Data protection law has emerged as an important bulwark against online privacy intrusions, and yet its status within privacy law remains awkward. Its starting point of protecting ‘personal’ rather than ‘private’ information puts it at odds with privacy more generally. Indeed, in its very design, data protection law caters for the protection of public personal information, or personal information which has attained a degree of publicness through disclosure. Building on James Whitman's comparative privacy study, this article argues that data protection law is not the odd bedfellow of privacy law properly so called but may be understood as a manifestation of the Continental European culture of privacy. Its distinctiveness does not lie in its apparent technicality but in its robust openness to privacy in public—an idea that is alien to the Anglo-American culture of privacy. Whilst these two cultures of privacy have long ‘met’ in different jurisdictions, this article locates their enduring influence and antagonism within three contemporary privacy regimes. By taking the right to be forgotten, as an archetypal privacy-in-public right, in the testing context of spent criminal convictions, the article gauges the comparative openness to such claims, first, of the Court of Justice of the European Union as the authoritative voice on General Data Protection Regulation normativity; secondly, of the US judiciary as committed to the First and Fourth Amendment; and, thirdly, of the European Court of Human Rights on Article 8 of the European Convention on Human Rights and its fused Anglo-American and Continental European privacy jurisprudence. It is the latter jurisprudence in particular that highlights the tensions arising from trying to marry the two privacy traditions, or merge data protection and ‘privacy’ law. Yet, these tensions also offer insights and opportunities.

Morality bears on what we should forget. Some aspects of our identity are meant to be forgotten and there is a distinctive harm that accompanies the permanence of some content about us, content that prompts a duty to forget. To make the case that forgetting is an integral part of our moral duties to others, the paper proceeds as follows. In §1, I make the case that forgetting is morally evaluable and I survey three kinds of forgetting: no-trace forgetting, archival forgetting, and siloing. In §2, I turn to how we practice these forms of forgetting in our everyday lives and the goods these practices facilitate by drawing on examples ranging from the expunging of juvenile arrest records to the right to privacy. In §3, I turn to how my account can help us both recognize and address a heretofore neglected source of harm caused by technology and big data. In §4, I end by addressing the concern that we lack control over forgetting and thus can't be required to forget. I argue this challenge can be answered, but there's a harder challenge that can't. Forgetting is under threat. To address this challenge and preserve forgetting, we must change the world.

The binding legal force that the Charter acquired with the Treaty of Lisbon has led some national constitutional courts to adopt an entirely new approach to EU fundamental rights. Most notably, the Austrian Constitutional Court, the Italian Constitutional Court, and the German Federal Constitutional Court have explicitly made the Charter a yardstick of constitutional review. This article compares and contrasts the approaches of these three courts to the Charter. It shows that the strategies of the Austrian and German Constitutional Courts have many characteristics in common, including that national constitutional rights are treated as a primary source and the Charter as a mere secondary benchmark in the majority of cases. The most distinctive feature of the Italian Constitutional Court's strategy is that it mainly aims to prevent ordinary courts from circumventing constitutionality refences by directly applying the Charter. The article concludes by arguing that it has many advantages when national constitutional courts adopt the Charter as a yardstick of constitutional review. It is for the constitutional courts and the CJEU to ensure that these benefits are not outweighed by some serious drawbacks of constitutional review in light of the Charter.

In Google LLC v. Commission nationale de l'informatique et des libertés (CNIL), the Court of Justice of the European Union (CJEU or Court) held that the EU law only requires valid “right to be forgotten” de-referencing requests to be carried out by a search engine operator on search engine versions accessible in EU member states, as opposed to all versions of its search engine worldwide. While the ruling has been perceived as a “win” for Google and other interveners, such as Microsoft and the Wikimedia Foundation, who argued against worldwide de-referencing, the Court also made clear that that while the EU law does not currently require worldwide de-referencing, “it also does not prohibit such a practice” (para. 72). As a result, the CJEU found that an order by a national supervisory or judicial authority of an EU member state requiring worldwide de-referencing in accordance with its own national data protection laws would not be inconsistent with EU law where the data subject's right to privacy is adequately balanced against the right to freedom of information. By leaving the door to extraterritorial de-referencing wide open, the CJEU continues to pursue its post-Snowden hard-line stance on data privacy in a manner that is likely to transform the data privacy landscape.

The First Senate of the German Federal Constitutional Court (FCC) has recently introduced the express promise that where EU fundamental rights take precedence over German fundamental rights, the Court itself could directly review, on the basis of EU fundamental rights, the application of EU law by German authorities. There are, however, differences between the Basic Law as the relevant standard of review and other standards of review that are dangerous to ignore. The constitutional status of the FCC’s jurisdiction depends crucially on whether the Court relies on the constitution or on EU fundamental rights. If the constitutional status of the novel jurisdiction covered any binding-effect, and that is a big if, the FCC still would not safeguard the unity and coherence of Union law. Leaving aside the fact that the First Senate is confined to reversing and remanding (unable to enforce anything directly), no beneficial effect on legal certainty grows apparent. Any binding-effect of the novel jurisdiction only provides for consistency without finality. And to venture further into the question: Even if anyone welcomed this novel kind of consistency without finality (virtually “provisional consistency”), this oddish consistency would still be a localized consistency, i.e. in German courts only.

The Right to Be Forgotten II crystallizes one lesson from Europe’s rights revolution: persons should be able to call on some kind of right to protect their important interests whenever those interests are threatened under the law. Which rights instrument should be deployed, and by what court, become secondary concerns. The decision doubtless involves some self-aggrandizement by the German Federal Constitutional Court (GFCC), which asserts for itself a new role in protecting European fundamental rights, but it is no criticism of the Right to Be Forgotten II to say that it advances the GFCC’s role in European governance, so long as the decision also makes sense in the context of the European and German law. I argue that it does, for a specific reason. The Right to Be Forgotten II represents a sensible approach to managing the complex pluralism of the legal environment in which Germany and other EU member states find themselves.

The ruling of the German Federal Constitutional Court in the Right to be forgotten II case is an example of constitutional pluralism in action. It demonstrates how a pluralist-minded court can elevate itself from and above the constitutional confines of its own legal order. By integrating the material standards of another legal order in its own review of constitutionality a national constitutional court contributes directly to the strengthening of the fundamental rights of individuals against the national authorities within the overall system of European legal order.

This article explores the challenges of the extraterritorial application of the right to be forgotten and, more broadly, of EU data protection law in light of the recent case law of the ECJ. The paper explains that there are good arguments for the EU to apply its high data protection standards outside its borders, but that such an extraterritorial application faces challenges, as it may clash with duties of international comity, legal diversity, or contrasting rulings delivered by courts in other jurisdictions. As the article points out from a comparative perspective, the protection of privacy in the digital age increasingly exposes a tension between efforts by legal systems to impose their high standards of data protection outside their borders – a dynamic which could be regarded as ‘imperialist’ – and claims by other legal systems to assert their own power over data – a dynamic which one could name ‘sovereigntist’. As the article suggests, navigating between the Scylla of imperialism and the Charybdis of sovereigntism will not be an easy task. In this context, greater convergence in the data protection framework of liberal democratic systems worldwide appears as the preferable path to secure privacy in the digital age.