Pathways to Justice Toolkit

PATHWAYS TO JUSTICE 1

PATHWAYS TO JUSTICE TOOLKIT

AUTHORS: Alexandra Giannopoulou (Digital Freedom Fund) Nikita Kekana (Digital Freedom Fund) Cesar Manso Sayao (Digital Freedom Fund)

EDITOR: Alexandra Giannopoulou (Digital Freedom Fund)

COPYEDITOR: Emma Irving

CREATIVE DIRECTOR: Marea Zanlungo

GRAPHIC DESIGNER: studio kitschen www.studiokitschen.com

ILLUSTRATOR: Tessa www.lotsofbroth.com

Developing Information, Guidance, and Interconnectedness for (Charter) Rights Integration in Strategies for Enforcement

PUBLISHED NOVEMBER 2024

Funded by the European Union. Views and opinions expressed are however those of the authors only and do not necessarily reflect those of the European Union or the CERV Programme. Neither the European Union nor the granting authority can be held responsible for them.

This work is published under a CC BY-SA 4.0 license (Creative Commons Attribution and ShareAlike). The full license is available here: https://creativecommons.org/licenses/by-sa /4.0/legalcode Human-readable summary: https://creativecommons.org/licenses/bysa/4.0/

3

PATHWAYS TO JUSTICE TOOLKIT INTRODUCTION

CONTENTS

1

PART 1 Enforcing the EU Charter of Fundamental Rights in the Court of Justice of the European Union

PART 2 Enforcing EU Charter Law in Member State’s National Courts

7 15

PART 3 Using the National Human Rights Institutes, Ombuds Institutions & Equality Bodies

19

PART 4 Using Collective Redress to Improve Access to Justice

26

PART 5 Alternative Quasi-Judicial Pathways: DPA & DSA Mechanisms

CONCLUSION

35

49

7

PATHWAYS TO JUSTICE TOOLKIT

O INTRODUCTION

INTRODUCTION

Systemic and transformative change happens when impacted people act and collaborate with others to build power to challenge the root of their oppression. With this toolkit, we collate and present information, strategies, and best practices designed to protect the EU Charter of Fundamental Rights1 (EU Charter/ the Charter) in the digital sphere through strategic litigation.

1

EU Charter of Fundamental Rights of the European Union [2010] OJ C 326.

With an ever-increasing proportion of

The EU Charter, drafted at the turn of

interactions between citizens, the public

the millennium, represents an important

sector, governments, and commercial

contribution to the canon of binding

entities taking place online and via digital

legal instruments that make up the

technologies, it is crucial that fundamental

European human rights framework. It

rights are upheld in the digital space in

exists in addition to and alongside other

order to combat digital harms. This digital

international and European human

transformation brings, according to the

rights instruments, including the

European Commission, ‘new opportunities

Universal Declaration of Human Rights

to make fundamental rights more effective

(UDHR), the European Convention on

but also brings challenges.’2 Through this

Human Rights (ECHR), a range of

toolkit, we invite the reader to witness

subject-matter specific instruments, and

the instrumental role of the EU Charter

national constitutions and ‘bills of rights’.

in countering the systemic oppression, harms, and injustices that are encoded in

The Charter is binding on both EU

technology. The immense potential of the

institutions and Member States

EU Charter as a means of resistance against

when they act within the scope of EU

technological bias and oppression sits at the

law. It can therefore play a role in

core of this toolkit.

filling existing gaps in national and international human rights frameworks

2 Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, ‘Strategy to strengthen the application of the Charter of Fundamental Rights in the EU’ (2020), p. 2.

and provide an additional layer of protection. With the entry in force of the Treaty of Lisbon,

1

the Charter became a legally binding

The host of rights and freedoms the EU

the establishment and expansion of data-

in particular. The outcome of strategic

instrument with the same legal value as

Charter articulates creates the image

extractive business and revenue models,

litigation cases can lead to changes in

the Treaties. As a result, the Charter is

of a modern (digitally aware) human

and the growing reliance on technology-

legislation and government policy, raise

becoming the primary avenue for rights-

rights instrument. It is the only binding

mediated decision-making processes by

public awareness, and foster support for

based claims, since it can offer tangible

international legal instrument that distinctly

both public and private entities.

a particular issue.7

opportunities for individuals to directly

mentions a right to the protection of

enforce fundamental rights before the

personal data as clearly distinguished

Many of the case studies presented in

In a blog post for the European Roma

courts, including in relationships between

from the right to privacy. As evidenced in

this toolkit address direct harms and

Rights Centre, strategic litigation is

private parties.

case law and in our case studies, Articles

highlight the impact of fundamental rights

compared to Nassim Nicholas Taleb’s

7 (privacy) and 8 (protection of personal

violations resulting from invasive techno-

Black Swan:

From the practical perspective of

data) of the EU Charter are the foundational

social systems. Creating a corpus of texts

procedural rules, the Charter can be used

rights around which most digital rights

highlighting litigation pathways built on

in strategic litigation when a given right is

cases are built. However, there are other

the link between fundamental rights and

not guaranteed by any other binding and

Charter rights and freedoms that are or can

digital rights is ultimately an attempt to

enforceable document (such as the

be a solid foundation for strategic digital

address the legacy of power in the context

right to good administration). The Charter

rights litigation.

of digital technologies.

the rights contained in other human rights

The Charter’s potential for protecting

documents have been violated (most

digital rights goes even further and includes

STRATEGIC LITIGATION

often those under the ECHR).3

a host of other rights and freedoms that–in

can also be used to strengthen claims that

the face of the ongoing digitisation and However, it has been shown in practice

datafication of everyday lives–are likely to

that ‘references to the Charter are formal,

grow in importance and utility in the digital

declaratory, even decorative and combined

sphere. These rights and freedoms, like all

with references to the ECHR, without

human rights, are designed to uphold EU

4

distinction.’ As a result, it is clear that the

values and the rule of law and ultimately

potential of many Charter provisions is in

to protect individuals and groups from

need of further exploration.

being subjected to injustice, discriminatory treatment, and exclusion from opportunity.

3 See also Łukasz Bojarski, Jane A. Hofbauer, and Natalia Mileszyk, ‘The Charter of Fundamental Rights as a Living Instrument: Guidelines for Civil Society’ (2014) <https:// gmr.lbg.ac.at/wp-content/uploads/sites/12/2021/09/cfreu_ guidelines.pdf> accessed 12 October 2024.

4 Jeremias Adams-Prassl and Michal Bobek, ‘Introduction’ in Michal Bobek and Jeremias Adams-Prassl (eds), The EU Charter of Fundamental Rights in the Member States (Hart publishing 2022), p. 7.

Importantly, such abuses can be increasingly observed in the digital domain in connection with the use of artificial intelligence (AI), access to and (selective) provision of digital goods and services,

To be considered strategic, litigation must have the potential to have an impact beyond the parties directly

[f]irst it is an outlier, as it lies outside the realm of regular expectations, because nothing in the past can point to its possibility. Second, it carries an extreme impact (…) Third, in spite of its outlier status, human nature makes us concoct explanations for its occurrence after the fact, making it explainable and predictable.

involved in the case and to bring about legislative, policy, or social change.5 Though a ‘terminological forest’6 surrounds the concept, we understand successful strategic litigation as entailing widespread benefits for both society in general and those involved in a case 5 See Nani Jansen Raventlow, ‘Litigation as an instrument for social change – laying the foundations for DFF’s litigation support’ (Digital Freedom Fund Blog, 29 November 2017) <https://digitalfreedomfund.org/litigation-as-an-instrument-for-social-change-laying-the-foundations-for-dffs-litigation-support/> accessed 12 October 2024.

6 Michael Ramsden and Kris Gledhill, ‘Defining Strategic Litigation’ (2019) 38(4) Civil Justice Quarterly 407.

7 Equinet, ‘Strategic Litigation Handbook’ (2017) <https://equineteurope.org/wp-content/uploads/2018/05/ equinet-handbook_strategic-litigation_def_web-1. pdf> accessed 30 September 2024. See also, Public Law Project, ‘Guide to Strategic Litigation’ (2014) <https:// publiclawproject.org.uk/content/uploads/data/resources/153/40108-Guide-to-Strategic-Litigation-linked-final_1_8_2016.pdf> accessed 30 September 2024.

3

STRUCTURE OF THE TOOLKIT The Pathways to Justice Toolkit aims to

well as quasi-judicial pathways and out-of-

provide civil society organisations (CSOs),

court processes. The objective of digiRISE

litigators, and activists with concrete

is to reveal a spectrum of diverse pathways

advice and guidance on the potential of

that can be explored to make the EU

strategic litigation for protecting digital

Charter more effective in the digital realm.

Charter rights.

The protection of digital rights as When developing a litigation strategy, it

fundamental rights has predominantly

is important to assess not only the rights

taken place on a CJEU level, with the

that may be enforced in each context, but

effective use of Article 267 of the Treaty on

also the different procedural opportunities,

the Functioning of the European Union8

causes of action, and remedies that are

(TFEU). However, we are aware that there

available to raise digital rights issues before

are other avenues for using the EU Charter

the courts.

in national jurisdictions. In this toolkit, we present five different judicial and quasi-

With this digiRISE Pathways to Justice

judicial pathways at the EU or Member

toolkit, the DFF seeks to build capacity

State level. Each case study attempts to

and raise awareness amongst litigators of

reveal the opportunities and challenges of

different legal frameworks that could be

a given pathway. The focus of the toolkit is

used to protect and promote digital rights.

primarily on digital rights, but many of the principles apply to the use of the EU Charter

Across digiRISE activities, we have

The objectives of the toolkit are:

1. to provide concrete procedural information on the judicial pathways that are available to CSOs, activists, and litigators to invoke the EU Charter; 2. to articulate how strategic litigation before different courts, independent authorities, or other actors can be impactful when combined with other organising strategies; and 3. to provide case studies, takeaways, and reference resources (including a list of strategic litigation guidelines, expert tips, and examples) to assist CSOs, activists, and litigators as they embark upon strategic litigation.

more generally.

developed a corpus of materials and research and a network of experts in

This toolkit presents the following

order to systematise the different avenues

pathways to justice: the CJEU, national

available for CSOs, activists, and litigators

courts, National Human Rights Institutes

to strategically exploit the Charter’s

or Ombuds institutions, representative

potential. There are opportunities to explore

actions, and quasi-judicial pathways such as

and leverage different litigation models

complaints to Data Protection Authorities

in order to strengthen strategic digital

and Digital Service Coordinators, as well as

rights litigation. These include mass, group, collective, and representative litigation, as

8 Article 267 of the Consolidated version of the Treaty on the Functioning of the European Union [2016] OJ C202/47.

other options provided by legal instruments such as the Digital Services Act.

5

O ENFORCING THE EU CHARTER OF FUNDAMENTAL RIGHTS IN THE COURT OF JUSTICE OF THE EUROPEAN UNION

PATHWAYS TO JUSTICE TOOLKIT

PART 1

The case law of the CJEU has immense potential which can be leveraged through strategic litigation. In the last decade, this potential has become more salient as the CJEU has adjudicated more regularly on important human rights issues.

This pathway explains how the EU Charter can be used in the CJEU for digital rights strategic litigation cases. We examine the process enshrined in Article 267 of the TFEU in order to provide insights into how organisations and individuals from all Member States can raise strategic fundamental rights questions before the CJEU via a reference from a Member State national court.

USING THE EU CHARTER IN THE CJEU We recognise that many CSOs frequently

The constitutionalisation of the CJEU is

formulate their actions before national

understood as the process that

courts in such a way as to invoke the preliminary ruling mechanism, and in this way, benefit from the impact of a potential CJEU decision. This is the judicial route most CSOs strategize towards when attempting to use the EU Charter. The advantage of this judicial route is the direct, vertical, and expanded impact that a potential CJEU decision might have for the topic at hand.

Considering the procedural rules laid out in EU law, combined with the recent adjudication in human rights causes, the consitutionalisation of the CJEU

enhances step-bystep substantive and procedural safeguards that allow to keep (executive) power in check.

Concretely, this means that constitutionalization strengthens the ‘triad of constitutionalization’—that is democratic scrutiny by parliaments, judicial review, and fundamental rights protection by courts.9

could become one of the most impactful

PART 1

tools available to CSOs and human rights coalitions.

9 Carolyn Moser and Berthold Rittberger, ‘The CJEU and EU (de-)constitutionalization: Unpacking jurisprudential responses’ (2022) 20(3) International Journal of Constitutional Law 1038.

7

The contention that the Charter can act

courts for an indirect review. There is no

of CJEU case law is the defining factor

as a useful tool to protect individuals’

guarantee of success for this pathway, as

in the strategic decision of individuals,

digital rights is supported by the CJEU’s

national courts have discretion in whether

CSOs, and coalitions thereof to attempt

recent attitude towards the interpretation

to refer the case for a preliminary CJEU

to reach the European judiciary through

and application of even the most long-

ruling. In any case, collective actors such

the preliminary ruling mechanism

established human rights to the digital

as CSOs can only participate in the

provided by Article 267 of the TFEU.

sphere.10 While the CJEU is encouraged,

European case if they were part of the

This procedure enables national courts

and indeed required, to ensure that its

original national proceedings.

to apply to the CJEU for a ruling on

jurisprudence takes into account and

the interpretation or validity of an EU

aligns with that of the European Court of

There are numerous potential benefits

legal act.

Human Rights (ECtHR), it has nevertheless

to pursuing this pathway. The European

developed its own distinctive approach

supranational judicial oversight provided

and priorities.11

by a CJEU decision can shift policies and set precedents across Member States. In

national courts have the power to address a question to the CJEU on the

In practice, this should make the Charter an

practice, and as will be shown in our case

validity (legality) of acts of institutions,

attractive proposition for all stakeholders

study, Member States can exercise levels

bodies, offices, or agencies. The question

seeking to use strategic litigation as a

of control over the process and thereby

must relate to the conformity of these

means to protect digital rights. However,

affect CSOs’ ability to gain access to

acts with the Treaties (including the

CSOs often must go through national

the CJEU for fundamental rights cases.

Charter), general principles of EU law, directly applicable international treaties binding on the EU, or superior acts of secondary EU law (e.g. conformity of a decision with the regulation on which it was based). The procedure is a non-contentious one and serves as an instrument of cooperation between the CJEU and national courts, enabling the CJEU to provide a national court with guidance on the interpretation of EU law. In practice, strategic litigation cases have systematically put forward both specific and innovative legal arguments to address to the CJEU.

10 According to a report by the EU Agency for Fundamental Rights in 2020, the Charter is currently invoked in about 10% of all preliminary ruling procedures and the number of cases in which the CJEU refers to the Charter has increased from 27 in 2021 to 379 in 2019 (European Fundamental Rights Agency, ‘Report on fundamental rights 2020’, focus section, p.4; available at https://fra.europa.eu/sites/ default/files/fra_uploads/fra-2020-fundamental-rights-report-2020_en.pdf, last accessed on 14 October 2024.

11 This can be seen, for example, in the CJEU’s decisions in cases related to electronic surveillance, where it has arguably taken a more restrictive stance in cases like Digital Rights Ireland, Tele2/Watson and Schrems 1 and 2 than its Strasbourg counterpart in, for example, its decisions in Big Brother Watch and Others v United Kingdom and Centrum för Rättvisa v Sweden. Case citations: Joined Cases C‑293/12 and C‑594/12, Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources and Others and Kärntner Landesregierung and Others [2014] ECLI:EU:C:2014:238; Joined Cases C‑203/15 and C‑698/15, Tele2 Sverige [2016] ECLI:EU:C:2016:970; Case C‑362/14, Maximillian Schrems v Data Protection Commissioner [2015] ECLI:EU:C:2015:650; Case C-311/18, Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems [2020] ECLI:EU:C:2020:559; Big Brother Watch and Others v United Kingdom, App nos. 58170/13, 62322/14 and 24960/15 (ECtHR 25 May 2021); Centrum för Rättvisa v Sweden, App no.

35252/08 (ECtHR 25 May 2021).

Knowledge of these country-specific procedural hurdles in various Member States can lead to better chances of CSOs obtaining a CJEU ruling.

CJEU-C-511 / 18

According to Article 267 of the TFEU,

CASE STUDY

LA QUADRATURE DU NET

The transnational effects and impact

9

A coalition of CSOs in France, including

March 2006, which allowed the

La Quadrature du Net, the French Data

indiscriminate retention of personal

Network, the Fédération des fournisseurs

data, in contravention of applicable EU

d’accès à Internet associatifs, and Igwan.

law. Coordinated legal actions by CSOs

net brought a case before the French

were also launched in Belgium and the

courts for the annulment of a national

United Kingdom.

regulation that required electronic communication providers and operators

The CJEU ruled the following: first,

to massively and automatically store

that EU law applies every time a national

and process data in order to detect

government obliges telecommunications

terrorist threats.

providers to process data, including for the purposes of national security; second,

The coalition considered that these

it concluded that EU law sets out privacy

regulations did not comply with (among

and data protection safeguards regarding

others) the ePrivacy Directive.12 The French

the collection and retention of data by

Council of State stayed the proceedings

national governments.

and referred three questions to the CJEU for a preliminary ruling. The questions

Specifically, the CJEU proclaimed that

concerned the compatibility of the general

read in the light of Article 4(2) of the

and indiscriminate data retention obligation

Treaty on European Union (TEU) and

under French law with fundamental rights

Articles 7, 8, 11, and 52(1) of the Charter,

guaranteed by the EU Charter. This action

the Directive must be interpreted as

was also joined by Privacy International and

precluding national legislation that

the Centre for Democracy and Technology,

requires electronic communications

who intervened in February 2016 before the

services providers to carry out the general

Council of State in support of the French

and indiscriminate transmission of traffic

organisations’ request for the annulment

and location data to the security and

of the regulatory provisions. Annulment

intelligence agencies of a State for the

was requested of the provisions of, in

purpose of safeguarding national security.

particular, Decree No. 2006-358 of 24

ANALYSIS The CJEU issued a decision which spoke

data by service providers as well as access

to the interaction between secondary

to them by authorities, because, inter alia,

law, national transpositions, and the

the ePrivacy Directive imposed obligations

EU fundamental rights framework. This

to guarantee the confidentiality of

decision–well situated within a thematic

communications and provided for possible

focus on the compliance of the Directive

restrictions, including law enforcement.14

in question and the EU Charter–is not

The same conclusion was reached in

alone in articulating how Articles 7 and

subsequent CJEU case law on the same

8 of the Charter are to be balanced and

topic, as our case study evidences.

interpreted in national law transpositions of an EU Directive. Rather, the case in

In the field of data protection more

question sits within a long tradition of

broadly, impactful cases where CSOs have

CJEU case law ensuring respect for and

collaborated with individuals or intervened

the balancing of fundamental rights in

include Schrems II,15 Google,16 Planet49,17

EU lawmaking.

and IAB Europe.18

Surveillance is a field where CSOs have

However, we acknowledge that there is a

been active and largely successful in

risk that a CJEU decision could ultimately

their strategic litigation before European

be unfavourable. For example, on 30 April

courts.13 As with every other Charter

2024, the CJEU published its decision in

right, Article 8 is binding on both EU

the EncroChat case.19 The case concerned

bodies and on Member States when they implement EU law (Article 51(1) EU Charter). In Tele2, the CJEU examined the validity of a national law obliging telecommunications service providers to retain certain telecommunications data for law enforcement purposes. The Court held that EU law covered the retention of the

12 Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) [2002] OJ L 201.

13 The first landmark CJEU ruling was delivered in 2014 in the joined cases against the Data Retention Directive, one of which was litigated by the Irish CSO Digital Rights Ireland.

14 For more on this discussion see Ioannis Kouvakas, ‘Article 8 of the Charter of Fundamental Rights of the EU’ in Digital Freedom Fund, Digital Rights are Charter Rights, (2023) <https://digitalfreedomfund.org/digital-rights-arecharter-rights-essay-series/> accessed 30 September 2024.

15 Case C-311/18, Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems [2020] ECLI:EU:C:2020:559.

16 Case C-507/17, Google LLC v CNIL [2019] ECLI:EU:C:2019:772.

17 Case C-673/17, Planet49 [2019] ECLI:EU:C:2019:801.

18 Case C-604/22, IAB Europe [2024] ECLI:EU:C:2024:214.

19 For an analysis of the case, see Hugo Partouche and Chloé Barthélémy, ‘Mass hacking and fundamental rights: a missed opportunity for the CJEU?’ (EU Law Analysis, 11 July 2024) <https://eulawanalysis.blogspot.com/2024/07/ mass-hacking-and-fundamental-rights.html> accessed 14 October 2024.

11

European police cooperation operations

accessing justice through the CJEU. It is

strategic litigation space. While there is a

portions of the population living in

against organised crime, involving the mass

possible to challenge a national court for

long tradition of CJEU cases dealing with

EU territories.

interception of encrypted communications

failing to make a reference to the CJEU, but

privacy (Article 7) and data protection

by means of spyware (‘hacking’). This

this process is time consuming, expensive,

(Article 8), there are fewer opportunities for

resulted in the collection of millions of

and unusual. It can also prove counter-

CSOs to bring non-discrimination cases,

messages leading to thousands of arrests

productive for CSOs aiming to use these

especially in the digital space. This is partly

across Member States. The Berlin Regional

same national courts in the future.

due to the fact that any fundamental

While not guarantying access to justice

rights that have not been systematically

for all, the CJEU constitutes a very

Court referred questions to the CJEU, asking

TAKEAWAY AND RECOMMENDATIONS

whether a German European Investigation

There are many factors to consider when

associated with digital rights, such as the

efficient pathway to ensure compliance

Order concerning the transmission of data

deciding whether to seek a preliminary

ones mentioned above, are less likely to be

with EU law and the fundamental rights

collected by French investigators using

ruling to enforce the EU Charter. The

part of CJEU strategic litigation case law.

framework and can deliver strategic

hacking techniques was compatible with

CJEU’s procedural hurdles prevent CSOs

fundamental rights. The CJEU decision

from using this pathway to its fullest

Finally, it is important to note that all these

avoided linking this case to existing

potential. Not all organisations have the

challenges particularly affect access to

European case law applying Articles 7 and

expertise and working hours to dedicate

justice for racialised groups, migrants,

8 of the EU Charter to criminal matters.

to the preparation of a case and to the

LGBTQI+ communities, people with

Instead, it prioritised the principle of mutual

strategic formulation of the questions

disabilities, working class people, women,

trust, which guarantees the effectiveness of

to be referenced using the Article 267

sex workers, and many other minoritised

European judicial cooperation.

mechanism. While the referencing itself

and historically excluded communities

does not come with directly associated fees,

and individuals. These communities and

Statistically, we see that in practice some

the national court litigation process and the

individuals are the first to suffer from the

Member States make more use of the

legal expenses of litigating at the EU level

ways in which technology can amplify

preliminary ruling mechanism than others.

constitute often insurmountable barriers

biases, surveil, classify, discriminate against,

This is due to national processes, including

for individuals, CSOs, and coalitions of CSOs

exclude, and more. The complicated

the general tendency of certain courts

to achieve their objectives at the CJEU. This

procedures laid out by EU law, the need to

to refer questions to the CJEU in order to

becomes even more evident especially

define a novel legal argument to attract

support EU legal integration (since the

when one considers other barriers such as

the attention of the CJEU judiciary, the

integration process expands their judicial

the expertise necessary to create, select,

necessity to present a case via national

powers) and the established strategic

and research the strategic litigation case

courts (with all the variability in trust in the

litigation strategies within national case

thatwill be more likely to be adjudicated by

judiciary among different Member States),

law. If collective actors want to influence

the European judiciary.

and the need (at times) to define specific

the CJEU, their best bet is to get involved in

decisions in digital rights cases.

•

•

•

The decision of which national court you will bring the preliminary question to is strategic.

Make sure to shape your legal argument in a way that highlights its legal novelty.

Ensure that you include affected individuals or groups in your strategy.

Is going to the CJEU the preferred route for the people affected?

individuals (or not) within a strategic

national legal proceedings from the start, as

This all points to flagrant access to justice

litigation case, all pose challenges that

this will increase their chances of eventually

inequalities even within the human rights

directly affect access to justice for large

13

O ENFORCING EU CHARTER LAW IN MEMBER STATE’S NATIONAL COURTS

PATHWAYS TO JUSTICE TOOLKIT

PART 2

One of the most important pathways for enforcing fundamental rights using the EU Charter is through the national courts of EU Member States (National Courts). This section explains when and how the EU Charter should be utilised by National Courts. It also unpacks the main reasons in favour of utilising this pathway and briefly identifies some of this pathway’s limitations. Like the rest of the toolkit, this section primarily focuses on digital rights, but many of the principles apply to the enforcement of fundamental rights through National Courts more generally.

APPLYING THE EU CHARTER IN NATIONAL COURTS All Member States, including their national courts,20 are required to take appropriate measures to ensure the fulfilment of obligations that arise from the EU Treaties, including the EU Charter, or the acts of EU institutions.21 National judges must always observe EU law and cannot rely on national laws to override EU Law.22

This means that National Courts cannot declare a law or practice as lawful if it overrides fundamental rights contained in the EU Charter.

PART 2

20 Case 14/83, Von Colson and Kaufmann v Land Nordrhein-Westfalen [1984] ECLI:EU:C:1984:153, para. 26.

21 Arts. 4(3) and 5, Consolidated version of the Treaty on European Union [2016] OJ 202/1.

22 Case 6/64, Flaminio Costa v ENEL [1964] ECLI:EU:C:1964.

15

CASE STUDY

The Dutch government introduced system risk indication (SyRI) software to identify ‘fraud’ in its social welfare system. 23

The core issue of the case was whether this system violated the right to privacy under European laws, including the right to the protection of personal data under the EU Charter and the General Data Protection Regulation (GDPR) and Article 8 of the ECHR.

The Hague Court decided that it was necessary to strike of a fair balance between the interests of the community as a whole and the right of the individuals affected by the legislation to respect for their private life in particular. In this case, the Court held that the

NETHERLANDS SYRI CASE

possible benefits of using SyRI in fraud detection did not outweigh the right to privacy of the individuals whose data was being processed by the software.

Referring to the EU Charter (and the GDPR), the Court specifically held that it was important to consider the principles of transparency, purpose limitation, and data minimisation. Ultimately, the Court held that the legislation relating to the application of SyRI was not adequately transparent and verifiable.

This case study highlights a number of important things, namely: -

National Courts do use the EU Charter to protect

fundamental rights, especially when relying on national laws might not offer adequate protection; -

This pathway is indeed accessible, as the Dutch legal

team were able to bring arguments referring to EU and European Law in their own national court (The Hague), in their local language, and in the jurisdiction where the harm occurred (i.e. where the privacy violating software was being used)24.

23 C-09-550982-HA ZA 18-388, 5 February 2020, The Hague District Court <https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:RBDHA:2020:1878> accessed 14 October 2024.

24 Douwe Linders, ‘Landmark ruling in SyRI case: Dutch court bans risk profiling’ (SOLV, 5 February 2020) <https://solv.nl/blog/landslide-victory-in-syricase-dutch-court-bans-risk-profiling/> accessed 14 October 2024.

ANALYSIS There are many reasons why this pathway

rules on admissibility and prescription

remains an important one for enforcing

and of the court etiquette.

the EU Charter, and why it should not be overlooked, particularly as we witness

Effective strategic litigation includes

the increasing use of digital systems to

strategic communications, advocacy,

conduct many aspects of daily life, such

and/or campaigning around the case.

as welfare systems, banking systems, and

This is a lot easier to do on a national level,

migration systems.

particularly in the specific Member State where digital harm occurred, as people

Violations of fundamental rights that

are a lot closer to the issue and feel more

exist within the digital space typically

personally affected by it, even if they are

affect a group of persons or a community

not themselves the applicants before the

rather than one single individual. This is

court. Therefore, if a case takes place before

because they often relate to the use of a

National Courts, it is easier to get affected

particular digital tool or system that has

individuals and communities to attend the

been rolled out more generally, e.g. border

court hearings, organise protests outside

passport scanners.

the courts, and come up with related communications that are likely to gain the

Although persons can make submissions

attention of local media. This will, in turn,

before the CJEU in their local EU language,

make it more likely, even if the judgment

national courts will nevertheless still be

is unfavourable, for the particular case to

more accessible as the proceedings will be

be impactful and to raise awareness of the

completely in the local language, take place

fundamental rights violation.

closer to the applicants’ place of residence, and the applicants will be more familiar

National Courts also typically have better

with the national court’s proceedings.

binding enforcement mechanisms in place to ensure that their judgments are adhered

Another advantage of using this pathway

to–including the seizing of assets within the

is the fact that, typically, the legal team

jurisdiction– compared to other pathways,

working on a case will come from that

especially Ombuds institutions and human

particular Member State. As such, they will

rights bodies.

be more aware of the court’s procedural

17

However, although the EU Charter

case ultimately ending up at a Supreme

technically applies in National Courts, in

or Constitutional Court. This can make

practice courts are more familiar with

it hard to maintain momentum and

national laws and may feel that they lack

enthusiasm about a case.

the expertise to apply EU law. As a result, National Courts are more likely to invoke national laws in their judgments.25 This

TAKEAWAY AND RECOMMENDATIONS

can be a missed opportunity, as not referring to fundamental rights can result

Despite some shortcomings, particularly

in lower protection in situations where

in the universal application of the

national provisions are not as expansive

EU Charter, National Courts remain

as the EU Charter.

an important pathway for enforcing fundamental rights in the digital space.

Even when fundamental rights are referred to in National Courts, there is a

•

risk that the rights will not be uniformly interpreted across different Member States. Where National Courts have slightly different interpretations of the scope of

•

a fundamental right, this can result in unequal protection (although it is in these situations that National Courts should refer to the CJEU for clarification26). Further training of local judges on EU law could overcome this particular disadvantage.

•

Finally, these national procedures tend to be long and expensive, particularly as there are usually several instances with the

25 Tobias Nowak and Monika Glavina, ‘National courts as regulatory agencies and the application of EU law’ (2021) 43(6) Journal of European Integration 740.

26 Court of Justice of the European Union (European Union, 2024) <https://european-union.europa.eu/institutionslaw-budget/institutions-and-bodies/search-all-euinstitutions-and-bodies/court-justice-european-union-cjeu_ en> accessed 14 October 2024.

•

Local applicants are more familiar with national courts, which can be beneficial for the case.

National Court cases are easier to align with a broader advocacy and communication strategy related to the cause at hand.

Enforcement of a National Court judgment is often easier than in other pathways.

More work needs to be done to ensure that the national judges are familiar with applying EU law.

USING THE O NATIONAL HUMAN RIGHTS INSTITUTES, OMBUDS INSTITUTIONS, & EQUALITY BODIES

PART 3

19

PART 3

In 2022, a Dutch student named Robin Pocornie, supported by the Racism and Technology Centre,29 filed a discrimination claim with the Dutch equality body and

National Human Rights Institutes (NHRIs) are independent bodies established by the State through either constitutional or legislative authority in order to promote and protect human rights. They commonly have multiple mandates. NHRIs are essential in bridging the ‘protection gap’ between the rights of individuals and the responsibilities of the state. The Vienna Declaration of 199327 recommended the establishment of NHRIs, following the 1991 UN Paris Principles which outlined their functioning and status.

investigating maladministration at the national and EU levels respectively. The national Ombuds institutions are independent authorities with investigating powers charged with receiving and examining complaints against national, regional, and local public authorities in the Member States. The European Ombudsman has this same responsibility with respect to EU institutions. Together, the national Ombuds institutions and EU Ombudsman form the European Network of Ombudsmen.

27 World Conference on Human Rights, ‘Vienna Declaration and Programme of Action’ (1993) <https://www.ohchr.org/sites/default/files/Documents/ProfessionalInterest/vienna.pdf> accessed 3 October 2024.

USING THE EU CHARTER IN NATIONAL HUMAN RIGHTS INSTITUTES

national human rights institution, the College voor de Rechten van de Mens (the Institute for Human Rights).

Pocornie argued that the Vrije Universiteit Amsterdam’s (VU) use of proctoring software to invigilate online exams taken at home during the Covid-19 pandemic in 2020 discriminated against her on grounds of race.30

The e-proctoring software, Proctorio, repeatedly failed to

The national Ombuds institutions and the EU Ombudsman are responsible for

European Network of NHRIs28 supports and connects these institutions, promoting the exchange of best practices and

The role of NHRIs extends beyond

engagement with the EU and

the promotion and protection of

other international mechanisms.

human rights at the national level. It

recognise Pocornie’s face, which made her participation in exams difficult and imposed undue stress. Pocornie was able to discern that this issue was not experienced by her non-racialised fellow students. Her claim echoed academic research showing that commercial facial recognition systems perform significantly worse when attempting to identify the faces of individuals (and particularly women) with darker skin tones. When these systems are used to control access to resources, services, institutions, or benefits, their subpar performance for certain demographic groups generates unjust disadvantages.

In a preliminary decision, the Institute found that there was sufficient evidence to suggest the software was discriminatory. However, in its final judgment, it focused only on the student’s individual experience, ruling that the VU was not required to demonstrate that no racial discrimination had occurred in the use of the Proctorio

also involves the implementation of

software across the board.

international standards, which make NHRIs suitable pathways to address and seek enforcement of fundamental rights, including those under the Charter. The

28 European Network of National Human Rights Institutions, available at <https://ennhri.org/> accessed 3 October 2024.

CASE STUDY

29 Racism and Technology Center <https://racismandtechnology.center/> accessed 14 October 2024.

30 For an overview of Robin’s story, see Robin Aisha Pocornie, ‘Error 404: Human Face Not Found’ (28 February 2024) <https://youtu.be/ pVfvYYUkIcY?si=jbAEXbSC8rTc2vAT> accessed 14 October 2024.

DISCRIMINATORY E PROCTORING SOFTWARE AT THE DUTCH HUMAN RIGHTS INSTITUTE

PATHWAYS TO JUSTICE TOOLKIT

21

The Institute determined that there was

prohibition of discrimination applies to ‘the

relating to the national level. Complaints

sent a complaint to the EU Ombudsman

no conclusive legal proof of discrimination

institutions [and] bodies […] of the Union’ as

relating to EU maladministration should be

asking the independent authority to

in the student’s specific case.

well as ‘the Member States only when they

addressed to the EU Ombudsman.

investigate the transfer to third

Nevertheless, the ruling acknowledged

are implementing Union law’. Hence, the EU

the possibility that such software could

has a comprehensive obligation to refrain

lead to discrimination in other scenarios.

from any form of discrimination based on

countries of surveillance capabilities

USING THE EU CHARTER (including capacity building or training IM OMBUDS INSTITUTIONS of third country authorities in surveillance

all grounds listed in Article 21.31 For instance,

techniques), surveillance equipment,

this implies that Frontex, an EU agency,

The EU Ombudsman is an independent

and other forms of support. The EU

cannot utilise border control software that

and impartial body that holds the

Ombudsman is the entity responsible

discriminates against individuals based on

EU administration to account. The

for handling the complaint because

factors such as skin colour, ethnic origin,

Ombudsman investigates complaints

these activities are carried out by the

NHRIs and Ombuds institutions

or language. The obligation for Member

about maladministration in EU

European Commission, the European

provide an accessible and cost-effective

States, however, is more limited: the non-

institutions, bodies, offices, and

Border and Coast Guard Agency (Frontex),

pathway, especially for individuals facing

discrimination obligation only applies when

agencies. The Ombudsman may find

the European Union Agency for Law

discrimination. These institutions often

there is a ‘direct link’ with EU law.

maladministration if an institution fails

Enforcement Training (CEPOL), and the

to respect fundamental rights, legal rules

European External Action Service (EEAS).

ANALYSIS

offer free legal assistance and serve as a critical first point of contact, especially for

NHRIs and Ombuds institutions often lack

or principles, or the principles of good

discrimination cases. Their procedures are

the desired level of effectiveness in securing

administration. This covers, for example,

The complaint suggested that no human

typically more streamlined, informal, and

rights and achieving enforceable outcomes.

administrative irregularities, unfairness,

rights risk and impact assessments had

approachable, particularly for individuals

This is because the remedies they propose

discrimination, abuse of power, failure

been carried out prior to the engagement

with limited means or those whose

are frequently non-binding and dependent

to reply, refusal of information, and

of these bodies with the authorities of

circumstances do not permit going to

on voluntary compliance, which can limit

unnecessary delay. Any citizen or resident

third countries. These risk assessments

National Courts. The ability of these actors

their ability to address complex or systemic

of the EU, business, association, or other

are needed to ensure that any surveillance

to investigate cases, seize the courts

legal issues. Furthermore, unlike court

body with a registered office in the

transfer will not result in serious violations

directly, provide legal support, and even

rulings, the recommendations or findings

EU can lodge a complaint before the

of the right to privacy or facilitate other

engage in strategic litigation, contributes

from these bodies do not establish legal

Ombudsman whether they are directly

serious violations of human rights.

not only to individual cases but also to

precedents, thereby diminishing their

affected by the maladministration or not.

The coalition asked the EU Ombudsman

broader systemic changes.

broader legal impact.

to proclaim maladministration and to A coalition of CSOs comprised of Privacy

address it, recognising the implications of the failure for millions of people.

Traditionally, these independent authorities

NHRIs and national Ombuds institutions

International, Access Now, the Border

are tasked with discrimination cases,

are only competent to deal with complaints

Violence Monitoring Network, Homo

among other human and fundamental

Digitalis, the International Federation for

rights violations. Due to the scope of the

Human Rights (FIDH), and Sea-Watch,32

Charter, as expressed in Article 51(1), the

31 See Raphaële Xenidis, ‘Article 21: an exploration, or the right to algorithmic non-discrimination’ in Digital Freedom Fund (n 14).

32

‘Complaint

on

EU

surveillance

transfers

to

third countries’ (Privacy International) <https:// privacyinternational.org/legal-action/complaint-eusurveillance-transfers-third-countries> accessed 14 October 2024.

23

The EU Ombudsman issued a decision in November 2023 finding that no further inquiries were justified, but it

TAKEAWAY AND RECOMMENDATIONS

did suggest a series of improvements

NHRIs, national Ombuds institutions, and

the EEAS should adopt in order for its

the EU Ombudsmen are all independent

human rights due diligence process to

institutions designed to be access to justice

constitute an acceptable alternative to a

pathways. While it is difficult to assess their

human rights impact assessment. These

in powers, capacity, funding, and expertise

changes to the EEAS human rights due

among the different national authorities

diligence documentation, in particular,

in the Member States–all these authorities

the inclusion of ‘data protection provisions’

are part of a wider system set up to obtain

on information sharing sessions, the

redress and to create processes for rights

assessment of the human rights impact

violations. The essence of NHRIs and

of an activity at ‘every stage’ of said activity,

Ombuds institutions is their neutrality and

and the inclusion in the due diligence

ability to work towards systems changes.

documentation of a description of the risk

involved in a potential risk assessment.

•

The recommendations aimed to enhance transparency, accountability, and human rights considerations. Similarly, the Ombudsman’s decision with respect to Frontex followed the same logic, highlighting that human rights impacts assessments ‘should be specifically designed, taking into account the nature of surveillance capabilities being transferred, so as to allow for the potential negative effects on human rights to be identified and to provide for mitigation measures’.

You can combine the NHRIs and Ombuds institutions pathways with appropriate advocacy and communications strategies to maximise the impact of your strategic litigation case.

efficiency as a whole–due to divergences

recommendations focused on making

identification process and the elements

•

•

NHRIs and Ombuds institutions provide an accessible and costeffective alternative pathway, especially for individuals facing discrimination.

The recommendations or findings of these bodies do not establish legal precedents.

While the broader legal impact is low, these bodies contribute to opening a pathway for legal precedent setting by courts.

25

USING O COLLECTIVE REDRESS TO IMPROVE ACCESS TO JUSTICE

PATHWAYS TO JUSTICE TOOLKIT

PART 4

The expansion of large digitalisation and datafication processes exposes thousands or even millions of individuals to harmful practices that are leading to the violation of their digital rights. As the Commission highlighted, ‘[i]n light of increasing cross-border trade and EU-wide commercial strategies, these infringements increasingly also affect consumers in more than one Member State.’33 Collective redress mechanisms can help to ensure the enforcement of digital rights at scale by enabling CSOs to develop efficient litigation strategies that allow them to represent groups or classes of claimants, both with and without a representative mandate. Such collective actions also create opportunities for cross-disciplinary and cross-jurisdictional collaborations between different CSOs and other institutional stakeholders.

Challenging technologically created, imposed, and amplified systemic injustices

requires knowledge and understanding of data systems, social capital, and political agency to claim rights, and resilience and courage to stand up. We need to move away from the notion of individual empowerment (…) to collective agency - which should be understood as a process that brings together different competencies needed to identify and uncover the problem and jointly work towards a solution, through the practice of resistance.34

33 Proposal for a Directive on representative actions for the protection of the collective interests of consumers, and repealing Directive 2009/22/EC [2018] COM/2018/0184 final - 2018/089 (COD), p. 1.

PART 4

34 Roderic Crooks, Catherine D’Ignazio, Arne Hintz, Fieke Jansen, Juliane Jarke, Anne Kaun, Stine Lomborg, Dan McQuillan, Jonathan A. Obar, Lucy Pei, and Ana Pop Stefanija, ‘People’s Practices in the Face of Data Power’, in Juliane Jarke and Jo Bates (eds), Dialogues in Data Power (Bristol University Press 2024).

27

CASE STUDY

Flo Health, Inc. developed and owns the smartphone application called ‘Flo Ovulation and Period Tracker’.

In April 2023, a representative action was brought against Flo Health, Inc. by Ius Omnibus, a Portuguese not-forprofit consumer association, before the Judicial Court of the District of Lisbon. The complaint alleges that Flo Health, Inc. unlawfully shared users’ sensitive personal data.

Between 30 June 2016 and 23 February 2019, Flo Health, Inc. shared sensitive personal data of (Portuguese) users of the application relating to their menstruation, health, and sex life. This data was recorded by users in the application. The company shared this information with companies such as Meta and Google, i.e. companies that regularly engage in data analytics and targeted advertising activities. Personal data was shared without obtaining users’ consent, for commercial purposes, and in violation of the company’s

FLO HEALTH APP

assurance that this data would not be shared with third parties. This data-sharing practice was detected by authorities from the United States of America, which forced Flo Health, Inc. to end the personal data sharing and notify all users.

The subsequent lawsuit, still pending before Portuguese courts, highlights the importance of the fundamental rights of Portuguese consumers, including the right to privacy and data protection, as well as the right to consumer protection.

If this claim is successful, Flo Health, Inc. will be ordered to compensate the consumers represented in the action for the damage caused by these illegal practices.

ANALYSIS While many Member States provide for

collective interests of consumers is

collective redress mechanisms in their

available in all Member States.’37

national laws, this is not the case in all States. Consecutive EU initiatives have

The Directive applies to ‘representative

sought to make it possible ‘for qualified

actions brought against infringements

entities designated by the Member

by traders’38 of provisions included in

States, such as consumer organisations

a long list of EU laws, including in the

or independent public bodies, to bring

areas of product liability, consumer

representative actions for the protection

contracts, consumer protection and

of the collective interests of consumers

unfair commercial practices, e-commerce,

with the primary aim of stopping both

universal service and users’ rights relating

domestic and cross-border infringements

to electronic communications networks

of EU consumer law.’35

and services, data protection, distance marketing, consumer credit agreements,

This effort culminated in the adoption

and several others.39 Among other things,

of Directive (EU) 2020/1828 of the

the Directive includes provisions on the

European Parliament and of the Council

designation of qualified entities,40 the

of 25 November 2020 on representative

types of representative actions covered,41

actions for the protection of the collective

the available injunctive42 and redress43

interests of consumers and repealing

measures, and funding.44 Member States

Directive 2009/22/EC36 (Representative

were obliged to transpose the Directive into

Actions Directive), which ‘sets out rules

domestic law by 25 December 2022 and to

to ensure that a representative action

apply these measures from 25 June 2023.45

mechanism for the protection of the

35 Commission Report of 25 January 2018 on the implementation of Commission Recommendation 2013/396/ EU6 on common principles for injunctive and compensatory collective redress mechanisms in the Member States concerning violations of rights granted under Union Law [2018] COM(2018) 40 final, p.2.

36 Directive (EU) 2020/1828 of the European Parliament and of the Council of 25 November 2020 on representative actions for the protection of the collective interests of consumers and repealing Directive 2009/22/EC [2020] OJ L 409.

37 38 39 40 41 42 43 44 45

Art. 1(1), Representative Actions Directive (n 38).

Art. 2(1), Representative Actions Directive (n 38).

Annex I, Representative Actions Directive (n 38).

Art. 4, Representative Actions Directive (n 38).

Art. 7, Representative Actions Directive (n 38).

Art. 8, Representative Actions Directive (n 38).

Art. 9, Representative Actions Directive (n 38).

Art. 10, Representative Actions Directive (n 38).

Art. 24(1), Representative Actions Directive (n 38).

29

The Directive promises to broaden the

the complaint. This system is particularly

their ID card number. This prompted 620

‘widespread’. The Court decided that this

possibility of bringing representative

advantageous for cases concerning BigTech

claimants to join the action. Furthermore,

practice constitutes discrimination every

actions in all Member States, including

because of the large number of people that

the Foundation partnered with noyb and

time people have been subject to a check

actions that challenge violations of digital

could be affected.

filed another complaint with the national

on the basis of physical characteristics

Data Protection Authority.48

associated with a real or supposed origin.

EU Charter rights. In addition to the mechanisms introduced following the

In addition to the case study presented

The Council of State notes, however, that

Directive’s implementation throughout

above, there are multiple other

Alternatively, there are representative action

the measures requested by the associations

the EU, some Member States have pre-

representative action cases with the

cases pursued in other EU jurisdictions

have, in fact, the aim of redefining public

existing collective redress mechanisms.

potential to affect a large number of people.

which do not necessarily rely on the

policy choices regarding the use of identity

The availability of information about the

We believe it to be important to highlight in

consumer harm or compensation narrative

checks for the purposes of supressing crime

substantive and procedural requirements of

this context the representative action case47

as described in the case study above.

and preventing public order disturbances.

different collective redress mechanisms can

brought by The Daphne Caruana Galizia

Take, for instance, the collective action

Such measures do not fall within the

be key in strategic litigation, for example in

Foundation against the company C-planet

case that was brought in France against

powers of the administrative judge.

developing cross-jurisdictional strategies.

for a data breach related to electoral data

discriminatory identity checks by law

After the Council of State dismissed the

in Malta. C-planet created a database of

enforcement. As part of a representative

appeal, the coalition re-oriented the

The case study described above represents

illegally collected personal data containing

action,49 several associations and NGOs50

complaint towards the United Nations

one of the many objectives that can be

the personally identifiable information

brought a case before the Council of

Committee on the Elimination of Racial

pursued with a representative action. The

of anyone who had the right to vote in

State to put an end to the practice of

Discrimination (CERD).52

aim of the complaint in the case study

the 2013 elections, including sensitive

discriminatory identity checks. According

is to have a national court recognise the

information such as voting intentions

to the Council of State decision,51 while the

Finally, the complaint brought by

damage to consumers, to have the court

or party leanings. While the case is still

Court recognised that these practices do

members of the Rohingya community

order compensation, and, finally, to have

pending before the local courts, the process

not constitute isolated instances, it also did

before the Irish courts against Meta seeks

information about the violation become

adopted for bringing the case is notable.

not go as far as to call them ‘systemic’ or

to establish the responsibility of Facebook

public. The case in question was filed in

The Daphne Caruana Galizia Foundation’s

Portugal, a Member State with an opt-in

strategy considers both the large number

system.46 This means that the consumer

of potential claimants and the procedural

organisation acting as a qualified entity

and redress opportunities afforded by data

is considered to represent all consumers

protection regulations and the GDPR. For

affected by the unlawful practice, without

example, the Foundation created a tool that

being obliged to prove that consumers have

allowed anyone to check whether their data

specifically signed up to be represented in

had been leaked by C-Planet by entering

46 For more information on the differences in collective redress systems, please refer to our collective redress database on the DFF digiRISE webpage: https://digitalfreedomfund.org/digirise-2/ accessed 14 October 2024.

47 ‘Collective action against C-Planet data breach’ (The Daphne Caruana Galizia Foundation, 03 April 2020) <https:// www.daphne.foundation/en/2020/04/03/collective-action-data-breach> accessed 14 October 2024.

for the contribution that its content 48 For this process, please refer to the next pathway and its corresponding analysis.

49 See here the representative action website: https:// maruemesdroits.org/ accessed 14 October 2024.

50 These CSOs are: Maison Communautaire pour un Développement Solidaire (MCDS), Pazapas, Réseau Egalité, Antidiscrimination, Justice Interdisciplinaire (Reaji), Amnesty International France and Human Rights Watch.

See also: ‘Contrôles au Faciès en France: le combat continue’ (Amnesty International, 11 October 2024) <https://www. amnesty.fr/discriminations/actualites/controles-au-faciesle-conseil-detat-reconnait-lexistence-du-probleme-mais-refuse-de-contraindre-letat-a-y-mettre-un-terme> accessed 14 October 2024.

51 N° 454836, 11 October 2023, Council of State <https://www.conseil-etat.fr/actualites/controles-d-identite-discriminatoires-la-determination-d-une-politique-publique-ne-releve-pas-du-juge-administratif> accessed 14 October 2024.

moderation policies–and the ensuing amplified disinformation–made to the commission of genocide against the Rohingya population in Myanmar.

In 2018, UN human rights investigators said the use of Meta’s social media platform Facebook had played a key role 52 See the complaint here: ‘CERD submission April 2024’ <https://www.hrw.org/sites/default/files/media_2024/04/CERD%20submission%20April%202024.pdf> accessed 14 October 2024.

31

in spreading the hate speech that fuelled

are many challenges in engaging with

the violence. ‘Facebook’s algorithms and

communities and resistance movements,

Meta’s ruthless pursuit of profit created an

and in aligning the broader structural

echo chamber that helped foment hatred

objectives, representative actions are ideal

of the Rohingya people and contributed

avenues to apply this form of lawyering

to the conditions which forced the ethnic

and to build the collective power needed

group to flee Myanmar en masse’, read a

to set strategies with transformative

statement by Amnesty International.53 The

objectives for all.

case, brought collectively by 17 Rohingya refugee individuals, alleges that harm was suffered as a result of Facebook’s failure

TAKEAWAY AND RECOMMENDATIONS

to appropriately moderate content, which contributed to the genocide against the

Representative actions are another type

Rohingya group.

of procedure that can be instituted before national courts. They come in various

In all the cases presented above, there

procedural forms but are subject to a

was a high degree of direct involvement in

degree of harmonisation thanks to the

case strategy by the affected communities.

Representative Actions Directive. There is

Movement lawyering54 is one form of

no one-size-fits-all representative action

social change lawyering, and its aim is to

strategy–it must be adjusted to harm

invert the relationship dynamics between

suffered, the objective pursued by the

litigators and represented communities

group of individuals or communities

and to escape more traditional forms of

affected, and the chosen forum and

lawyering. One of the biggest aims of

jurisdiction in the EU.

•

•

When making strategic choices about jurisdictions and partners, you should take into consideration the type of collective claim pursued (not all collective claims are necessarily consumer law claims).

Consider implementing movement lawyering as a driving principle.

Representative actions are ideal tools to use in broader collective action efforts, especially for movement strategizing.

movement lawyering is to use the law to build the power of communities and to ensure that movements do not become reliant on lawyers only. While there

53 ‘Myanmar: Time for Meta to pay reparations to Rohingya for role in ethnic cleansing’ (Amnesty International, 25 August 2023) <https://www.amnesty.org/en/latest/ news/2023/08/myanmar-time-for-meta-to-pay-reparationsto-rohingya-for-role-in-ethnic-cleansing/> accessed 14 October 2024.

54 Christine Cimini and Doug Smith ‘An Innovative Approach to Movement Lawyering: An Immigration Rights Case Study’ (2021) 35(2) Georgetown Immigration Law Journal 431.

•

Collective actions create opportunities for cross-disciplinary and cross-jurisdictional collaborations between different CSOs and other institutional stakeholders.

33

ALTERNATIVE Q QUASI-JUDICIAL PATHWAYS: DPA & DSA MECHANISMS

PATHWAYS TO JUSTICE TOOLKIT

PART 5

Besides private enforcement through national courts, both the GDPR and the Digital Services Act (DSA) provide quasi-judicial pathways to enforce their provisions and the fundamental rights that underpin them. Data Protection Authorities (DPAs) are the specialised national authorities primarily responsible for managing complaints and ensuring the enforcement of the GDPR. In contrast, the DSA designates the European Commission as its primary public enforcer. However, the DSA also establishes a multilayered private enforcement framework of quasi-judicial mechanisms. This includes the option to file complaints with Digital Service Coordinators (DSCs), the national authorities tasked with privately enforcing the DSA. Additionally, the DSA provides for non-binding out-of-court dispute resolution through specialised bodies certified by DSCs, as well as direct engagement with digital platforms via their internal complaint-handling systems.

ENFORCING THE EU CHARTER RIGHTS THROUGH DATA PROTECTION AUTHORITIES (DPAs) DPAs are independent public authorities responsible for overseeing the enforcement of the GDPR and national data protection laws in each Member State. As such, they are a primary pathway

fundamental rights, as recognised in Article 1(2) of the GDPR.55

Many provisions throughout the GDPR further reinforce the fundamental rights enshrined in the Charter. For example, the additional protections for special categories of personal data under Article 9 of the GDPR can be instrumental in protecting Charter rights such as freedom of thought, conscience, and religion under Article 10,

to seek the enforcement not only of the right to protection of personal data under Article 8 of the Charter, but all other interconnected and interdependent

PART 5

55 This is mirrored in Recital 4, which goes into further detail explicitly recognising that the GDPR observes the freedoms and principles recognised in the Charter, mentioning the respect for private and family life, home and communications (Article 7), freedom of thought, conscience and religion (Article 10), freedom of expression and information (Article 11), freedom to conduct a business (Article 16), the right to an effective remedy and to a fair trial (Article 47), and cultural, religious and linguistic diversity (Article 22).

35

the right to non-discrimination under Article

Article 8(3) of the Charter explicitly

21, and the right of collective bargaining and

establishes that the compliance control

action under Article 28, among others.56

carried out by DPAs is an integral part of

Under Article 77, data subjects have the

the right to data protection. This has been

right to lodge a complaint with a DPA for

Scholars have also recognised this interplay

further developed by Articles 51 to 59 of

infringements of the GDPR in the Member

between the GDPR and other fundamental

the GDPR, which ensure the

State of their habitual residence, their

rights. The right to data protection is seen

independence of DPAs and set out their

place of work, or the place of the alleged

as an enabler of other fundamental rights

competence, tasks, and powers.

infringement. The DPA must in turn inform

or as a precondition to exercising them,57

and enforcement actions.

the complainant of both the progress and

and the GDPR itself is described as a ‘multi-

In general, each member state is

the outcome of the complaint, as well as

functional’ framework for the protection of

responsible for overseeing compliance

the possibility to appeal its decision before

other fundamental rights.58 The right

within its own territory, as established

a court under Article 78. The availability of

to protection of personal data under Article

in Article 55 of the GDPR. However, the

recourse to the courts reaffirms the right

8 of the Charter, in conjunction with the

GDPR contains an exception for cross-

to an effective remedy and a fair trial under

GDPR and national laws regulating personal

border data processing in the form of

Article 47 of the Charter.

data, remains the main avenue for seeking

a ‘one-stop-shop’ mechanism under

enforcement of Charter rights through

Article 56. In such cases, the supervisory

Lastly, Article 79 of the GDPR gives data

a DPA.

authority of the Member State where the

subjects the right to bring legal action

company’s sole or main establishment59

before national courts against data

is located becomes the ‘lead supervisory

controllers or processors if their rights

authority’ (LSA). The LSA is required

under the GDPR are infringed, further

under Article 60 to cooperate and share

reaffirming the aforementioned

information with the other relevant or

fundamental right to an effective remedy.

‘concerned supervisory authorities’ in

However, while the option to seek judicial

order to reach a consensus on decisions

remedies exists, DPAs offer a series of

56 Other examples could be: the provisions on data processing for journalistic, academic, artistic or literary purposes in Article 85, which reconcile data protection with the right to freedom of expression and information under Article 11 of the Charter; or provisions such as Article 88, which establish that Member States can provide, either by law or by collective agreements, more specific rules to ensure fundamental rights protections for the processing of employees’ personal data in the context of employment, which aligns with the right of collective bargaining and action under Article 28 of the Charter.

57 ‘Article 1 GDPR’ (GDPR Hub, 14 March 2024) <https:// gdprhub.eu/Article_1_GDPR> accessed 14 October 2024.

58 This can be illustrated, for example, by examining how the right to data protection can serve as a tool to counter the effects of online harassment and its impact on human dignity, integrity and freedom of expression under Articles 1, 3, and 11 of the Charter respectively, or automated decision-making and its impact on non-discrimination under Article 21 of the Charter. See Florence D’Ath, ‘The General Data Protection Regulation: A Multi-Functional Framework for the Defence of the Rights and Freedoms of Data Subjects in the Digital Sphere’ (Dissertation to obtain the degree of Doctor in Law, University of Luxembourg/Maastricht University 2023) <https://orbilu.uni.lu/bitstream/10993/60043/1/Thesis%20 DATH%20Florence.pdf> accessed 3 October 2024.

59 The European Data Protection Board has recently issued an opinion on the notion of main establishment of a controller under Article 4(16)(a) GDPR, and on the criteria for the application of the one-stop-shop mechanism.

It concluded that a controller’s ‘place of central administration’ can be considered as a main establishment only if it takes the decisions on the purposes and means of the processing of personal data and it has power to have these decisions implemented. It also reiterated that the burden of proof falls on controllers in relation to the place where the relevant processing decisions are taken and where there is the power to implement them. See European Data Protection Board, ‘Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR’ (2024) <https://www.edpb.europa.eu/system/files/2024-02/edpb_opinion_202404_mainestablishment_en.pdf> accessed 14 October 2024.

advantages as a pathway to seek the enforcement of data protection and adjacent Charter rights.

37

CASE STUDY

After receiving complaints from various data subjects, the Dutch DPA (Autoriteit Persoonsgegevens, AP) launched an investigation into Clearview AI. Clearview AI offers facial recognition services that allow law enforcement to search a database of over 30 billion images of individuals (including EU/EEA citizens) scraped from the internet and social media platforms. The company uses algorithms to convert these images into biometric data by creating vectors for facial recognition.

This case followed a series of coordinated enforcement actions against Clearview AI across several jurisdictions in Europe, as well as campaigning efforts against facial recognition amongst the European digital rights community.

The AP found that Clearview AI had collected the sensitive personal data of Dutch citizens without a legal basis. It issued a fine of EUR 30,5 million and ordered the deletion of the data. The AP’s decision centred fundamental rights considerations to assess Clearview AI’s reliance on legitimate interest as a legal basis for its data processing activities. In doing so, it applied the three-part test established by CJEU case law (purpose, necessity, and balancing).

CLEARVIEW AI NETHERLANDS

The AP determined that Clearview AI’s only interest lay in the necessity of processing personal data in order to conduct a business. The AP stated that ‘such freedom does not extend so far as to cover activities that almost fully coincide with infringing the fundamental rights of others’ and that such an interest did not constitute a legitimate interest and valid legal basis. The AP also determined that Clearview AI’s data processing violated the principle of data minimisation as it was not limited to what was strictly necessary. The AP considered the vast amount of personal data Clearview AI collects from the internet and the lack of a defined retention period or geographical restrictions.

Furthermore, the AP concluded that the indiscriminate mass processing of biometric data constituted a very grave infringement of data subjects’ fundamental rights, significantly outweighing any potential interest Clearview AI might have in processing the data for its commercial activities.

This finding confirmed the AP’s initial assessment and the rejection of the

ANALYSIS DPAs are experts in data protection

However, there are also some downsides

laws and are well-equipped to

to seeking enforcement of Charter rights

adequately interpret, apply, and

by lodging complains with DPAs. Due

enforce data protection and privacy

precisely to their specialisation in data

rights. They also have dedicated staff

protection, they might have limited legal

trained in data protection laws, which

purview or expertise to address other

can speed up investigations and

fundamental rights under the Charter.

decisions compared to general courts,

Furthermore, many DPAs are underfunded

where data protection is just one of a

and understaffed, which can lead to delayed

myriad of legal issues handled.

investigations and enforcement actions.60

DPAs also tend to have simple processes

DPAs have expressed concerns that new

in place for filing a complaint, typically

EU legislation will significantly increase

involving filling out a form or an online

their workload and responsibilities, without

submission. Filing a complaint with a

providing additional resources. The new

DPA is usually free or involves minimal

legislation will require them to oversee new

administrative fees, and individuals

large-scale IT systems61 and carry out new

do not need to be represented by a

supervisory duties related to AI technologies

lawyer. By contrast, court proceedings

following the successive implementation of

often involve significant legal fees for

the AI Act.

filing, legal representation, and court costs. DPAs can provide guidance and mediation between the data subject and the processor, with the aim of resolving disputes that might not require escalation. DPAs also have significant investigatory and sanctioning powers, are able to impose hefty fines, and can order measures to force processors into compliance.

60 For example, a recent report by the EU Agency for Fundamental Rights found that inadequate resources risk undermining the implementation of DPAs’ mandate and independence because DPAs find themselves overburdened and dealing with increasing numbers of complaints, which often times does not allow them to provide comprehensive oversight and start their own ex officio investigations. See European Union Agency for Fundamental Rights, ‘GDPR in practice – Experiences of data protection authorities’ (2024) <https://fra.europa.eu/en/publication/2024/gdpr-experiences-data-protection-authorities> accessed 14 October 2024.

61 For example, the Entry/Exit System for border control: ‘Entry/Exit System’ (European Commission, 9 October 2024) <https://home-affairs.ec.europa.eu/policies/schengen-borders-and-visa/smart-borders/entry-exit-system_en> accessed 14 October 2024.

notion of legitimate interest as a valid legal basis.

39

Furthermore, DPAs across Europe vary

a pathway to enforce data protection

significantly in their approaches to

laws and Charter rights more broadly.64

enforcement. For example, the French Commission nationale de l’informatique

TAKEAWAY AND RECOMMENDATIONS Despite the challenges and obstacles to

et des libertés (CNIL) is known for taking a

consistently enforcing data protection

proactive and strict stance towards Big

laws across EU Member States, DPAs

Tech companies. This contrasts with

frequently integrate fundamental rights

Ireland’s Data Protection Commission,

considerations into their decisions, serving

which oversees many major Big Tech cases

as a vital and accessible means to uphold

due to the companies’ EU headquarters

these rights in relation to data protection.

being in Ireland, and which has been

However, due to the varying approaches

criticised for taking a more cautious

and capacities of DPAs in different

approach, particularly in high-profile

jurisdictions, careful legal research and

cases. Another example is Germany’s

strategic planning are necessary to

decentralised system of state-level

determine their suitability for a given case.

DPAs, which leads to significant regional

to address other fundamental rights under the Charter.

• Consider the potential delays to investigations and enforcement actions in a given jurisdiction, especially since many DPAs are underfunded

differences in enforcement.

and understaffed.

• You can file a complaint

In general, the lack of harmonised procedures and the legal uncertainty62

with a national DPA free

have resulted in inefficient and patchwork

of charge or with minimal

enforcement of the GDPR so far.63 However, it’s possible that the upcoming GDPR

administrative fees; there is

procedural regulation might be a step in the

no need for individuals to

right direction towards overcoming these obstacles and may enhance DPAs’ role as 62 Data Protection Law Scholars Network and Access Now, ‘The Right to Lodge a Data Protection Complaint: OK, but then what? An empirical study of current practices under the GDPR’ (2022) <https://cadmus.eui.eu/bitstream/ handle/1814/74899/The_right_to_lodge_a_data_protection_ complaint_2022.pdf?sequence=1&isAllowed=y> accessed 14 October 2024.

63 ‘Data Protection Day: Are Europeans really protected?’ (noyb, 27 January 2023) <https://noyb.eu/en/data-protection-day-are-europeans-really-protected> accessed 14 October 2024. See also Irish Council for Civil Liberties, ‘Europe’s enforcement paralysis: ICCL’s 2021 report on the enforcement capacity of data protection authorities’ (2021) <https://www.iccl.ie/digital-data/2021-gdpr-report/> accessed 14 October 2024.

be represented by a lawyer.

• DPAs are specialised in data protection, so they might have limited legal 64 ‘Analysis: GDPR Procedural Regulation enters critical phase’ (noyb, 16 July 2024) <https://noyb. eu/en/analysis-gdpr-procedural-regulation-enters-critical-phase> accessed 14 October 2024.

purview or expertise

41

ENFORCING THE EU CHARTER OF FUNDAMENTAL RIGHTS THROUGH THE DIGITAL SERVICES ACT (DSA) Big Tech platforms exert substantial control

In this context, the DSA offers a novel

One of the key mechanisms introduced

Although the DSA is now fully in effect,

over online public discourse through their

multi-layered mix of public and private

by Article 20 of the DSA is the internal

many questions remain regarding its

content moderation systems. Inconsistent

enforcement mechanisms, amongst

complaint-handling systems for dealing

enforcement.68 So far, most actions have

enforcement driven by arbitrary terms and

which are a series of private enforcement

with complaints against content

been led by the Commission, and it remains

conditions, vague policies and guidelines,

pathways to address freedom of expression

moderation decisions. Article 21 of the

to be seen how private enforcement and

and an overreliance on automation, are

and other Charter rights issues.

DSA entitles users to challenge these

the case law around it will unfold.69 For

types of decisions by platforms (including

this reason, we have chosen to propose a hypothetical case study in this section.

among the many flaws which have been noted in these systems.65 These flaws often

One of the DSA’s overarching aims is

the outcomes of the aforementioned

result in the suppression and censorship of

precisely to set out harmonised rules for

internal complaint-handling procedures)

important public interest speech,66 while at

a safe, predictable, and trusted online

through any of the out-of-court dispute

the same time allowing disinformation, hate

environment in which Charter rights

settlement bodies certified by Member

speech, and harmful content to spread,67

are effectively observed. Moreover,

States’ DSCs. Additionally, this provision

all of which has a disproportionate effect on

Article 14 imposes a specific obligation

states that users are entitled to initiate

marginalised groups.

on platforms to apply and enforce their

proceedings to challenge the platform’s

terms and conditions with due regard to

content moderation decisions before a

users’ freedom of expression, freedom

national court at any stage, regardless of

and pluralism of the media, and other

their engagement with these out-of-court

fundamental rights as enshrined in the

dispute settlement mechanisms.

65 João Pedro Quintais, Naomi Appelman, and Ronan Ó Fathaigh, ‘Using Terms and Conditions to apply Fundamental Rights to Content Moderation’ (2023) 24(5) German Law Journal 881.

66 Among many examples, one that stands out in particular is the suppression of pro-Palestinian voices in the context of the ongoing mass atrocities currently taking place in the region. See ‘Meta’s Broken Promises - Systemic Censorship of Palestine Content on Instagram and Facebook’ (Human Rights Watch, 21 December 2023) <https://www.hrw.org/ report/2023/12/21/metas-broken-promises/systemic-censorship-palestine-content-instagram-and> accessed 14 October 2024.

67 Amongst the most notable cases is Meta’s admittedly substantial role in fuelling the ethnic cleansing suffered by the Rohingya people in Myanmar. See Amnesty International, ‘The Social Atrocity, Meta and the Right to Remedy for the Rohingya’ (2022) <https://www.amnesty.org/en/documents/ASA16/5933/2022/en/> accessed 14 October 2024.

Charter. The ‘notice and action mechanism’ for illegal content under Article 16 identifies

Lastly, Article 53 of the DSA entitles users

the conditions for platforms’ liability for

to lodge complaints with DSCs, which are

the content hosted on their sites. Once the

the national regulatory bodies tasked with

platform has decided on the notice, users

overseeing the application of the DSA and

then have a series of options to seek redress

ensuring compliance by platforms.

for these decisions.

68 Gaby Miller, ‘The Digital Services Act Is Fully In Effect, But Many Questions Remain’ (Tech Policy Press, 20 February 2024) <https://www.techpolicy.press/the-digital-services-actin-full-effect-questions-remain/> accessed 14 October 2024.

69 Although some private enforcement litigation decisions are beginning to emerge. See, for example, Paddy Leerssen, ‘The DSA’s first shadow banning case’ (DSA Observatory, 6 August 2024) <https://dsa-observatory.eu/2024/08/06/thedsas-first-shadow-banning-case/> accessed 14 October 2024.

43

CASE STUDY

This case study envisions a situation where a video uploaded on Facebook by a user from an EU Member State depicting a military intervention and apparent human rights violations on another continent is removed by the platform.

The removed content contained graphic scenes of military violence deliberately targeting what appear to be civilians. The content further contained solidarity and resistance slogans in the local language of where the atrocities took place, and details regarding an upcoming protest in the EU Member State organised to apply political pressure in support of economic sanctions against the oppressive military regime.

Under the DSA, the user could engage with Meta’s internal complaint-handling system, requesting that the platform reinstate the content on the basis that it did not violate Meta’s violent and graphic content policy or its violence and incitement policy.

Furthermore, the user could leverage Article 14(4) of the DSA and argue that the platform must apply its terms and conditions with due regard to their fundamental rights.

In particular, the user could argue that their freedom of expression and information under

ARMED CONFLICT CONTENT REMOVAL

Article 11 of the EU Charter has been infringed, and that the restriction to their speech would not pass the three-part test established in human rights law. Furthermore, the user could claim an infringement of their freedom of assembly and of association under Article 12 of the Charter, on the basis that they are an activist and the purpose of the content was to organise and promote a political protest.

Additionally, the user could claim that their right to non-discrimination under Article 21 of the Charter has been infringed, since the content did not include any incitement to violence or hateful content. The video did include slogans in a minority language which have been used by many resistance movements in the country in question, and therefore the removal might have been discriminatory based on either algorithmic bias or a content moderation decision that lacked contextual and cultural awareness.

Based on the outcome of the internal complaint-handling system, the user could consider beginning an out-of-court dispute settlement procedure with a specialised body or lodging a complaint with a DSC. Seeking redress in the courts would not be a priority in this type of case, given the time-sensitive nature of the issue and the main focus being the reinstatement of the content.

45

ANALYSIS The set of multi-layered pathways

efficiently, and cost-effectively with clear

provided by the DSA offers many

and fair procedural rules that are easily

substantial benefits for the protection of

and publicly accessible. While these out-of-

fundamental rights in the online context.

court settlements are not legally binding,

An evident advantage is how accessible,

platforms must engage with the procedures

cost effective, and expedient some of

in good faith, and they therefore remain a

these pathways can be for users seeking

viable option for users to seek redress for

to address potential infringements of their

Charter rights violations.

rights by social media platforms.

It should be noted that research shows that For example, under Article 20 of the DSA,

the majority of people who suffer online

platforms’ internal complaint-handling

harms do not take action. This is partly

procedures must be easily accessible online,

because they may have little confidence in

user-friendly, and free of charge. Depending

a fair judgement, and partly because they

on the issue, its urgency, and the type of

may be pursuing outcomes beyond the

remedy sought, this direct pathway to

content moderation decision itself, such as

engage with the platforms themselves

uncovering or punishing a perpetrator.70

could in many instances be the most

Moreover, the effect on the protection of

efficient way to address the fundamental

marginalised groups will largely depend on

rights infringement, in particular because

which organisations receive certification to

it does not preclude leveraging other

conduct these out-of-court procedures, and

pathways as well.

the scope of their expertise.71 Experts have pointed out that the selection of specific

Similarly, under Article 21 of the DSA, out-

authorities and the scope of their expertise

of-court procedures must also be clear,

may significantly impact access to justice

user-friendly, and easily accessible on

through this particular pathway.72

the platforms’ interfaces. This provision also establishes that the bodies carrying out these procedures must be impartial and independent, have the necessary expertise related to the contested issue, and be able to settle the disputes swiftly,

70 Anna van Duin, Naomi Appelman, Brahim Zarouali, and Max Kosian, ‘Harmful Content and Access to Justice on Online Platforms: An Empirical Study on the Experiences and Needs of Victims’ (2023) Amsterdam Law School Research Paper No. 2023-19 <https://ssrn.com/abstract=4456769> accessed 3 October 2024.

71 Pietro Ortolani, ‘If You Build It, They Will Come. The DSA’s “Procedure Before Substance” Approach’ (Verfassungblog, 7 November 2022) <https://verfassungsblog.de/dsabuild-it/> accessed 3 October 2024 72 Ortolani, ibid.

Another aspect of the DSA worth noting is

Another benefit provided by the DSA in

that it does not explicitly create a private

terms of redress for fundamental rights

right of action or enforceable substantive

infringements is the right that Article 54

rights. Therefore, complaints before DSCs

confers on users to seek compensation from

under Article 53 will most likely relate

platforms and digital service providers for

to either procedural rules or other due

any harm or loss incurred as a result of a

diligence obligations imposed by the DSA,

failure to comply with the DSA’s provisions.

which could in turn be linked to violations

This compensation must be in accordance

of individuals’ fundamental rights and

with EU and national laws.76

therefore offer a viable pathway to enforce them.73 However, Article 53 of the DSA, in

The DSA envisions the option for collective

conjunction with the obligations platforms

redress under the Representative Actions

have under Article 14 to apply and enforce

Directive, which significantly enhances

their terms and conditions with due regard

individuals’ right to seek redress by

to users’ Charter rights, could actually be

reducing the burden of pursuing claims

constructed as a separate private right

individually when harms have a collective

of action before DSCs. This would give

dimension. Furthermore, whether

fundamental rights an indirect horizontal

individually or collectively, users are entitled

effect in the relationship between online

to authorise a non-profit organisation or

platforms and their users.74 However,

association to exercise their rights under

given the absence of detailed guidance

the DSA on their behalf. This will gain

on Article 53 and its interaction with other

additional importance if the organisations

DSA provisions, and the current lack of

representing users are ‘trusted flaggers’

precedent on how DSCs will interpret and

under Article 22 of the DSA. In recognition

act upon their competence and powers

of their expertise, platforms have the

under the DSA, this remains to be seen.75

obligation to handle complaints by trusted flaggers more expeditiously,

73 For instance, when the reasons behind a content removal decision are not provided, or information regarding the appeal mechanisms for this decision is not given, it might be possible to make the case that this failure constitutes an unjustified infringement with an individual’s freedom of expression, and potentially serve as the basis for a separate cause of action. See Bengi Zeybek, Joris van Hoboken, and Ilaria Buri, ‘Redressing Infringements of Individuals’ Rights Under the Digital Services Act’ (DSA Observatory Analysis, 4 May 2022) <https://dsa-observatory.eu/2022/05/04/ redressing-infringements-of-individuals-rights-under-thedigital-services-act/> accessed 3 October 2024.

74 Quintais and others (n 72).

75 Zeybek and others (n 84).

and the privileges trusted flaggers are awarded under the DSA in general should be conducive to increased fundamental rights protections.

76 As set out by Recital 121, compensation should not only align with the applicable national law’s rules and procedures, but it should also apply without precluding other avenues for redress available under consumer protection regulations.

47

However, the fact that the DSA allows law enforcement agencies, including Europol, as

•

well as profit-seeking industry organisations to apply for this status raises wider concerns around the ‘trusted flagger’ figure itself and how it might facilitate enforcement overreach. Moreover, in the context of Member States with more repressive regimes, the weaponisation of ‘trusted

•

flaggers’ could also pose a serious threat to fundamental rights, especially when it comes to marginalised groups.

TAKEAWAY AND RECOMMENDATIONS The DSA offers a novel and promising multi-level approach to enforcing EU Charter rights, encompassing both platform-based and external mechanisms to safeguard users’ rights. However, while the DSA does also leave the window

•

This is a new legal framework and the processes it lays out are mostly untested. Make sure that the people affected are onboard with the lack of certainty in the pathways you suggest.

Depending on the urgency of the issue at hand and the type of remedy sought, the direct pathway of engaging with the platforms themselves could be an efficient way to address a fundamental rights violation because it does not preclude leveraging other pathways as well.

To maximise the impact of a collective claim, you can combine this pathway with a representative action.

O CONCLUSION

open for other judicial remedies, research reveals a significant mismatch between existing pathways and effective access to justice for those affected by harmful online content. This raises considerable concerns around digital due process in this context.

49

PATHWAYS TO JUSTICE TOOLKIT

CONCLUSION

This Pathways to Justice Toolkit was designed to support and guide you as you embark on your litigation strategy building. It shone a light on the complex matrix of decision-making processes in the different pathways that are available for enforcing the EU Charter.

While our choice was to guide you in

Toolkit, we believe that strategic litigation

the judicial and quasi-judicial pathways

is a process that lasts beyond the duration

to justice for better fundamental rights

of the litigation procedures. The impact

enforcement and protection in the digital

of a strategic litigation case is decided

realm, we acknowledge that no strategic

in a context much larger than that of a

litigation can operate in a vacuum. The

courtroom. The preparation of a good legal

broader strategy is a constant negotiation

argument that carefully considers the

between the applicants’ objectives, legal

procedural norms of the jurisdiction and

realities at hand, timing, costs, risks, and

forum at hand are naturally key to

ultimately, luck.

a successful decision. However, the impact of a successful decision is determined both

We are convinced that maintaining a

before the court application is submitted

dialogue with the applicants affected by the

and after the court decision is published.

fundamental rights violations–whether they are individuals, communities, organisations,

With this toolkit, we have presented five

or collectives–is necessary for ensuring that

different pathways, some of which can be

you will follow a pathway to justice that will

efficiently combined for impact. We hope

lead to impactful changes for all.

that these guidelines and recommendations become a helpful tool to contribute to your

Justice is not achieved by judicial and

case-building and strategizing.

quasi-judicial pathways alone. The value of these pathways is only properly revealed

We hope that this toolkit will lead to a better

when seen in conjunction with broader

understanding of EU Charter pathways,

movement-building strategies, advocacy,

ensuring that fundamental rights are

communication, and storytelling efforts. As

respected in the digital realm, and ultimately

revealed by the DFF’s Strategic Litigation

contribute to justice for all.

51

Systemic and transformative change happens when impacted people act and collaborate with others to build power to challenge the root of their oppression. With this toolkit, we collate and present information, strategies, and best practices designed to protect the EU Charter of Fundamental Rights (EU Charter / the Charter) in the digital sphere through strategic litigation.

Many of the case studies presented in this toolkit address direct harms and highlight the impact of fundamental rights violations resulting from invasive techno-social systems.

Creating a corpus of texts highlighting litigation pathways built on the link between fundamental rights and digital rights is ultimately an attempt to address the legacy of power in the context of digital technologies.

digitalfreedomfund.org

52