The emergence of data protection as a legally recognised EU fundamental right, which began with its identification in Article 8 of the EU Charter of 2000 and was consolidated in the granting of this right treaty status in 2009, will undoubtedly come to be recognised as one of the most central developments in EU data protection since its genesis in the 1990s. It is true that Court of Justice of the European Union (CJEU) jurisprudence has often elided this new right with that of the more traditional right to privacy, especially as instantiated within the case law of the European Court of Human Rights (ECHR). Nevertheless, the role of data protection's separate status in structuring an increasingly autonomous EU perspective is increasingly apparent, not least in the recent case of C-131/12, Google Spain, Google Inc. v Agencia Española de Protección de Datos (AEPD), Mario Costeja González, EU:C:2014:317, which recognised the right of individuals in certain circumstances to require that search engines de-index public domain material relating to them. Moreover, the potential for such autonomy to lead to heightened tension with the ECHR is also ever more likely, especially following the CJEU's Opinion 2/13, EU:C:2014:2454, on the EU's proposed accession to the European Convention.
Although finalised before either of the above decisions were handed down, Fuster's impressive monograph seeks to explore an aspect of the EU data-protection architecture which is of clear and growing importance. Moreover, she shows herself far from unaware of the complexity of the relationship between data protection and more traditional fundamental rights notions such as the right to privacy. To the contrary, such complexity forms an essential part of her core argument that:
the surfacing in EU law of the fundamental right to the protection of personal data is best described as a series of legal operations of distinction and in-distinction. This means that notions such as “privacy”, “private life”, “data protection” and “personal data protection” have over the years sometimes functioned in EU law as distinct, different, and separate, whereas in some occasions they have worked as equal or at least equivalent, or in-differentiated (thus, not as the object of any distinction) (p. 254).
It is also clear that this process has not yet reached a fully coherent or settled conclusion. In sum:
Article 8 of the Charter marked a key step in the emergence of the right to personal data protection in EU law, but cannot be regarded as amounting by itself to the culmination of a process of recognition, or of integration into EU law. Such a process is a matter of fact still on-going, and its outcome is dependent on the constant reading and re-writing of Article 8 of the Charter both in EU positive law, and in the EU Court of Justice's case law (pp. 260–61).
In effect, what Fuster offers us is the historical prelude to a legal concept – data protection as an EU fundamental right – which will clearly be of central importance in the future.
The book is structured into two parts. Part One comprises three chapters primarily exploring developments which, whilst external to the EU, nevertheless played an important role in the genesis of data-protection provisions within EU law itself. Thus, Chapter Two explores the meaning ascribed to the term “privacy” and how this evolved with the advent of computerisation, Chapter Three examines the emergence of national data-protection law within Europe during the 1970s, whilst Chapter Four focuses on early transnational data-protection and privacy instruments including the Council of Europe's Privacy Recommendations of 1973 and 1974, the OECD Privacy Guidelines of 1980, and the Council of Europe's Data Protection Convention of 1981. Part Two includes a further four chapters which more explicitly explore the development of EU law itself. Chapter Five elucidates a history of the EU's involvement in data protection up to 2000 (naturally focusing on the drafting of the EU Data Protection Directive 95/46), Chapter Six investigates the inscription of data protection as an EU fundamental right, whilst Chapter Seven explores the materialisation of this right both in CJEU case law and in the legislative package for a renewed EU data-protection framework presented by the European Commission in 2012. Finally, Chapter Eight offers some conclusions.
In essence, Fuster's book provides a compendious elucidation of the history of European data protection generally, albeit one which specifically emphasises data protection's pathway to the status of an EU fundamental right. Such a comprehensive perspective in a medium-length monograph will undoubtedly be of enormous benefit to both researchers and advanced students of data protection. This approach, however, does mean that the work's specific focus is sometimes somewhat lost sight of. Certainly, Chapter Six does include a valuable and clear consideration of the process which led up to the inclusion, and drafting, of the data-protection clause in the EU Charter. This chapter also considers the relationship between this and existing national rights traditions, the groundwork for which is also partially laid out as an aspect of Chapter Three. Despite this, there could have been more detailed emphasis on why and how many EU member states (and candidate countries) had included data protection as a separate right within their national constitutions even prior to 2000, whilst others had rejected this. Such discussion would have helped fill out our understanding of the extent of both continuity and change represented by the recognition of data protection as a fundamental right by the EU itself. Despite the almost encyclopaedic nature of the book, it surprisingly does not feature traditional finding aids such as an index, list of cases, and list of legislation.
Notwithstanding these limitations, however, the value of Fuster's work should not be underestimated. It tackles an extremely important issue, is meticulously researched, and is genuinely thought-provoking and enlightening. It will constitute an essential point of reference in the growing field of data-protection scholarship for many years to come.
