Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP-E > Chapter 1 (Origins & Development Of European Data Protection Law) > Flashcards

Chapter 1 (Origins & Development Of European Data Protection Law) Flashcards

1
Q

What concept underlies EU data protection laws?

A

That the right to a private life and associated freedoms is considered a fundamental human right.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

When and who adopted the Universal Declaration of human rights?

A

The General Assembly of the United Nations on December 10, 1948.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What fundamental rights are enshrined in Articles 12, 19, and 29(2) of the 1948 Human Rights Declaration?

A

Article 12: right to a private life and associated freedoms.
Article 19: right to freedom of opinion and expression as well as right to seek, receive, and impart info and ideas through any media regardless of frontiers.
Article 29(2): individual rights are not absolute and there will be instances where a balance must be struck.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the ECHR?

A

The European Convention on Human Rights, an international treaty to protect human rights and fundamental freedoms enacted on September 3, 1953.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What body enforces the ECHR?

A

The European Court of Human Rights (ECtHR), restructured into the Court of Human Rights in 1988.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What fundamental rights are laid out in Articles 8, 10(1), and 10(2) of the ECHR?

A

Article 8: right to private life and associated freedoms.
Article 10(1): protects the right of freedom of expression and the right to share info and ideas across national boundaries
Article 10(2): clarifies that rights of individuals aren’t unqualified and justifiable interference OK.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What 7 countries led in implementing legislation aimed at controlling the use of PI by government agencies and large companies?

A
  1. Austria
  2. Denmark
  3. France
  4. Federal Republic of Germany
  5. Luxembourg
  6. Norway
  7. Sweden
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What 3 countries incorporated data protection as a fundamental right in their constitutions?

A
  1. Spain
  2. Portugal
  3. Austria
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the OECD?

A

The Organization for Economic Co-operation and Development.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the role of the OECD?

A

To promote policies designed to achieve the highest:
1. Sustainable economic growth
2. Sustainable employment
3. Rising standard of living

In both OECD member states and nonmember states, while maintaining financial stability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What did the OECD develop in 1980?

A

The Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (“OECD Guidelines”)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the aim of the OECD Guidelines?

A

To strike a balance between protecting the privacy, rights, and freedoms of individuals w/o creating any barriers to trade and allowing the uninterrupted flow of personal data across national borders.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Are the OECD Guidelines legally binding?

A

No. They are intended to be flexible and serve either as a basis for legislation in countries that have no data protection legislation or as a set of principles that may be built into existing legislation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the 8 principles set forth in the OECD Guidelines?

A
  1. Collection Limitation
  2. Data Quality
  3. Purpose Specification
  4. Use Limitation
  5. Security Safeguards
  6. Openness Principle
  7. Individual Participation
  8. Accountability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the Collection Limitation Principle outlined in the OECD Guidelines?

A

PI must be collected fairly and lawfully and, where appropriate, with the knowledge or consent of the individual concerned.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the Data Quality Principle outlined in the OECD Guidelines?

A

PI must be relevant, complete, accurate, and up to date.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the Purpose Specification Principle outlined in the OECD Guidelines?

A

The purpose for which the PI is to be used must be specified no later than at the time of collection, and any use must be compatible with that purpose.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the Use Limitation Principle outlined in the OECD Guidelines?

A

Any disclosure of PI must be consistent with the purpose specified unless the individual has given consent or the data controller has lawful authority to do so.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the Security Safeguards Principle outlined in the OECD Guidelines?

A

Reasonable security safeguards must be taken against risks, such as loss or unauthorized access, destruction, use, modification, or disclosure of PI.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the Openness Principle outlined in the OECD Guidelines?

A

There should be a general policy of openness with respect to the uses of PI, as well as the identity and location of the data controller.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the Individual Participation Principle outlined in the OECD Guidelines?

A

Sets out what an individual is entitled to receive from a data controller pursuant to a request for their PI.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the Accountability Principle outlined in the OECD Guidelines?

A

A data controller should be accountable for complying with measures that ensure the previously stated principles.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Of the 8 OECD Principles, which has become the most important aspect of subsequent data legislation?

A

The Individual Participation Principle.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the 5 statements the OECD Guidelines make with regard to transborder data flow?

A
  1. Consider the implications for other member countries of domestic processing and re-export of personal data.
  2. Take all reasonable and appropriate steps to ensure transborder data flows of personal data, including transit through a member country, are uninterrupted and secure.
  3. Transborder flow of data OK except with countries that don’t observe Guidelines or where re-export would circumvent domestic privacy legislation.
  4. A member state may impose restrictions on transborder data flow for categories of personal data protected under its domestic legislation.
  5. Should’t develop laws and policies that are unnecessarily restrictive to transborder data flow.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What was the first legally binding international instrument in the area of data protection?

A

The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108).

26
Q

How to the OECD Guidelines and Convention 108 differ?

A

Convention 108 differs from the Guidelines in that it requires signatories to take the necessary steps in their domestic legislation to apply the principles it lays down with regard to processing PI.

27
Q

What are the 3 main parts of Convention 108?

A
  1. Substantive law provisions in the form of basic principles (Chapter 2)
  2. Special rules on transborder data flow (Chapter 3)
  3. Mechanisms for mutual assistance and consultation between the parties (Chapter 4 & 5)
28
Q

Under the substantive law provisions of Convention 108, personal info undergoing automatic processing shall be subject to what 5 conditions?

A
  1. Obtained and processed fairly and lawfully.
  2. Stored for specified and legit purposes and not used in a way incompatible with those purposes.
  3. Adequate, relevant, and not excessive in relation to the purposes for which they are stored.
  4. Accurate and, where necessary, kept up to date
  5. Preserved in a form that permits identification of the individuals for no longer than is required for the purpose for which info is stored
29
Q

Under the substantive law provisions of Convention 108 (outside of how to automatically process PI), what other 3 principles are outlined?

A
  1. Appropriate security measures must be taken to protect stored PI.
  2. PI that reveals racial origin, political opinions, or religious or other beliefs, as well as personal data that concerns health, sexual life, or criminal convictions may not be processed automatically unless domestic law provides appropriate safeguards.
  3. Individuals must have the right of communication, rectification, and erasure of held PI.
30
Q

When implementing Convention 108, when may signatories include an exception to the substantive law provisions?

A

Only when it is a necessary measure in a democratic society (e.g. state security or criminal investigation).

31
Q

What does Article 12 of Convention 108 provide?

A

That transfers of PI made between Convention 108 signatories generally shall not be subject to any prohibitions or require any special authorizations.

32
Q

When may a Convention 108 signatory place prohibitions or require special authorizations from another signatory before a data transfer can occur?

A

When the exporting country has specific rules in its national law for certain categories of data or automated personal data files and the importing country doesn’t provide similar protections.

33
Q

What does the 2001 Additional Protocol to Convention 108 provide?

A

It was designed to address the fact that Convention 108 didn’t provide any measures for transfers of PI to countries that weren’t signatories to Convention 108.

34
Q

What does the Additional Protocol to Convention 108 provide with regard to data transfers to non-signatory parties?

A

It introduced the concept of an “adequate” rather than an equivalent level of protection for PI.

35
Q

Under the mutual assistance provision of Convention 108 must a signatory appoint a supervisory authority?

A

Yes.

36
Q

Under Convention 108, what are the 3 responsibilities of a supervisory authority?

A
  1. To oversee compliance with data protection law.
  2. To liaise with supervisory authorities in other jurisdictions for purposes of consultation and mutual assistance re implementation
  3. To assist individuals in the exercising their rights.
37
Q

Which international legal instrument remains as the only binding agreement with a worldwide scope of application in the data protection field?

A

Convention 108

38
Q

What is Convention 108+?

A

A modernizing protocol to Convention 108 to address challenges resulting from the use of new info and communications technologies.

39
Q

What is the Data Protection Directive?

A

Directive 95/46/EC undertaken by the European Commission to protect the processing of individuals’ personal data and the free movement of data, as well as harmonize data protection laws.

40
Q

What is the aim of the Data Protection Directive?

A

To further reconcile protecting individuals’ fundamental privacy rights with the free flow of data from one member state to another, maintaining consistency with Articles 8 and 10 of the ECHR.

41
Q

When was the Charter of Fundamental Rights signed and what is its purpose?

A

Signed December 7, 2000. It further consolidates fundamental rights applicable within the EU.

42
Q

When was the Charter of Fundamental Rights given binding legal effect?

A

In December 2009 when the Treaty of Lisbon came into force.

43
Q

Article 8 of the Charter of Fundamental Rights enshrines what 5 core values for the protection of personal data?

A
  1. The processing must be fair.
  2. The processing must be carried out for specified purposes.
  3. There must be a legit basis for the processing.
  4. Individuals must have the right to access and rectify personal data.
  5. There must be a supervisory authority to oversee compliance.
44
Q

When was the Treaty of Lisbon signed and effective?

A

Signed on December 13, 2007. Effective December 1, 2009.

45
Q

What is the main aim of the Treaty of Lisbon?

A

To strengthen and improve the core structures of the EU to enable it to function more efficiently.

46
Q

Which 2 core treaties of the EU does the Treaty of Lisbon amend?

A
  1. The Treaty on European Union
  2. The Treaty Establishing the European Community (renamed the Treaty on the Functioning of the European Union)
47
Q

What are 6 core values the Treaty of Lisbon promotes?

A
  1. Human dignity
  2. Freedom
  3. Democracy
  4. Equality
  5. The Rule of Law
  6. Respect for Human Rights
48
Q

What is the comprehensive reform of the Directive that the Commission proposed?

A

The General Data Protection Regulation (GDPR)

49
Q

When was the GDPR signed and fully enforceable?

A

Signed in May 2016 and became fully enforceable on May 25, 2018.

50
Q

What is the purpose of having the GDPR be a regulation instead of a directive?

A

To maximize consistency of approach amongst the EU member states.

51
Q

What are 4 examples of instances where member states may make further legislative provisions under the GDPR?

A
  1. Where there are already sector-specific laws in place, for example, in relation to the processing of employee data.
  2. Archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes.
  3. Processing of special categories of personal data.
  4. Processing in compliance with a legal obligation.
52
Q

What are 6 key changes incorporated into the GDPR?

A
  1. Stronger rights for individuals, particularly in the online environment.
  2. A requirement that data protection be considered when new technologies are being developed.
  3. Introducing concept of accountability whereby orgs must be able to demonstrate compliance with the GDPR
  4. Increased powers for supervisory authorities
  5. The concept of the one-stop shop
  6. Broader applicability of the GDPR to anyone targeting EU consumers
53
Q

How many states signed Convention 108+ and when was it signed?

A

Signed on October 10, 2018 by 21 states.

54
Q

As amended, what is Convention 108+ intended to do?

A

Increase standards of data protection whilst maintaining compatibility with established and emergent regulatory frameworks.

55
Q

What is the Law Enforcement Directive (LED)?

A

A directive introduced by the European Commission to protect natural persons re the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection, or prosecution of criminal offenses or the execution of criminal penalties on the free movement of such data.

56
Q

When did the Law Enforcement Directive enter into force and when must member states have transposed the LED into their national law?

A

Entered into force on May 5, 2016. Member states had until May 6, 2018.

57
Q

What is the aim of the Law Enforcement Directive?

A

To harmonize the rules in place across the member states to protect citizens’ fundamental rights whenever personal data are used by criminal law enforcement authorities.

58
Q

Does the Law Enforcement Directive preclude member states from providing higher safeguards in their national laws to protect data subjects’ rights?

A

No.

59
Q

What does the ePrivacy Directive do?

A

It sets out rules relating to processing personal data across public electronic communications networks.

60
Q

Is the GDPR intended to impose additional obligations on top of the obligations contained in the ePrivacy Directive?

A

No.

61
Q

What are the 5 components of the UK’s data protection legal framework after Brexit?

A
  1. The UK GDPR, which is the GDPR, as it forms part of the EU law and as amended by the Data Protection, Privacy and Electronic Communications Amendments.
  2. The DPA as amended by the 2019 Regulations (Exit Regulations)
  3. The secondary legislation which may be adopted by the Secretary of State to amend the DPA or set out additional rules.
  4. The codes of practice and guidance adopted by the ICO
  5. International instruments re personal data which the UK adheres to, namely the ECHR and Convention 108.
62
Q

On June 28, 2021, the European Commission adopted 2 adequacy decision for the UK under what laws?

A
  1. The GDPR
  2. The Law Enforcement Directive

CIPP-E (18 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions