Ch. 1

Question 1

1968 Recommendation CoE

Answer 1

Recommendation 509 on human rights and modern scientific and technological developments -> out of worry from the CoE that national legislations did not adequately shield the human right to privacy against technological advancements.

Question 2

1980 legislation

Answer 2

OECD Guidelines on the Protection of Privacy & Trans-border Flows of Personal Data (1980). Not legally binding.

Question 3

OECD Guidelines content

Answer 3

Don’t distinguish between public & private sectors or between personal information gathered electronically or otherwise. Number of principles: collection limitation; data quality principle; purpose specification; use limitation; security safeguards; openness; individual participation (data requests); accountability.

Question 4

1981 legislation

Answer 4

Convention 108 of the CoE. Convention on the Protection of Individuals and the Automatic Processing of Personal Data. Implementation, however, left up to the discretion of states.

Question 5

1970s legislation

Answer 5

CoE resolutions in 1970s 1970s due to divergent national laws.

Question 6

Convention 108 substance

Answer 6

Two reasons for Convention 108:
- Failure of signatories to follow through on previous CoE resolutions
- General need for a binding instrument implementing principles of data protection
Open to signatories outside of CoE. Principles proved determinative for European data protection law: still found in e.g. GDPR. Also recognizes importance of free flow of data as a legally binding instrument it required signatories to adopt its legislations.

Question 7

2001 legislation

Answer 7

Additional Protocol to Convention 108 (2001). Recognizes concept of adequate level of protection, and prohibits data transfers to countries who did not meet this threshold. Also introduced a requirement for Supervisory Authorities

Question 8

Global treaty on data protection + successor

Answer 8

Convention 108. ‘Convention 108+’ was signed in 2018 (in practice a Protocol). After about 30 years, Convention 108+ furthers the (largely European driven) global convergence in data protection laws. Introduces various concepts, such as ‘processor’, the legal basis for data processing. Recommended by the UN Special Raporteur on the right to privacy.

Question 9

1995 legislation

Answer 9

Data Protection Directive (1995) of the European Commission. Principles contained in Convention 108 as a benchmark.

Question 10

Legal basis Data Protection Directive

Answer 10

Response to signatories not responding adequately to the Convention 108. The EU could not just draw up human rights law: no foundation within the Charter. Instead it was framed as a harmonization measure, intended to take away obstacles for internal trade between MS.
However, MS still varied widely in their implementation of the Directive, eventually requiring the adoption of the GDPR.

Question 11

Substance DPD (1995)

Answer 11

A major advance of the Directive over Convention 108 was its applicability to manual data: not only data processed by automatic means.

• identified special categories of data
• specific DS rights
• principles of lawful processing, legitimate purposes, accuracy, storage terms, appropriate technical and organizational measures.
• identified data controllers, both established in the EU and outside, using processing equipment in a EU MS
• mandated the establishment of a DPA

Question 12

Legislation 2000 + privacy article

Answer 12

Charter of Fundamental Rights was signed and proclaimed in 2000. Art. 8 specifically names a right to the protection of data. Mentions various basic requirements: fair processing; specific purposes; legitimate basis; right to access and rectification; oversight from a supervisory authority. Limitations must be in accordance with art. 52, which contains the general exemption provision.

Question 13

2007 legislation + privacy article

Answer 13

Treaty of Lisbon, became effective in 2009, amends the TEU and the TFEU. Art. 16 TFEU echoes art. 8 of the Charter and grants everyone with the right to protection of personal data.

Question 14

2018 legislation + innovations

Answer 14

GDPR, introduced:

• focus on privacy while developing new technologies (privacy by design and by default);
• accountability for organizations;
• increased powers for SA’s; the one-stop-shop.
• not limited to data controllers anymore

Question 15

Reach of GDPR outside of EU

Answer 15

The applicability of the Regulation to organisations not established in the EU is determined by the location of the data subject. The GDPR applies when:

• personal data are processed relating to the offering of goods or services to individuals in the EU, irrespective of whether a payment is required,
• or to the behavior of individuals located in the EU is monitored.

Question 16

GDPR includes tracking DS?

Answer 16

Yes, tracking data subjects on the internet to analyse or predict their personal preferences triggers the application of the Regulation (Recital 24). Massive widening of the application of the rules, as it makes almost every website that drops tracking cookies or app that retrieves usage information subject to the Regulation.

Question 17

7 new responsibilities for controllers under GDPR

Answer 17

The new responsibilities include:

• Implementation of data protection policies and measures to ensure compliance
• Data protection by design and data protection by default
• Record-keeping obligations by controllers and processors
• Cooperation with supervisory authorities by controllers and processors
• Carrying out data protection impact assessments (DPIAs) for operations that present specific risks to individuals due to the nature or scope of the operation
• Prior consultation with DPAs in high-risk cases
• Mandatory data protection officers (DPOs) for controllers and processors for the public sector and big data processing activities

Question 18

2 new responsibilities under GDPR to processor

Answer 18

• existence of direct obligations on processors

- processor may not subcontract a service without the consent of the controller

Question 19

2016 legislation + reach

Answer 19

Law Enforcement Data Protection Directive (2016) -> fundamental rights when personal data are used by criminal law enforcement agencies.

Question 20

ePrivacy Directive reach + goals

Answer 20

Sets out rules regarding the processing of data across public communications networks. 3 objectives:

• Better cooperation between law enforcement authorities
• Better protection of citizens’ data
• Clear rules for international data flows

Question 21

Key provisions ePrivacy Directive

Answer 21

Sets out rules relating to processing personal data across ‘public communications networks’.

• Providers should take appropriate technical & org measures and inform users of risks/breaches
• Communications are confidential, with certain exceptions (consent/exceptions provided by law)
• Most forms of digital marketing require opt-in consent.
• Limited exceptions for marketing of services which are very similar to what customers have previously bought/opted in.
• Location data is anonymized
• Subscribers must be informed before being included in any directory

Question 22

ePrivacy cookie rule + exception

Answer 22

The storing of information (or the gaining of access to information already stored) in the terminal equipment of a subscriber or user is allowed only on the condition that the user concerned has given their consent, having been provided with clear and comprehensive information.

2 exceptions, when cookie is:

• For the sole purpose of carrying out the transmission of a communication over an electronic communications network.
• Strictly necessary for the provision of an information society service explicitly requested by the subscriber or user.

Question 23

Innovations ePrivacy regulation

Answer 23

• Wider application: applies to all providers of electronic communications services (e.g., messaging services on mobile phones, email and voice services, and not just traditional telecoms operators).
• Consent is required to process communications content and metadata: Under the proposed rules content and metadata derived from electronic communications (e.g., time of a call, location, duration, websites visited) will need to be anonymised or deleted if users have not given their consent.
• Revised rules on cookies: The Commission is of the view that the cookie rules contained in the ePrivacy Directive have resulted in an overload of consent requests. The new rules proposed in the ePrivacy Regulation seek to allow users to be more in control of their settings, providing an easy way to accept or refuse the tracking of cookies and other identifiers in case of privacy risks