competitiveness with the rights of the data subjects. " Today ' s agreement is a major step towards a Digital Single Market. With solid common standards for data protection, people can be sure they are in control of their personal information. We should not see privacy and data protection as holding back economic activities. They are, in fact, an essential competitive advantage”, the Vice-President for the Digital Single Market affirmed 20.
It is worth recalling that, from the outset, in line with the objectives of the European Internal Market, the DPD sought to reconcile the protection of personal data( and the inherent right to privacy) with“ the free movement of data”( to use the DPD’ s wording). In reality, the DPD can be regarded as a step in a route whereby data protection principles and rights have been gradually rendered more flexible and open to exceptions. The DPD includes a catalogue of exceptions to the data protection principles, not found in the Council of Europe’ s Convention of 1981, and largely justified by the DPD’ s intent not to raise unjustified obstacles to the free movement of the data. This is especially clear in the case of the principle of consent 21. Article 7( b) to( f) DPD ultimately allows the processing of personal data on almost any ground, a door opened by exceptions provided by law to the“ legitimate interests pursued by the controller”. The only criterion offered for assessing the legitimacy of the interests is a balance between them and the“ interests and fundamental rights and freedoms” of the data subject, which is quite an evasive criterion. The balancing test is left to a case-by-case determination by the data controllers themselves, without any specific guidance( Zanfir, 2014, p. 237 ff) 22. This criterion is retaken in the GDPR 23.
In fact, the legitimate interest clause is the criterion upon which the majority of personal data processing takes place( Le Métayer, Monteleone, 2009, p. 136). Now, the way consent is devised seemingly provides a weaker protection for individuals, in the big data age, in the face of the wider power and autonomy of online operators to collect, process and apply personal data, as well as to judge, in the first instance, on how to balance their own interest and the rights to data protection 24. Moreover, one may reasonably doubt that data controllers have the necessary competency to undertake such a balancing test apart from being in a position of clear conflict of interest( Ferretti, 2012, p. 473). For instance, Google does not collect the unambiguous consent of data subjects and it relies on its legitimate interest to provide and improve services, develop new ones, and protect itself and its users. If broadly
20 http:// europa. eu / rapid / press-release _ IP-15-6321 _ en. htm( last accessed 18.03.2016).
21 Articles 2( c) and 7( a) DPD; Article 4( 8) GDPR. According to Article 7 DPD, personal data may be
processed only if the data subject has unambiguously given his consent, or processing is necessary for the performance of a contract to which the data subject is party, for compliance with a legal obligation to which the controller is subject, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject.
22 Article 29 Data Protection Working Party, Opinion 06 / 2014 on the Notion of Legitimate Interests of the
Data Controller under Article 7 of Directive 95 / 46 / EC. Available at: < http:// ec. europa. eu / justice / dataprotection / article-29 / documentation / opinion-recommendation / files / 2014 / wp217 _ en. pdf >( last accessed 18.03.2016).
23 Article 6( 1)( f) GDPR.
24“ Google and Facebook now have far more power over the privacy and free speech of most citizens than any king, president, or Supreme Court justice could hope for.”( Rosen, 2012, p. 1525 ff). See infra, section 4.
52