove, Information Privacy Law, 1216; see also Dumortier, European Privacy and Data Protection Law, 62; see also Haastrup, A Dictionary of the European Union 52-53; see also Paul Craig and Gráinne de Búrca, EU LAW Text, Cases, and Materials, 16, 427-428, Seventh Edition, (Oxford: Oxford University Press, 2020)
• 27) Haastrup, A Dictionary of the European Union 52-53, 97-99, 199-200.
• 28) Solove, Information Privacy Law, 1267, 484-486; see also Dumortier, European Privacy and Data Protection Law, 67-68.
• 29) Solove, Information Privacy Law, 1270, 484-486.
• 30) Solove, Information Privacy Law, 1270-1272.
• 31) Solove, Information Privacy Law, 1284; see also Dumortier, European Privacy and Data Protection Law, 111-112, 260; see also Haastrup, A Dictionary of the European Union 52-53; see also Zetoony, The EU GDPR General Data Protection Regulation, 224.
• 32) Solove, Information Privacy Law, 1221; see also Dumortier, European Privacy and Data Protection Law, 68, 102.
• 33) Solove, Information Privacy Law, 1283-1291; see also Dumortier, European Privacy and Data Protection Law, 68.
• 34) Solove, Information Privacy Law, 1284.
• 35) Solove, Information Privacy Law, 1287.
• 36) Solove, Information Privacy Law, 1288, 1289, 1291.
• 37) Dumortier, European Privacy and Data Protection Law, 10-12, 164-170, 191-246, 246-248; see also Zetoony, The EU GDPR General Data Protection Regulation, 25, 230, 231, 233-235.
• 38) Dumortier, European Privacy and Data Protection Law, 164-154; see also Zetoony, The EU GDPR General Data Protection Regulation, 230.
• 39) Dumortier, European Privacy and Data Protection Law, 164-154; see also Zetoony, The EU GDPR General Data Protection Regulation, 230, 284-286, 305-307.
• 40) Dumortier, European Privacy and Data Protection Law, 191-229; see also Zetoony, The EU GDPR General Data Protection Regulation, 231-232.
• 41) Dumortier, European Privacy and Data Protection Law, 192-213; see also Zetoony, The EU GDPR General Data Protection Regulation, 227.
• 42) Dumortier, European Privacy and Data Protection Law, 214-215; see also Zetoony, The EU GDPR General Data Protection Regulation, 231.
• 43) Dumortier, European Privacy and Data Protection Law, 219-220; see also Zetoony, The EU GDPR General Data Protection Regulation, 231.
• 44) Dumortier, European Privacy and Data Protection Law, 223-224; see also Zetoony, The EU GDPR General Data Protection Regulation, 231.
• 45) Dumortier, European Privacy and Data Protection Law, 224-228; see also Zetoony, The EU GDPR General Data Protection Regulation, 231.
• 46) Dumortier, European Privacy and Data Protection Law, 229-246; see also Zetoony, The EU GDPR General Data Protection Regulation, 231.
• 47) Dumortier, European Privacy and Data Protection Law, 246-247, 299; see also Zetoony, The EU GDPR General Data Protection Regulation, 233-234.
• 48) Dumortier, European Privacy and Data Protection Law, 12, 246-260; see also Zetoony, The EU GDPR General Data Protection Regulation, 233-234.
• 49) Haastrup, A Dictionary of the European Union, 466-467.
• 50) Haastrup, A Dictionary of the European Union, 466-467; see also Craig, EU LAW Text, Cases, and Materials, 21.
• 51) Haastrup, A Dictionary of the European Union, 191, 208, 424,466-467; see also Craig, EU LAW Text, Cases, and Materials, 21; see also James D. Dinnage and Jean-Luc Laffineur, The Constitutional Law of the European Union, 82-83, Third Edition, (New Providence, NJ: Matthew Bender & Company, Inc., 2012); see also Giuliano Amato, Enzo Moavero-Milanesi, Gianfranco Pasquino, Lucrezia Reichlin, eds., The History of the European Union Constructing Utopia, 92, (Oxford, UK: Hart Publishing, 2019); see also David Phinnemore, The Treaty of Lisbon Origins and Negotiation, ix, 9, 96, 111, (New York: Palgrave McMillan, 2013)
• 52) Zetoony, The EU GDPR General Data Protection Regulation, 1-4, 225-229, 306.
• 53) Stephen Dycus, Arthur L. Berney, William C. Banks, Peter Raven-Hansen, and Stephen I. Vladeck, National Security Law, 249-250, 1084, 1086, (New York: Wolters Kluwer, 2016).
• 54) Dycus, National Security Law, 249-250, 1086.
• 55) Dycus, National Security Law, 249-250, 1086.
• 56) Zetoony, The EU GDPR , 225-229.
• 57) Zetoony, The EU GDPR , 249-255.
• 58) Zetoony, The EU GDPR , 249-262.
• 59) Zetoony, The EU GDPR , 249-262.
• 60) Solove, Information Privacy Law, 1259-1260.
• 61) Solove, Information Privacy Law, 1259-1260.