The Place of Personal Data in Human Rights and Personal Rights

Place in Human Rights

Historical Dimension

The European Union data protection policy is based on the right to privacy regulated in Article 8 of the European Convention on Human Rights adopted in 1950. The Council of Europe has regulated the ‘Convention on the Protection of Individuals with regard to Automatic Processing of Personal Data’, taking into account the changes in the field of information technologies, the lack of a clear boundary of private life and the limits of the authority of public authorities. Turkey signed this convention on 28.01.1981, ratified it on 02.05.2016 and it entered into force on 0109.2016. The Convention contains provisions for the protection of the fundamental rights and freedoms of individuals, especially in terms of the right to privacy, especially in matters related to personal data. Data protection refers to a wider area than privacy in one aspect and a special area within the right to privacy in another aspect. While the issue of data protection is related to fundamental rights and freedoms in one aspect, it may sometimes fall outside of privacy and private life.

As a matter of fact, the European Court of Human Rights has decided that the principle of privacy and protection of private life cannot be applied to all personal data. After the 1981 convention, the European Union issued Data Protection Directive 95/46/EC, which protects natural persons in the processing of personal data and regulates the free movement of data, and subsequently issued Directive 97/66/EC on the protection of personal data and private life in the telecommunications sector, and the 1997 directive was amended by Directive 2002/58/EC. The European Parliamentary Council regulated the protection and free movement of personal data within the European Union Institutions by Regulation No. 45/2001. Article 7 of the ‘Declaration of Fundamental Rights of the European Union’ published in 2000 includes the regulation in Article 8 of the European Convention on Human Rights for the protection of private life.

Article 8 of the Declaration is about the protection of personal data. Article 8 on the protection of personal data reads as follows: ‘1. Everyone has the right to request the protection of personal data concerning him or her. 2. Such information shall be used fairly for the purposes specified and on the basis of the consent of the person concerned or other legitimate basis provided for by law. Everyone has the right to access and rectify the information collected about him or her. 3. Compliance with these rules shall be supervised by an independent authority. Here, it is seen that the right to protection of personal data is regulated as a separate right from the right to protection of private life in the European Convention on Human Rights. The right regulated in the 2000 Declaration was included in the 2004 ‘Treaty Establishing a Constitution for Europe’ with a slight amendment.

There were problems during the ratification phase of the Constitution of the European Union and it did not fully enter into force. For this reason, the main articles of the said constitution were incorporated into the Reform Treaty for the European Union. The final version of the Reform Treaty was signed with the participation of the states at the conference held in Lisbon in 2007 (Treaty of Lisbon) and submitted for ratification. The aim is to give effect to the rights enshrined in the Charter of Fundamental Rights of the European Union. The Lisbon Treaty also includes provisions on the protection of personal data in the fight against crime and judicial co-operation between law enforcement and security policies.

The European Union system recognises data protection as a fundamental right. In the historical process, the approaches of the member states of the European Union regarding the protection of personal data have differed from each other. The protection of personal data and privacy do not have a structure that can replace each other and replace each other. The scope, objectives and content of data protection and the right to privacy are different from each other. Protection of personal data protects values that are not at the core of privacy, and in doing so, this right may be interfered with on grounds such as consent, lawfulness, non-discrimination and legitimacy. The approach that privacy and data protection are not interchangeable has not only a positive consequence but also a deeper meaning. While privacy is at the centre of data protection, the idea that data protection regulations will protect privacy is misleading. Data protection regulations serve multiple purposes beyond the traditional conceptualisation of privacy. There are few intimate notions of privacy in data protection. A broad notion of privacy is not of a nature to endorse the principles of data protection for purposes such as purposeful limitation, data quality and security. In the European Union, countries such as Belgium and the Netherlands recognise privacy as the starting point of data protection, while France bases data protection on freedom and Germany on human dignity. [1]

The European Court of Human Rights' Approach to Private Life

Article 8/1 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR) on the Right to Respect for Private and Family Life stipulates that ‘Every person has the right to respect for his private and family life, his home and his correspondence’. In this article, four separate and interconnected rights, which are expressed as the right to respect for private and family life, dwelling and communication, are secured. These rights are not absolute rights and Article 8/2 regulates the limitations and conditions imposed on the exercise of these rights. The duty imposed on the state under this article is not only a negative obligation, i.e. not to arbitrarily interfere, but also a positive obligation, which includes the duty to respect. The positive obligation may require the State to take measures in its relations between individuals. According to the Court, making legal regulations and establishing enforcement mechanisms to protect the rights of the individual and applying special measures when necessary are within the scope of positive obligations.

Conducting an effective investigation when violations occur at the national level is also within the scope of positive obligations. Article 8 imposes three types of obligations on the State. These are non-injunction, protection and investigation. When a claim of violation of a right under Article 8 is brought before the European Court of Human Rights, the court examines whether there is an interference with the right exercised by the individual through an act, act or omission of the public authorities. The Court assesses the claims regarding the state's interference with private life within the scope of negative obligation, while it assesses the claims regarding the protection of private life within the scope of positive obligation. When it is determined that there is an interference with private life, it is examined whether this interference is justified. The first step in the examination of whether the interference is justified is whether the interference is made in accordance with the law. If it is in accordance with the law, it is examined whether the intervention is carried out for legitimate purposes, and in the last step, it is examined whether the intervention is necessary in a democratic society. In case of an intervention that complies with all of these conditions, there is no violation of rights. [2]

According to the Court, the concept of private life is a broad and undefinable concept. It includes the material and moral integrity of the person. The concept of private life sometimes encompasses matters relating to an individual's ‘physical and social identity’. On the other hand, Article 8 also protects aspects of the ‘private sphere’, such as gender identification, name, sexual orientation, sexual life. Article 8 also protects the right to personal development, the right to establish and develop relationships with other people and the outside world. The Court also states that personal autonomy is an important principle in its interpretation. Within the scope of material and moral integrity, States have a positive obligation to ensure effective respect for the individual's material and moral integrity in the face of physical and sexual attacks on the individual's physical and mental integrity, medical interventions, and private attacks affecting honour and reputation.[3]

The European Court of Human Rights' Approach to Personal Data

There is no regulation on personal data in the ECHR. The European Convention on Human Rights has endeavoured to avoid metaphysical approaches. Rights such as the right to liberty, the right to protection of human dignity, the right to autonomy or the right to self-determination do not exist in the Convention. Prioritising these values in a convention for different cultures has been particularly avoided. It may be questioned whether it would be possible to protect and define rights without including such superior values. In the case of Pretty v United Kingdom (2002)), the issue was raised before the European Court of Human Rights as to whether the private life of an incurable patient covered the right to medically assisted dying under Article 8.

In the case, Pretty argued that the decision rejecting her request not to prosecute her husband for assisting her to die was contrary to Articles 2, 3, 8, 9 and 14 of the ECHR, but her claim of a violation of her rights was not accepted. In paragraph 61 of the judgement in this case, concerning personal autonomy, the Court gave a comprehensive and appropriate definition of private life. The Court stated in paragraph 61 that private life includes the mental and physical integrity of the person. According to the Court, sometimes private life includes social life as well as physical life. A person's name, gender, identity, sex life and sexual orientation are protected by Article 8 ECHR. Article 8 of the Convention also protects the right to associate with others and the outside world and to make decisions about oneself. Although the right to self-realisation under Article 8 has not been mentioned in any previous case, the court ruled that the idea of personal autonomy is a principle to be taken into account when determining private life. With this approach of the Court, personal autonomy is included within the scope of the right to privacy under Article 8. In this judgement, the court specifically refrained from discussing Pretty's right to self-determination. [4]

Although the ECHR does not mention modern means of communication in itself, the court has recognised telephone conversations, telephone numbers, computers, video calls, voice recordings, e-mails, etc. within the scope of Article 8. The Court has recognised telephone calls made from the workplace and e-mails sent from the workplace as private life and communication within the scope of Article 8 (Copland vs United Kingdom case). The monitoring of the internet used by the person at the workplace is also considered within the scope of private life. In its cases, the Court of Human Rights has taken private life beyond the walls of the person's home, brought it to the limits of the area where personal relationships can be developed, and brought it to the public sphere outside the local centre of the person.

It also recognises the right to privacy within the scope of company and workplace activities. It has stated that not only the state, but also all legal entities other than the state must comply with the obligations regarding the protection of private life. With this approach, the Court creates positive obligations in addition to negative obligations. Considering these positive obligations, the right to access one's own information must be ensured by the state parties within the scope of Article 8 of the ECHR. Similarly, states parties will be responsible for violations of private life by private law natural or legal persons, companies, newspapers, employers and public authorities in accordance with their positive obligations. In the event of litigation against these actors, the judgements of the ECtHR should be taken into account by national courts.

The ECHR has taken several characteristic detailed approaches to the protection of personal data under Article 8. In its decisions on data protection, the ECtHR has interpreted Article 8 by taking into account new technological developments within the scope of the right to protection of private life and freedom of communication. In interpreting this Article, it has specifically avoided the assessment of whether communication or private life is a fundamental right. The Court has made several findings that data protection is covered by Article 8 (lundvall v Sweden 100473/83, Amann v Switserland, Rotarou v Romania 28341/95). The Court has held that the systematic storage of personal data by public authority may result in a violation of Article 8. The Court also recognised that individuals have the right to control over the recording and use of personal data. The Court has emphasised that individuals have the right to access personal files (Gaskin v. the United Kingdom, Application No. 10454/83) (Antony and Margaret McMichael v. the United Kingdom, Application No. 16424/90) (Guerra v Italy, McGinley & Egan v. the United Kingdom, Applications nos. 21825/93 and 23414/94,) and that transsexuals have the right to correct their identity (Leander v. Sweden, Application No. 9248/81). Moreover, the court emphasised the need for an independent supervisory and oversight authority to ensure the rule of law in the protection of personal data and to prevent abuse of power. (Klass v. Germany, Leander v. Sweden, Rotaru v. Romania,) In the cases of Peck, Perry, PG VD Jh. Romania,) Peck, Perry, PG VD Jh, the court stated that the purpose behind purposeful use in data protection is to prevent unforeseen use. (Peck v. the United Kingdom, Perry v. the United Kingdom) In the Amann and Segerstedt Wiberg cases, the court ruled that state authorities can only collect data related to the suspected situation in case of concrete suspicion.[5]

Since its earliest judgements, the Court of Human Rights has considered the collection and storage of information about an individual's private life in a confidential information register and the disclosure of such information to those concerned within the scope of Article 8 of the Convention. (Leander, 48, Aman, Rotou 43, Sve Marper 67, Khelli 55) According to the Court, the systematic collection and storage of data on certain individuals by security forces (Segerstedt- Wiber and Others 72 Cemalettin Canlı 43), even if these data are collected in the open (Peck 59 PG and J. H 57-59), or even if the information in question relates only to the person's professional or public activities (Rotaru 43-44), or if the information in question relates to the person's distant past (Peck 59 PG and J. H 57-59). H 57-59) or even if this information is only related to the person's professional or public activities (Rotaru 43-44), if the information in question is related to the distant past of the person, it will constitute an interference with the private life of the person (Cemalettin Canlı 43).(Cemalettin Canlı 43) Determining when and where the person is through the GPS system by means of a device to be placed in the person's private vehicle (Uzun-Germany 51-53) constitutes a violation of the right to respect for the private life of the person.

Examples of personal matters relating to private life are as follows. A person's name concerns his or her private and family life, as it is a means of identifying oneself and establishing contact with one's family (Burghartz 24). Genealogical issues are a matter of private life as they relate to a person's identity ( Rasmmussen 33, Kruskovic 20). Issues related to gender changes are a matter of private life (Rees 42, Cossey 38-39), ethnic identity is a matter of private life (S e Marper 66). Sexual intercourse and sexual orientation constitute the most intimate aspect of an individual's private life (Laskey, Jeggard and Brown 36), requesting information about one's own origin and access to information held by public authorities is part of the right to respect for private life (Odievre v. France), the detection of audio, text and video recordings of the individual and his/her activities by public authorities in order to obtain information about the commission of a crime constitutes an interference with the right to respect for private life. Klass and Others - Germany 48,49) [6]

Footnotes

[1] P. De Hert and S. Gutwirth, Data Protection in the Case Law of Strasbourg and Luxemburg: Constitutiona-lisation in Action

[2] Osman DOĞRU Atilla NALBANT European Convention on Human Rights Explanation and Important Decisions, 2013, Ankara Pozitif Matbaa, p.1-2

[3] DOĞRU and NALBANT, p.3

[4] P. De Hert and S. Gutwirth, Data Protection in the Case Law of Strasbourg and Luxemburg: Constitutiona-lisation in Action

[5] P. De Hert and S. Gutwirth, Data Protection in the Case Law of Strasbourg and Luxemburg: Constitutiona-lisation in Action

[6] DOĞRU and NALBANT, pp.25-53