Civil society and the legality of public administration: the Google case

Civil society often turns to the courts to bring cases against the state in order to guarantee our rights. But what happens when it is civil society that wants to support the legality of the actions of the public administration in defense of its rights against private corporations?

 Let’s focus on a specific example: In September 2020, the Colombian Superintendency of Industry and Commerce (hereinafter SIC), considering that Google had failed to comply with the provisions of the Colombian Data Protection Law, ordered Google to implement appropriate, effective, and demonstrable mechanisms or procedures to guarantee the data protection rights of Colombians, especially minors. 

 In response to this decision, Google sued the SIC, requesting the administrative court to declare these decisions null and void. In this ongoing case, the plaintiff is Google and the defendant is the SIC, and the subject of the dispute is to determine whether the latter’s decisions are valid or not. What did Google allege? That the SIC did not have the authority to make these decisions. According to Google, they are not a Colombian company, nor are they based in Colombia; there is no international, bilateral, or multilateral treaty that empowers the Colombian data authority to control them; and the data processing they do occurs in the United States, not in Colombia. 

On the contrary, the SIC argues that, under Colombian law, it has jurisdiction to judge compliance with the Data Protection Law, since the data processing takes place in Colombia. The law expressly states that one form of data processing is collection, and this occurs in Colombia, if one takes into account how cookies work and the type of data that Google collects. 

 Thus, the controversy focuses mainly on two aspects: Is the SIC competent to take action against Google regarding compliance with the Colombian Data Protection Law? And is the Colombian Data Protection Law applicable to Google’s processing of data from Colombians who are in the country? This controversy is clearly of interest to Colombian civil society, as it depends on these aspects to guarantee its rights to personal data protection vis-à-vis a technology company such as Google. 

 In this context, is it possible for members of civil society to intervene in these proceedings in favor of the administrative authority’s decision? Although the answer should be clear, it is not entirely so. 

Read another article from the latest edition of El Sur Global: Catatumbo: humanitarian crisis and internal unrest

What mechanisms can be used to enable civil society to intervene in this type of process? In the Colombian case, there are two mechanisms: co-adjudication and amicus curiae. In the case of co-adjudication, civil society intervenes as a third party supporting one of the parties, with the same powers as them (with a few restrictions) and linked to the process. In the case of amicus curiae, judges are provided with an expert opinion on the issue under debate, but it does not act as a third party supporting one of the parties, nor does it have similar powers, and it is not bound to the process. Co-adjudication is regulated by law, while amicus curiae is based on case law in Colombia. 

 It is clear that civil society can submit an amicus curiae brief in this type of case, but because it is not regulated by law and is an opinion that seeks to enrich the judicial debate, it is at the discretion of the judges to decide how much attention to give to this type of brief. However, the question remains: Can civil society assist an entity such as the SIC in this type of case? Although it seems clear to us that the answer should be yes, some dispute this interpretation.

 In cases such as Google’s, only “persons with a direct interest” in the case can be interveners, as it is a process of nullity and restoration of rights (in which the invalidity of a decision is sought and the damage caused is to be restored).

 As a civil society organization, Dejusticia has requested to be considered as an intervening party in the Google v. SIC case. As might be expected, Google has argued that we do not have a “direct interest” in the case in order to oppose our intervention. This raises the question: how should direct interest be interpreted in order to be an intervening party in this type of case?

 Some believe that it should be interpreted in the same way as civil proceedings. In Colombia, in civil proceedings, those who have “a substantial relationship with one of the parties to which the legal effects of the judgment do not extend, but which may be affected if that party is defeated (…)” may be interveners. Although it sounds technical, it can be easily understood: as a general rule, creditors can assist their debtors (if Juan owes me a sum of money and he is sued, I can assist Juan, even if the judge does not decide on what Juan owes me, since there is a “substantial relationship between us to which the legal effects of the judgment do not extend”). 

 In this sense, some consider that the “direct interest” in order to be able to assist one of the parties in the Google case should be interpreted as meaning “that there is a legal relationship with one of the parties that may be affected.” However, this interpretation ignores the dual dimension of this type of case: it only sees the private interest, but does not recognize the public interest that is at stake. 

 In the case against Google, we defended something that seems obvious but is sometimes lost in legal technicalities: supporting a company that defends private interests is not the same as supporting a public authority whose task is to protect people’s rights. That is why we insist that, when the discussion touches on issues that affect millions of users, the voice of civil society cannot be left out.

 We also question the idea of “direct interest,” under its civil law interpretation, according to which only those who have a close legal relationship with one of the parties can participate. In the digital world, this is insufficient. After all, what relationship could be more direct than being everyday users of Google’s services, from email to the documents we use for work or study?

 But there is something deeper: citizens have a legitimate interest in ensuring that decisions like this stand, because they confirm that Colombian legislation and the data protection authority can defend us against tech giants. And in a digital ecosystem where power is increasingly concentrated, ensuring that counterbalance is not a technical detail: it is a democratic necessity. This is especially true when companies like Google are increasingly being sanctioned internationally for violating fundamental rights such as personal data protection. Some examples: the US Federal Trade Commission (FTC) cases against Google in 2012 and 2019, the Joffe v. Google Inc. case in 2013, and the European Court of Justice cases Google Spain v. the Spanish Data Protection Agency in 2014 and Google LLC v. CNIL in 2019. 

 We are currently witnessing an economy with data-based business models, and legal disputes between large international companies and states over the level of compliance with data protection laws are becoming increasingly frequent. It is therefore clearly in the interest of civil society to take active steps to guarantee these rights in the face of large international corporations.