I.Intro

Question 1

A1. Rationale for data protection

Answer 1

1, data protection as fundamental human right.

2, Respect of fundamental rights and freedom.

Question 2

A2. Human rights laws

Answer 2

The United Nations’ (UN) Universal Declaration of Human Rights (UDHR) (1948) declared:
Article 12. No one shall be subjected to arbitrary interference with his privacy…
Article 19. Everyone has the right to freedom of opinion and expression…
The Council of Europe’s (CoE) European Convention of Human Rights
Article 29(2). In the exercise of his rights…everyone shall be subject…respect for the rights of others…
Article 8. Everyone has the right to respect for his private…life
Article 10(1). Everyone has the right to freedom of expression.
Article 10(2). The exercise of these freedoms may be subject to restrictions or penalties

Question 3

A3. Early laws and regulations

Answer 3

In 1980, OECD issued Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (OECD Guidelines). Revised 2013.
The guidelines are not law but contain many GDPR principles.

Council of Europe (CoE) issued the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), “GDPR Lite.”
Product: the EU Charter of Fundamental Rights. Includes fundamental right to data protection. Did not become law until 2009, when the Treaty of Lisbon made it law.
Recite: 2002, EU enacted the Directive on Privacy and Electronic Communications
Directive 2002/58/EC (ePrivacy Directive).
This law orders EU member states to adopt national laws to protect the confidentiality of communications by means of public communications networks and publicly available electronic communications services.
The e-Privacy Directive does not apply to private communication networks, such as a company intranet.

Question 4

A4. The need for a harmonized European approach

Answer 4

1, need for free data transfer in EU.
2, need for a better higher personal data protection standers.
3, prevent conflict between different Jurisdiction

Question 5

A5. The Treaty of Lisbon

Answer 5

Treaty of Lisbon (2009 )It legalized the EU Charter of Fundamental Rights (for all EU subjects) and the fundamental right to privacy.

Question 6

A6. A modernized framework

Answer 6

The General Data Protection Regulation (GDPR) modernizes data protection law. It is effective May 25, 2018. The ePrivacy Directive will be eventually replaced by the ePrivacy Regulation, expected on or after 2019. ePrivacy aims regulate online communication

Question 7

B1. Council of Europe

Answer 7

Council of Europe (CoE) is an international organization. It has 47 member states,It is separate from the EU

Question 8

B2. European Court of Human Rights

Answer 8

European Court of Human Rights (ECtHR) adjudicates disputes arising from (i) the European Convention on Human Rights and (ii) Convention 108.

Question 9

B3. European Parliament

Answer 9

European Parliament,It cannot propose legislation. However, it debates and passes legislation and bud-
gets, and supervises other institutions.

Question 10

B4.European Commission

Answer 10

The European Commission is the executive branch of the EU and implements policies and decisions. It has one commissioner per member state. It also proposes legislation. However, it cannot pass legislation.

Question 11

B5. The European Council

Answer 11

The European Council is this think-tank thing where heads of state (kings and queens) go to “provide the union with general political directions and priorities.” These people also dogpile on the meetings: the European Council President, the European Commission President, and the High Representative of Foreign Affairs and Security Policy. The European Council has no power.

Question 12

B6. European Court of Justice

Answer 12

The CJEU adjudicates disputes arising from EU law. Remember, the European Court of Human Rights adjudicates CoE law (the ECHR and Convention 108 only).
The CJEU is located in Luxembourg (not Strasbourg).
The CJEU has 2 branches. The Court of Justice “deals with requests for preliminary rulings from national courts and appeals.” Whereas the General Court “rules on actions for annulment brought by individuals, companies and, in some cases, EU governments.”

Question 13

C1. The Council of European Convention for the Protection of Individuals with Regard to the Automatic Processing of Personal Data of 1981 (The CoE Convention)

Answer 13

This Convention is the first binding international instrument which protects the individual against abuses which may accompany the collection and processing of personal data and which seeks to regulate at the same time the transfrontier flow of personal data.

In addition to providing guarantees in relation to the collection and processing of personal data, it outlaws the processing of “sensitive” data on a person’s race, politics, health, religion, sexual life, criminal record, etc., in the absence of proper legal safeguards. The Convention also enshrines the individual’s right to know that information is stored on him or her and, if necessary, to have it corrected.

Restriction on the rights laid down in the Convention are only possible when overriding interests (e.g. State security, defence, etc.) are at stake.

The Convention also imposes some restrictions on transborder flows of personal data to States where legal regulation does not provide equivalent protection.

Question 14

C2.The EU Data Protection Directive (95/46/EC)

Answer 14

The Data Protection Directive is replaced by the GPDR (1995 - May 25, 2018). approach was too “fragmented.” The EU had no choice but to pass the GDPR.

Question 15

C3. The EU Directive on Privacy and Electronic Communications (2002/58/EC) – as amended

Answer 15

Recite: 2002, EU enacted the Directive on Privacy and Electronic Communications Directive 2002/58/EC (ePrivacy Directive). This law orders EU member states to adopt national laws to protect the confidentiality of communications by means of public communications networks and publicly available electronic communications services.
The e-Privacy Directive does not apply to private communication networks, such as a company intranet. This law also contains the eCookie Directive, a 2009 amendment to the ePrivacy Directive.

Question 16

C4. The EU Directive on Electronic Commerce (2000/31/EC)

Answer 16

The EU Directive on Electronic Commerce (eCommerce Directive) exempts telecoms, social networks, and website operators from liability from the illegal acts of their users. The eCommerce Directive’s purpose is to ensure the free flow of “information society services” (ISS) in the single market.

Question 17

C5.European data retention regimes

Answer 17

Directive 2006/24/EC , According to the directive, member states had to store citizens’ telecommunications data for a minimum of 6 months and at most 24 months. Under the directive the police and security agencies would have been able to request access to details such as IP address and time of use of every email, phone call and text message sent or received.
On 8 April 2014, the Court of Justice of the European Union declared the Directive invalid in response to a case brought by Digital Rights Ireland against the Irish authorities and others because blanket data collection violated the EU Charter of Fundamental Rights, in particular the right of privacy.

Question 18

C6. The General Data Protection Regulation (GDPR) and related legislation

Answer 18

Like the earlier Data Protection Directive, the GDPR applies to the European Economic Area (EEA). Again, the EEA is all 28 EU member states plus Iceland, Norway, and Liechtenstein.