Authored By: Malachi Rees-Morny
University of Exeter
Introduction
The prolific rise of new technologies has fundamentally disrupted traditional mechanisms of human rights protection across Europe. At the epicentre of this disruption is Article 8 of the European Convention on Human Rights (ECHR), enabling the right to respect for private and family life as well as in homes and correspondence.[1] The legal conundrum now plaguing the ECtHR is how this provision can adapt to continue protecting human dignity against the dystopian reality of algorithmic decision-making, mass digital surveillance and the rise of transnational platform gatekeepers.
This article will explore Article 8’s relationship with the digital age, arguing that it is undergoing a stark evolution, shifting from a negative liberty into a foundational pillar of digital constitutionalism. This shift requires a proactive legal framework that works to protect informational privacy as well as decisional autonomy and the integrity of the digital persona (the collective representation of an individual existing solely within the digital setting). This article will follow three factors: 1. An analysis of the revolutionary shift toward digital constitutionalism, 2. A re-evaluation of decisional privacy, and 3. An examination of the threats to reputation that AI systems may perpetuate.
- The Paradigm Shift to Digital Constitutionalism
Academic discourse identifies three broad phases in the EU’s approach to emerging technology: 1. Digital liberalism, 2. Judicial activism, 3. The current era of digital constitutionalism.[2] During the initial phases of digital liberalism, regulatory focus was on protecting economic freedoms and fostering the internal market. These focuses were exemplified by the safe harbour liability exemptions for online intermediaries. Here, digital technologies were viewed moreso as vehicles for economic growth than arbitrary instruments of structural power. This was altered, however, through the unprecedented rise of platform power, which saw corporations perform quasi-public functions on a global scale, necessitating a more thorough constitutional perspective. As posited by De Gregorio, digital constitutionalism represents the articulation of principled limits to how power is exercised in a networked society.[3] As private online platforms have acquired what is essentially functional sovereignty, they have become the new arbiters of online speech and data. The ECtHR and the Court of Justice of the European Union (CJEU) have responded with judicial activism, which elevated fundamental rights over purely economic considerations.
This is most apparent in the horizontal application of Article 8, which imposes positive obligations on states to ensure that private entities respect the digital rights of individuals. In S and Marper v United Kingdom, it is confirmed that the retention of personal data by public authorities can itself constitute an interference with private life, even when tangible harm is absent.[4] This constitutional evolution is essential in the prevention of the rule of law being displaced by opaque and one-sided rules of online platforms.
- Second Wave Decisional Privacy
Modern privacy theory separates privacy into three forms: locational privacy, informational privacy and decisional privacy. Informational privacy refers to the control over one’s personal data, while decisional privacy concerns one’s rights to autonomous choices and self-governance regarding personal matters. Van der Sloot coined the phrase ‘Decisional Privacy 2.0’ in reference to what the digital age has constructed from the ordinary concept of privacy. This term encapsulates the movement beyond the mere right to be left alone, engaging a state obligation to facilitate the concept of individual decision-making itself.[5]
The ECtHR has progressively integrated these decisional elements into its jurisprudence, notably in the landmark Grand Chamber judgement in Bărbulescu v Romania. In this case, the Court held that an employer’s instructions could not reduce private social life in the workplace to zero, reinforcing the idea that individuals retain core Article 8 protections, even in spaces of high technological surveillance like the office.[6] The Grand Chamber found that Romania had failed to strike a fair balance between the interest of the employer (in monitoring communications within the work environment) and the employee’s right (to initiate private correspondence), a procedural failure akin to that which van der Sloot’s framework labels as a core vulnerability in the age of algorithms.
This procedural dimension is particularly significant in the context of profiling and automated decision-making. Building upon van der Sloot’s analysis, Article 8’s implicit procedural requirements, namely the rights to be informed, heard and to a reasoned decision, should be applicable to all data-driven processes to mitigate asymmetrical power dynamics between individuals and algorithmic systems. Without such procedural safeguards, the formal guarantee of privacy amounts to what is essentially a legal fiction.
- Protecting the Digital Persona
One significant dimension of Article 8’s private life protection is that of reputation, intrinsically linked to an individual’s social identity and self-perception.[7] However, the digital generation presents unprecedented threats to informational dignity through the unfettered circulation of misinformation, and English defamation law has faced significant challenges in responding to online forms of reputational harm. The Defamation Act 2013 introduced the serious harm threshold in section 1, which, in some respects, made it harder for claimants to seek rectification for online defamation.[8] In Banks v Cadwalladr [2022] EWCH 1417 (QB), the court’s careful application of section 1 illustrated both the utility and the limitation of this threshold in the era of social media.[9]
The rise of gen AI introduces a further threat: the AI hallucinations, where LLMs produce false statements about real individuals with unwarranted confidence. These anomalous falsehoods can seriously damage the social standing and psychological integrity of the affected individual. A growing notion in scholarly debate is that manufacturers and deployers of these AI tools should be held legally responsible for such outputs, both to compensate victims and to incentivise more careful development of these systems.
This makes way for Article 17. In certain circumstances, the right to erasure under Article 17 of the UK General Data Protection Regulation (GDPR) offers a far more accessible path to defamation litigation.[10] By focusing on the erasure of harmful data rather than the arduous process of proving reputational damage occurred, the right to erasure mitigates the snowballing of false information across platforms (also known as digital laundering), where false information is recycled from platform to platform until it acquires the guise of truth. A notable affirmation of this right’s strength can be seen in Hurbain v Belgium [2023], in which the Grand Chamber’s judgement demonstrates that the right to be forgotten can operate as a meaningful remedy against the permanent recording of harmful information.[11]
Conclusion
In conclusion, Article 8 ECHR is no longer merely a shield against physical intrusion but a cornerstone of digital constitutionalism, protecting the human personality against the trials of algorithmic decision-making. The shift towards digital constitutionalism reflects a necessary judicial response to asymmetric platform power dynamics and the systemic, self-reinforcing power of data-driven systems. The recognition of Decisional Privacy 2.0 and the integrity of the digital persona are vital elements in maintaining personal autonomy in an era driven by mass surveillance and AI.
It is recommended that future legislation work to codify the end-to-end safeguards identified by the Grand Chamber in Centrum for Rattvisa v Sweden [2021] ECHR 440, ensuring transparency and accountability are structurally embedded into systems where personal data flows.[12] Only by evolving from a negative right to a proactive constitutional framework can Article 8 continue to function as a meaningful guarantee of human dignity in the digital age.
Bibliography
Cases
Axel Springer AG v Germany (Judgment) [GC] ECtHR App No 39954/08 (7 February 2012)
Bărbulescu v Romania (Judgment) [GC] ECtHR App No 61496/08 (5 September 2017)
Banks v Cadwalladr [2022] EWHC 1417 (QB), [2022] EMLR 19
Centrum för Rättvisa v Sweden (Judgment) [GC] ECtHR App No 35252/08 (25 May 2021)
Hurbain v Belgium (Judgment) [GC] ECtHR App No 57292/16 (4 July 2023)
Lachaux v Independent Print Ltd [2019] UKSC 27, [2020] AC 612
Niemietz v Germany (Judgment) ECtHR App No 13710/88 (16 December 1992)
S and Marper v United Kingdom (Judgment) [GC] ECtHR App Nos 30562/04 and 30566/04 (4 December 2008)
Stocker v Stocker [2019] UKSC 17, [2020] AC 397
Von Hannover v Germany (Judgment) ECtHR App No 59320/00 (24 June 2004)
Legislation
Convention for the Protection of Human Rights and Fundamental Freedoms (opened for signature 4 November 1950, entered into force 3 September 1953) ETS No 5
Defamation Act 2013
Assimilated Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (‘UK GDPR’)
Secondary Sources
Brimblecombe F, Defamation in the Digital Age and the ‘Right to be Forgotten’ (Bristol University Press 2025)
De Gregorio G, ‘The Rise of Digital Constitutionalism in the European Union’ (2021) 19 I·CON 41
Gentile G, ‘Judicial Protection of Fundamental Rights on the Internet: A Road Towards Digital Constitutionalism?’ (2022) 30 IJLIT 507 (book review)
Van der Sloot B, ‘Decisional Privacy 2.0: The Procedural Requirements Implicit in Article 8 ECHR and Its Potential Impact on Profiling’ (2017) 7(3) International Data Privacy Law 190
[1] Convention for the Protection of Human Rights and Fundamental Freedoms (opened for signature 4 November 1950, entered into force 3 September 1953) ETS No 5 (‘ECHR’), art 8.
[2] Giovanni De Gregorio, ‘The Rise of Digital Constitutionalism in the European Union’ (2021) 19 I·CON 41.
[3] De Gregorio (n 2) 41.
[4] S and Marper v United Kingdom (Judgment) [GC] ECtHR App Nos 30562/04 and 30566/04 (4 December 2008) [67].
[5] Bart van der Sloot, ‘Decisional Privacy 2.0: The Procedural Requirements Implicit in Article 8 ECHR and Its Potential Impact on Profiling’ (2017) 7(3) International Data Privacy Law 190.
[6] Bărbulescu v Romania (Judgment) [GC] ECtHR App No 61496/08 (5 September 2017) [121], [141].
[7] Von Hannover v Germany (Judgment) ECtHR App No 59320/00 (24 June 2004) [50]; Axel Springer AG v Germany (Judgment) [GC] ECtHR App No 39954/08 (7 February 2012) [83].
[8] Defamation Act 2013, s 1; Lachaux v Independent Print Ltd [2019] UKSC 27, [2020] AC 612.
[9] Banks v Cadwalladr [2022] EWHC 1417 (QB), [2022] EMLR 19.
[10] Assimilated Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (‘UK GDPR’), art 17; Fiona Brimblecombe, Defamation in the Digital Age and the ‘Right to be Forgotten’ (Bristol University Press 2025).
[11] Hurbain v Belgium (Judgment) [GC] ECtHR App No 57292/16 (4 July 2023) [196]–[202].
[12] Centrum för Rättvisa v Sweden (Judgment) [GC] ECtHR App No 35252/08 (25 May 2021); Giulia Gentile, ‘Judicial Protection of Fundamental Rights on the Internet: A Road Towards Digital Constitutionalism?’ (2022) 30 IJLIT 507 (book review).
