Chapter 1 Origins and Development of European Data Protection Law

Question 1

What gave rise to the need for European data protection law

Answer 1

although rules and legal frameworks existed to protect individual personal information in privacy, tort, secrecy and confidentiality existed. Additional controls were needed to regulate the automated storage of PI and cross-border trade.

Question 2

What is the UDHR?

Answer 2

Universal Declaration of Human Rights.

Question 3

When and by whom was the UDHR adopted?

Answer 3

10 December 1948, by the General Assembly of the UN.

Question 4

What does Article 12 of the UDHR enshrine?

Answer 4

the right to privacy and the protection of the law from interference of said right:
no one shall be subjected to arbitrary interference with his privacy, family, home or correspondence no attacks upon his honour and reputation. everyone has the right to the protection of the law against such interference or attacks.

Question 5

What dos Article 19 of the UDHR enshrine?

Answer 5

the right to freedom of expression through any media frontiers:
everyone has the right to freedom of opinion and expression; this right includes freedom to hold opinions without interference and to seek, receive and impart information and ideas through any media and regardless of frontiers.

Question 6

What does Article 29(2) of the UDHR enshrine?

Answer 6

A reconciliation of Articles 12 and 19:
in the exercise of his rights and freedoms, everyone shall be subject only to such limitations as are determined by law solely for the purpose of securing due recognition and respect for the rights and freedoms of others and of meeting the just requirements of morality, public order and general welfare in a democratic society.

Question 7

What is the ECHR?

Answer 7

European Convention on Human Rights

Question 8

What is the ECtHR?

Answer 8

European Court of Human Rights, later restructured into the Court of Human Rights

Question 9

When was the ECHR adopted?

Answer 9

3 September 1953 by member states of the Council of Europe.

Question 10

What does Article 8 of the ECHR enshrine?

Answer 10

right to privacy, family life, home and correspondence:
Everyone has the right to respect for his private and family life, his home and his correspondence.
There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others

Question 11

What does Article 10(1) of the ECHR enshrine?

Answer 11

the right to freedom of expression:
Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers

Question 12

What does Article 10(2) of the ECHR enshrine?

Answer 12

qualifies the right to freedom of expression:
The exercise of these freedoms, since it carries with it duties and responsibilities, may be subject to such formalities, conditions, restrictions or penalties as are prescribed by law and are necessary in a democratic society, in the interests of national security, territorial integrity or public safety, for the prevention of disorder or crime, for the protection of health or morals, for the protection of the reputation or the rights of others, for preventing the disclosure of information received in confidence, or for maintaining the authority and impartiality of the judiciary.

Question 13

Which seven countries led the charge in implementing legislation aimed at controlling the use of PI by government agencies and large companies?

Answer 13

Austria, Denmark, France, Germany, Luxembourg, Norway, and Sweden

Question 14

What is PI?

Answer 14

Personal Information.

Question 15

What is Recommendation 509 on human rights and modern scientific and technological developments?

Answer 15

published with the intent to protect the right to privacy enshrined in article 8 of the ECHR in light of emerging technology

Question 16

Resolutions 73/22 and 74/29

Answer 16

establishment of principles for the protection of personal data in automated databanks in pvt and public sectors. emerged due to diverging national legislation.

Question 17

Who created the OECD guidelines on the protection of privacy and transborder flows of personal data?

Answer 17

Council of Europe

Question 17

who created the CoE convention for the protection of individuals with regard to automated processing of personal data?

Answer 17

Council of Europe

Question 17

when were the OECD guidelines established

Answer 17

23 September 1980

Question 18

What is the other name for the ‘Council of Europe convention for the protection of individuals with regard to automated processing of personal data’?

Answer 18

Convention 108

Question 18

what are the OECD Guidelines?

Answer 18

intended to govern the transborder flow of data and the protection of PI and privacy, with an aim to balance protection of rights to privacy and freedoms of expression without hindering trade and the free flow of data across borders.

Question 19

What principles are outlined in the OECD Guidelines

Answer 19

Collection Limitation
Data Quality
Purpose specification
Use limitation
security safeguards
openness
individual participation
accountability

Question 20

What is the OECD Guideline approach to private and public sectors

Answer 20

does not differentiate between the two

Question 21

Does the OECD Guidelines differentiate between how the PI was gathered?

Answer 21

No, both electronic and other means are covered by the OECD.

Question 22

Describe the collection limitation principle

Answer 22

Pi must be collected fairly and lawfully and where appropriate with the consent of the individual

Question 23

Describe data quality principle

Answer 23

PI must be relevant, complete, accurate and up to date

Question 24

Describe purpose specification principle

Answer 24

purpose for collecting PI must be specified no late than at the time of collection and must be compatible with that purpose.

Question 25

Describe use limitation principle

Answer 25

disclosure of PI must be consistent with the purposes specified, UNLESS consent is given or the data controller has the lawful authority to do so.

Question 26

Describe security safeguards principle

Answer 26

reasonable security safeguards must be taken against risks such as loss, unauthorised access, destruction, modification and disclosure of PI

Question 27

Describe openness principle

Answer 27

general policy of openness with respect to uses of PI and the location & identity of DC (transparency)

Question 28

Describe individual participation prinicple

Answer 28

what an individual is entitled to rceive from a DC pursuant to an request for their PI.

Question 29

Describe accountability principle

Answer 29

a DC should be accountable to comply with the OECD Guideline principles

Question 30

what do the guidelines say on transborder data flow?

Answer 30

- members should consider implications for domestic processing and the re-export of personal data - ensure that transborder data flows are secure and uninterrupted. - transborder flows may occur between member states unless the member is not ready to observe the guidelines. - members may impose restrictions on transfer if the receiving country has no equivalent protections -members should avoid creating privacy laws that hinder transborder flow of data

Question 31

What is convention 108

Answer 31

The Convention for the Protection of Individuals with regard to automatic processing of Personal Data

Question 32

When was Convention 108 adopted?

Answer 32

28 January 1981

Question 33

What was the value of Convention 108

Answer 33

consolidates resolutions of 1973 and 1974. was the first legally binding international instrument in the area of data protection, requiring signatories to take necessary steps in domestic legislation to apply the principles it lays down.

Question 34

What are the three parts of Convention 108

Answer 34

1. substantive law provisions in the form of basic principles 2. special rules on transborder data flows 3. mechanisms for mutual assistance and consultations between the parties.

Question 35

What does Convention 108 say on how information undergoing automatic processing should be treated?

Answer 35

must be: 1. obtained and processed fairly 2. stored for specified and legitimate purposes and use for those purposes 3. adequate, relevant and not excessive in relation to the purposes 4. accurate and up to date 5. doesn't unnecessarily identify individuals for longer than required for purpose

Question 36

what principles regarding to PI are enshrined in Convention 108

Answer 36

1. how PI should be treated (5) 2. security measures to be taken to protect such information 3. PI revealing racial, political, religious, health, sexual orientation, criminal convictions should be safeguarded 4. individuals must have the right of communication, rectification, and erasure of PI held.

Question 37

can signatories to Convention 108 make exception to provisions?

Answer 37

yes, only when necessary for the maintenance of a democratic society (i.e. state security & criminal investigation).

Question 38

Do signatories of Convention 108 have to place restrictions on trans-border flows to other signatory states?

Answer 38

No, because it is assumed that they offer certain minimum protections enshrined in the Convention.

Question 39

When is derogation from trans-border flow of data under Convention 108 allowed

Answer 39

1. if importing signatory does not provide for equivalent protection detailing originating signatory state in its national legislation 2. if the importing country is not a signatory

Question 40

what did the Additional Protocol to Convention 108.

Answer 40

to allow for trans-border flow of data to non-signatories to Convention 108.

Question 41

what did the additional protocol to Conveiton 108 introduce

Answer 41

the concept of "adequacy" compared to "equivalence" of protection

Question 42

What is unique about Convention 108?

Answer 42

the only piece of data protection instrument that is international and allows for any state to be a signatory.

Question 43

what is the Data Protection Directive

Answer 43

Directive 95/46/EC on the protection of individuals with regard to processing of personal data and on the free movement of such data.

Question 44

what challenges were experienced with the Data Protection Directive

Answer 44

implementation by states vastly differed, which had the unintended consequence of hindering business.

Question 45

what was the source of the Charter of fundamental rights

Answer 45

in 7 deember 2000, consolidated: 1. the EU treaty, 2. CJEU (court of justice of the european union) case law, 3. eu member state constitutional traditions, 4. European convention on human rights and 5. fundamental rights applicable within the EU.

Question 46

which articles of the charter of fundamental rights enshrine art 8 and 10 of the ECHR?

Answer 46

Article 7 and 11.

Question 47

what are the core values of art 8 of the charter of fundamental rights?

Answer 47

1. fair processing 2. carried out for specific purposes 3. legitimate basis for processing 4. individual right to access and rectification 5. supervisory authority to oversee compliance.

Question 48

when did the treaty of lisbon become effective

Answer 48

1 december 2009

Question 49

what was the impact of the treaty of lisbon

Answer 49

amended treaty of EU and treaty establishing the European community (treaty on the functioning of the european union 'TFEU')

Question 50

what does article 16 (1) of the TFEU

Answer 50

enshrines article 8 of the charter on fundamental rights.

Question 51

when can member states make further legislative provisions to the GDPR?

Answer 51

1. when there are sector-specific laws in place 2. archiving purposes in the public interest 3. processing special categories of personal data 4. compliance with a legal obligation

Question 52

how does GDPR apply?

Answer 52

all provisions apply entirely and directly upon entry to force without need to be localised into national law.

Question 53

what key changes were incorporated into GDPR?

Answer 53

1. stronger rights for individuals 2. data protection by design and default 3. introduction of accountability 4. increased powers of supervisory authorities 5. one stop shop 6. applicability to anyone targeting EU consumers.

Question 54

what is 'data protection by design and by default'?

Answer 54

data protection must be considered when new technologies are being developed.

Question 55

what is the law enforcement directive?

Answer 55

directive for the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes for the prevention, investigation, detection, or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data.

Question 56

what is the objective of the law enforcement directive?

Answer 56

harmonising the rules to protect citizens fundamental rights whenever personal data are used by criminal enforcement authorities

Question 57

what does the ePrivacy directive set out to do?

Answer 57

make rules on processing of personal data across public communication networks

Question 58

what challenges were experienced with the e Privacy Directive

Answer 58

not covered by the GDPR, and not reviewed because of the complexity of privacy public policy

Question 59

what is the current position regarding privacy law in the UK post Brexit?

Answer 59

GDPR was implemented mutatis mutandis.

Question 60

what is the current privacy regulatory framework in the UK

Answer 60

1. UK GDPR (as amended by the Data Protection, Privacy and Electronic Communications (Amednments) 2. EU Exit regulations to accomodate Brexit 3. DPA 3. secondary legislation adopted by secretary of state to amend of DPA. 4. codes of practice and guidance adopted by ICO 5. international instruments regarding personal data which UK adheres to (ECHR and Convention 108)

Question 61

what decision has been made post-Brexit regarding adequacy?

Answer 61

European Commission has determined that the UK privacy law regulatory regime is adequate for both the GDPR and LED.

Question 62

what criterion was used to determine the adequacy of UK privacy law?

Answer 62

The UK: 1. maintains the rule of law, respecting human rights and fundamental freedoms 2. provides effective and enforceable subject rights 3. has independent supervisory authorities 4. has entered into international commitment and participates in multilateral or regional systems

Question 63

describe the sunset clause in the adequacy decision for the UK?

Answer 63

the adequacy decision automatically expires in 4 years.