After Google Spain and Charlie Hebdo : The Continuing Evolution of European Union Data Privacy Law in a Time of Change

This article investigates various developments over that year that helped (or are helping) reshape European Union data privacy law, building around two important events: the Court of Justice of the European Union's Google Spain decision, applying a form of a "right to be forgotten," and the Paris terrorist attacks on the satirical journal Charlie Hebdo in January 2015 after which additional security measures involving websites and surveillance in France were adopted and advances on an EU directive on PNR data were made. The EU member state court decisions that came in the wake of the Google Spain decision and that give a right to individuals in the EU to have certain search engine results delisted, which raise issues for Internet search engines, publishers of information, and potentially other Internet intermediaries, are discussed, as are Google’s attempts to come to terms with the Google Spain decision. In addition, this article covers the continuing EU member state data protection agency enforcement action on Google's privacy policy, that were detailed in the author’s prior article – "European Data Privacy Law Developments," with lessons being drawn for businesses regarding privacy policies and data protection compliance generally. The surveillance measures discussed apply to electronic and other communication methods and introduce possibilities in France for mass data collection. Thus, the French legislation adopted in part in reaction to terrorist attacks, described by some as analog to the U.S. Patriot Act – evidences modifications related to security affecting the business legal environment for internet and telecommunications companies and others. Similarly, EU efforts to allow greater passenger data sharing following the Charlie Hebdo attacks also show the continuing tension between data privacy – considered a fundamental right in the EU – and security. Finally, ongoing work on the European Union data protection law reform – which will apply to non-European companies offering goods or services to individuals in Europe or monitoring their behavior – is detailed