Yesterday, in the case of Glawischnig-Piesczek, the Court of Justice ruled that the e-commerce Directive does not preclude Member States from ordering a host provider to remove unlawful information which it stores, as well as identical information of the kind. This is a heavy burden that will fall on online service providers, particularly information or social platforms. The case concerned defamatory information in Facebook targeted against Ms. Glawischnig-Piesczek, an Austrian politician. She successfully challenged in Austrian courts Facebook’s reluctance to remove equivalent contents, until Facebook appealed the decision relying on the e-commerce Directive. This appeal resulted in a preliminary reference to the Luxembourg court, which rendered its judgment yesterday and sided with Ms. Glawischnig-Piesczek.
A major issue underlying the case concerns the territorial scope of the order issued by the Austrian court. The ruling explicitly stated that, in order for the decision to be rendered effective, the order was to apply on a global scale. The Court of Justice was asked, inter alia, to determine whether it is lawful for a national court to grant such scope to a decision that implements EU law.
Yesterday, when the third chamber of the Court of Justice ruled that EU law does not preclude a national court from issuing a removal order with global effects, the outcome came as a surprise to many. The judgment reverberated around the world, mostly as a result of its contrast with last week’s decision in the Google case (analyzed by Alberto Miglio in this blog here).
However, the judgment is not as revolutionary as it might seem, at least when it comes to the issue of extraterritoriality.
First, the judgment should not be subject to a strict comparison with the Google case, because the context and legal issues are substantially different. In Google, the Court faced a question over the scope of the powers of a national data protection authority in administrative proceedings. In the Facebook case the context is one of a civil action and proceedings, in which a private physical person makes use of a civil remedy before a civil Austrian court. In contrast with administrative proceedings, civil actions can be subject to foreign law, enforced in other countries and benefit from private international law agreements that facilitate enforcement of civil or commercial judgments. What the Court was stating in Google is that EU law does not put a data protection authority under a duty to enforce its administrative decisions worldwide. In contrast, in Facebook the Court rules in a civil context in which worldwide enforcement of civil rulings is possible, as long as international agreements on private international law facilitate such enforcement.
Second, the Facebook judgment is quite aware of the limitations of civil enforcement, and it openly states that a national court can order a host provider to remove information worldwide “within the framework of the relevant international law”. As Advocate General Szpunar pointed out in his Opinion in the Facebook case, the effectiveness of the worldwide ruling of the Austrian court will fall upon the network of international agreements of the Member State concerned, a matter that is not covered by the e-commerce Directive. Although the judgment is ambiguous on the issue of applicability of the Directive (a point that the Advocate General bluntly rejected), there is a certain assumption that the Directive is not imposing rights or obligations of private international law on this matter. Therefore, it is up to the Member State and the international agreements that bind it to provide the terms in which global enforcement shall be carried out.
Of course, this is a source of legal uncertainty for the online service provider, which is now exposed to an unclear legal battle in all Member States and possibly many other third countries. A battle of uncertain outcome which will depend on Austria’s position as a party in private international law instruments, but also on the enforcement State’s internal provisions on conflicts of laws. It will be a burdensome ordeal for Facebook, no doubt, but the applicant will not be much better off. Ms. Glawischnig-Piesczek is facing a momentous task, in legal and financial terms, if she intends to have this judgment enforcement worldwide. It might be simpler if she only requests enforcement in some countries, but in that case the worldwide effect of the ruling would be undermined. It’s a tragic dilemma that probably has no happy ending in terms of effectiveness.
To conclude, what the Google and Facebook judgments show us is that rights and e-commerce are still unhappy bedfellows. The Google judgment might seem like a victory of online service providers, but the truth is that the GDPR is becoming the gold standard in data protection throughout the world. Frustration of data protection supporters with last week’s judgment should be taken with a pinch of salt, because reality shows that society (not only in Europe) is gradually shifting in support of the right to be forgotten, rather than freedom of expression. On the other hand, what seems like an invasive aberration of extraterritoriality in the Facebook judgment is actually a rather standard ruling that ends up ultimately relying on private international law. The practical outcome of the Facebook judgment will probably be much more nuanced in practice, despite the parties’ challenges ahead.
The sum of both decisions gives a rather different picture than the one portrayed by the media lately, in which one day Google triumphs and the next day Facebook fails miserably. The practical truth is rather more nuanced, but it is also the realization of the law’s limitations in a global marketplace, no matter how well-intended a court, a legislature or rights promoters may be.