Module 1: Data Protection Laws

Question 1

Universal Declaration of Human Rights

Answer 1

1948

United Nations General Assembly

Nonbinding.

Article 12: human right to privacy
Article 19: Right to free speech
Article 29(2): 12 & 19 not absolute and should be balanced

Question 2

European Convention on Human Rights

Answer 2

1953

Council of Europe

International Treaty
Enforced by ECHR

Article 8: Privacy 
Article 10: freedom of expression and sharing info across national boundaries 
Article 10(2): Balance 

Required member state ratification

Question 3

Treaty of Rome

Answer 3

1958

Allowed the Data Protection Directive to be setup as a harmonizing measure

Enriched free trade

Question 4

OECD Guidelines

Answer 4

1980 - Updated in 2013

Aimed to facilitate data flows and protect personal data in a global economy

Most widely recognized framework for fair information practices

Question 5

What are the 8 OECD Principles?

Answer 5

1. Collection limitation
   
   2. Data quality
   3. Purpose specification
   4. Use limitation
   5. Security safeguards
   6. Openness
   7. Individual participation
   8. Accountability

Question 6

Convention 108

Council of Europe Convention

Answer 6

Council of Europe

• Differs from OECD because it requires signatories
• Principles must be applied in domestic legislation

Enforced by ECHR

Governs international data transfers (along with GDPR)

Question 7

First data protection instrument for several Council of Europe member states

Answer 7

Convention 108

Question 8

EU Data Protection Directive (95/46/EC)

Answer 8

European Commission

Set out general data protection principles and obligations, requiring EU member states to transpose and implement them.

Differed across member states

Formed the Article 29 Working Party

Question 9

Charter of Fundamental Rights of the EU

Answer 9

2000

European Union Institutions

Comprehensive collection of individual’s rights including the fundamental right to the protection of personal data.

Question 10

Ecommerce Directive

Directive 2000/31/EC

Answer 10

2000

Issues relating to personal data are outside of its scope

Question 11

e-Privacy Directive

EU Directive on Privacy and Electronic Communications

Answer 11

2002

Legally binding on EU member states
Requires local implementation.

Generally applies to processing of personal data through public electronic communications services and networks in the EU.

Question 12

EU Data Retention Directive (2006/24/EC)

Answer 12

2006

Annulled in 2014 by the Court of Justice of the EU

Question 13

Treaty of Lisbon

Answer 13

2009

To strengthen and improve the core structures of the EU and help it function more efficiently.

Question 14

Gave the Charter of Fundamental Rights of The EU full legal effect in the EU.

Answer 14

Treaty of Lisbon

Question 15

General Data Protection Regulation (GDPR)

Answer 15

Became law in 2016
Replaced the Data Protection Directive and became enforceable on 25th of May 2018.

Directly applicable and enforceable by law
Provides one set of data protection rules for all
Allows member states a degree of tailoring

Forms the European Data Protection Board (EDPB)

Question 16

What are the 7 Principles of the GDPR?

Answer 16

1. Lawfulness, Fairness and Transparency of Processing
2. Purpose Limitation
3. Data Minimization
4. Accuracy
5. Storage Limitation
6. Integrity and Confidentiality
7. Accountability

Question 17

Convention 108+

Answer 17

2018

A version of convention 108 overhauled to align with the GDPR, signed by 20 states of the Council of Europe including the UK.

According to the European Commission it serves as a means for 3rd countries (those outside of the EU) to adopt the basic tenets of the GDPR.

Question 18

The CoE Convention

Answer 18

The Council of Europe Convention for the Protection of Individuals with Regard to the
Automatic Processing of Personal Data of 1981

Question 19

The EU Directive on Electronic Commerce (2000/31/EC)

Question 20

European data retention regimes