Notes

Italy has some roots connected to ideas on which Europe is based, that makes impossible to private citizens of privacy in a permanent way.

The Origins of the Right to Privacy Privacy is not born in Europe, but in U.S., even if it's taken very seriously in Europe.

1850-1890: The coming of the "sensationalistic press", favoured by the use of new technologies (handheld camera), increased the intrusions in individuals' private life. 1884: Eastman Kodak Company introduced the "snap camera", which allowed to "take candid photographs in public spaces". Between 1850 and 1890, U.S. newspaper circulation grew by 1,000 percent - from 100 papers with 800,000 readers to 900 papers with more than 8 million readers.

Warren & Brandeis, "Right to Privacy", Harvard Law Review, 1890: From a personal experience (Warren) to a new fundamental right The personal experience of S.D. Warren. The Boston gazette was commenting the nightlife of miss. Warren. Therefore the lawyer didn't want his reputation affected by the behavior of the wife. He wrote an article on Harvard Law Review, where he wrote the theorization of privacy. The idea was the "Right to be left alone" and to avoid intrusion in the personal life.

"The existing law affords a principle from which may be invoked to protect the privacy of the individual from invasion either by the too enterprising press, the photographer, or the possessor of any other modern device for rewording or reproducing scenes or sounds"

Technology, such as Cameras at the time, is something that changes the rules of the game. A change in technology requires a change in the ruling system.

Right to Privacy and Data Protection In relation to technology we can do a basic distinction between:

• ** Right to privacy**: right to be let alone is conceived as the freedom from any unauthorized intrusion or interference by public and private bodies into private life. (At the times of Warren, was the "Right to be left alone").
• Right to data protection: based on the concept of personal data, requires that the (authorized) use of the same by private and public bodies is made in accordance with specific legal standards.

Nowadays it's a dynamic concept, since there is the possibility to store thousands and thousands of data. It's no more just a static "Don't be inside my house and my spaces", therefore there is no processing of the data, it's just static. In a dynamic approach there is a permanent control and the data it's not forgotten after the journal is throw away, but it's stocked in the databases.

Privacy Laws in the US Fourth Amendment, US Constitution (1791) "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized". The Supreme Court, one century later, changed the interpretation of this amendment, in order to include a privacy protection perspective.

Privacy in the US "Shadow right, it's hidden behind"

• Griswold vs. Connecticut, 381 U.S. 479 (1965) The Supreme Court found a state law which prohibited the use of contraceptives to be in violation of "right to marital privacy" (it's not an issue of the State whether a family decides to use contraceptives) protected under the 4th Amendment.

Griswold v. Connecticut, the Supreme Court decision that made legal access to birth control the law of the land. The ruling stated that birth control is a matter of privacy, and something to be decided between a woman and her doctor. (It is generally recognized as the predecessor to Roe v. Wade and Lawrence v. Texas). Estelle Griswold, the Executive Director of the Planned Parenthood League of Connecticut, and Dr. C. Lee Buxton had opened a birth control clinic in New Haven in order to test the law in Connecticut which had outlawed birth control, and were subsequently arrested. The case went to the Supreme Court, and it was found that the law violated the 14th amendment,  which states, "no state shall make or enforce any law which shall abridge the privileges or immunities of citizens of the United States; nor shall any State deprive any person of life, liberty, or property, without due process of law...nor deny any person the equal protection of the laws."

• Roe v. Wade, 410 U.S. 113 (1973) The right of a woman to have an abortion is covered by the right to privacy, even though this right must be balanced with the state's interests to protect prenatal life and women's health.

• Lawrence v. Texas, 539 U.S. 558 (2003) Based on the constitutional protection afforded to the right to sexual privacy, the Supreme Court struck down the laws of fourteen states that had imposed criminal penalties for the offense of sodomy.

From the US to Europe Privacy and Data Protection in the European legal order

• While in U.S. the "Free Speech" is unattackable as stated by the First Amendment, in Europe, Privacy is its equivalent, privacy is a real super-right.
• Art. 8 ECHR: «Everyone has the right to respect for his private and family». Right to private life/privacy (right to be let alone).
• Convention of the Council of Europe No. 108/1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data. "Processing of personal data": from the right to privacy to the right to data protection.

Right to Privacy in the ECHR Article 8 "There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."

This article clearly provides a right to be free of unlawful searches, but the Court has given the protection for "private and family life" that this article provides a broad interpretation, taking for instance that prohibition of private consensual homosexual acts violates this article. The protection afforded by Art. 8 ECHR is not without limits. The rights enshrined in paragraph 1 may be interfered with subject to the conditions laid down in paragraph 2. In accordance with this structure of Art.8, the following approach to scrutinizing cases, in which this article may have a bearing, may be taken:

• In a first step, it should be established whether there is an interference with the right to private life, family life, home or correspondence. To this end, it has to be established whether a certain measure, action or omission (see below) falls within the scope of one the interests, which Art.8 para 1 protects, and whether it has some impact on the way in which the rights can be exercised, whether it limits the extend to which the right can be enjoyed. The scope of private life, family life, home and corresponce are dealt with on the parts of this website dealing with the respective rights.
• Then it should be scrutinized whether this interference is justified pursuant to Art.8 para 2 ECHR.

Privacy and Data Protection in the EU

• Data Protection Directive 95/46/EC GDPR That it is the directive adopted in Internet times, during the transition in 1995, dynamic nature.
• E-privacy Directive 2002/58/EC Still in force but...
• Data Retention directive 2006/24/EC Directive 2016/680.

Personal data are defined as "any information relating to an identified or identifiable natural person ("data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity". The notion processing means "any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction".

Treaty on the functioning of the EU (Art. 16) Everyone has the right to the protection of personal data concerning them (Art. 16).

Charter of Fundamental Rights of the EU Respect for private and family life /Art. 7). Everyone has the right to respect for his or her private and family life, home and communications. Protection of personal data (Art. 8).

• Everyone has the right to the protection of personal data concerning him or her.
• Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
• Compliance with these rules shall be subject to control by an independent authority.

From a purely market-oriented perspective:

• Personal data as an asset, with economic value for business purposes, free circulation of data.

To a Human Rights Perspective:

• Protection of personal data, fundamental rights of privacy and data protection.

Privacy and Data Protection in the EU - Data Protection Directive 95/46/EC GDPR Definitions:

• Personal Data, any information relating to an identified or identifiable natural person (Data subject, e.g. Youtuber).
• Processing of Personal Data, any operation performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, storage ...
• Data Controller, the natural or legal person, public authority, agency or any other body which determines the purposes and means of the Processing of Personal Data. (e.g. Youtube).
• Data Processor, a natural or legal person, public authority, agency or any other body which processes Personal Data on behalf of the controller.

Consent, Data Subject's consent. Any freely given, specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed. (e.g. Lombardy tracing mobile phones, temporary measures taken on reducing the privacy of individuals temporarily without their consent).

Principles:

• Transparency, the data subject has the right to be informed when his personal data is being processed. The controller must provide his name and address, the purpose of processing, the recipients of the data and all other information required to ensure the processing is fair. (art. 10 and 11). Data may be processed only under the following circumstances (art. 7):
  • When the data subject has given his consent.
  • When the processing is necessary for the performance of or the entering into a contract.
  • When processing is necessary for compliance with a legal obligation.
  • When processing is necessary in order to protect the vital interests of the data subject.
  • When processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed.
  • When processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject. The data subject has the right to access all data processed about him. The data subject even has the right to demand the rectification, deletion or blocking of data that is incomplete, inaccurate or isn't being processed in compliance with the data protection rules. (art. 12).
• Legitimate Purposes, personal data can only be processed for specified explicit and legitimate purposes and may not be processed further in a way incompatible with those purposes. (art. 6 b)
• Proportionality, personal data may be processed only insofar as it is adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed. The data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified; The data shouldn't be kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use. (art. 6). When sensitive personal data (can be: religious beliefs, political opinions, health, sexual orientation, race, membership of past organisations) are being processed, extra restrictions apply. (art. 8). The data subject may object at any time to the processing of personal data for the purpose of direct marketing. (art. 14). A decision which produces legal effects or significantly affects the data subject may not be based solely on automated processing of data. (art. 15) A form of appeal should be provided when automatic decision -making processes are used.

Data Protection Authorities Transfer to third non-EU Countries Member States shall provide that the transfer to a third country of personal data may take place only if the third country in question ensures an adequate level of protection.