Europe’s gavel comes down hard on tech

The tech sector’s bête noir in Europe: 28 judges at the European Court of Justice in Luxembourg.

Europe’s highest court is now also its main technology regulator, leading to accusations that it’s overreaching its mandate and incapable of dealing with complex tech issues.

The European Court of Justice will hand down a number of key verdicts in the coming months which could send company stock prices crashing, spark violent protests by taxi drivers and force legislators back to the drawing board.

A decision on whether Uber is a mobile app or a transportation company is expected within weeks, while another ruling expected by the end of the year could upend how Facebook and other websites target their online advertising. The court also will hear from privacy regulators seeking greater powers to pursue tech giants like Apple, Google and Microsoft.

Supporters of the court’s use of its powers — including former judges — say it only acts when asked to do so by uncertain national or European courts, wavering lawmakers and frustrated plaintiffs. The judges are often covering up the indecision, or bad decisions, by lawmakers, they say.

“In security and data protection there is a tendency for legislators to shy away from decisions they don’t want to take or to take decisions they know are not legally sound,” said Sophie in’t Veld, a Dutch liberal member of the European Parliament. “They leave it to the court to repair.”

The tech revolution has laid bare the EU’s divisions and shortcomings. Commission officials have been criticized for shying away from core questions such as how to regulate emerging business models like Uber or how to guarantee online privacy on a fast-changing internet.

Meanwhile, the Council and European Parliament took years to pass key legislation, including the data protection bill and the cybersecurity directive. As the speed of technological change eclipses bureaucratic institutions, more courts and regulators across Europe are turning to the ECJ for guidance.

“The court is filling a gap where legislators haven’t acted,” said one European Commission official, who spoke on condition of anonymity. “The court is not driven by the short-term” like politicians and their staff.

Human rights court

The court’s impact on the tech sector spiked after the 2009 Charter of Fundamental Rights became legally binding across the bloc, with Europe’s top judges taking on the role of guardians of the right to privacy and personal data.

In 2014, the court made its grand entrance into the online privacy debate when it torpedoed a Commission directive on data retention that asked telecoms to store vast amounts of communications data for surveillance purposes. The same year, it said Europeans had the right to force Google to remove links to old information, prompting hundreds of thousands of requests for the “right to be forgotten.”

Then last year, judges tore up an EU-U.S. deal on data transfers, stunning more than 4,000 companies sending information across the Atlantic.

“The European Court of Justice is starting to consider itself as also a human rights court,” said Gerrit Hornung, a professor of law at the University of Kassel in Germany.

Critics say the focus on human rights has blinded the judges to the complexities of technology and the internet.

“The biggest problem is the ECJ doesn’t seem to take into consideration enough what the practical effects are,” said David Hoffman, global privacy officer at tech giant Intel.

The court treats all data as if it were equal despite a great deal of data being useless, warned Per Strömbäck, editor of Netopia, an online forum dedicated to digital policy issues. It has been “dogmatic” when examining legal issues thrown up by the internet — such like hyperlinks or data — and yet wields an “increasing and disproportionate influence on tech policy,” he said.

The European Court of Justice declined POLITICO’s repeated requests for comment. However, former judges were quick to defend it.

“The caseload has been largely driven by the speed and evolution of technology, against a far greater understanding of the importance of data and communications, and of privacy in the digital world,” said Nicholas Forwood, a former judge at the General Court, the EU’s lower court (the ECJ is the higher court).

Aindrias Ó Caoimh sat on the ECJ until last year. During his tenure, the court heard major tech cases like the challenge to the Data Retention Directive and to Facebook’s data transfers to the United States.

“The more you read into a case, the more you realize you are not being asked to deal with technical aspects but with broader principles,” he said.

Reverberations

On the horizon is a rematch over the “privacy shield” data transfer agreement between the EU and the U.S. The pact, signed this summer, will give companies legal cover to send banking and payroll data as well as family photos and other personal information from Europe to America.

The privacy shield is supposed to be stronger than its predecessor, which the ECJ struck down last October, but privacy activists are expected to challenge it, claiming Europeans’ data still don’t have equal protections in the U.S.

In the meantime, Ireland’s data protection authority wants the ECJ to rule on the alternative to privacy shield: so-called model contract clauses used by multinationals to transfer data from Europe to the rest of the world. Striking down the clauses would take 1 percent out of Europe’s GDP, or €143 billion, Facebook claimed during a hearing in Ireland.

Then there is the dust-up over Facebook’s privacy settings. A German court in April asked the ECJ to determine whether national data protection regulators could investigate Facebook, which insisted it only had to answer to authorities in Ireland, where the company has its European headquarters. The judgment could leave Facebook and other internet giants facing an onslaught of probes across Europe.

“Clarity over who is competent [to regulate Facebook] needs to come as soon as possible,” said Philippe De Backer, the Belgian minister in charge of privacy, in June. He said Belgium would back the German court’s request to the ECJ. “Belgium seriously questions Facebook’s privacy policy.”

Facebook declined to comment.

The dispute over who big tech answers to is part of a wider tussle between tech companies — which have sunk roots into low-tax regimes like Ireland, Luxembourg and the Netherlands — and the taxmen in countries where they do business.

The ABCs of the ECJ

It’s easy to see why the ECJ may appear ill-equipped to deal with technology. Its 28 members are drawn from each member nation, following distinguished careers as barristers, judges or professors. They serve for terms of six years with no limit on renewals.

Judges can call expert witnesses, but in practice rarely if ever do. Rulings are adopted by consensus and — in a hangover from the EU’s founding days — exclusively discussed in French.

Although not all judges speak French on arrival, they must learn to say “toile d’araignée mondiale” rather than “world wide web,” and “l’économie collaborative” instead of “the sharing economy.”

That will be key next month when the ECJ is due to rule in the first of several major cases dealing with the sharing economy. Brands like Uber, Airbnb and BlaBlaCar have attracted the ire of taxi drivers and hoteliers. Courts in Belgium, Spain and Germany have asked the ECJ whether government efforts to rein in Uber comply with EU law. The ECJ is expected to rule on the Spanish case first.

Gareth Mead, a spokesperson for Uber, said it is difficult to predict where the court will come down, but a favorable verdict would leave the approach of skeptics like France or Hungary in tatters.

When the gavel comes down on the Uber case, it will either push some of the world’s most successful startups to bend their models toward tradition, or it could force radical changes upon traditional taxi businesses, hotels and many others.