Seminar 5 - Data protection principles

Question 1

Name the relevant provisions when talking about Data Protection principles?

Answer 1

● Art. 5(1)(a): lawfulness, fairness and transparency
● Art. 5(1)(b): purpose limitation
● Art. 5(1)(c): data minimisation
● Art. 5(1)(d): accuracy
● Art. 5(1)(e): storage limitation
● Art. 5(1)(f): integrity and confidentiality
● Art. 5(2): Accountability (elaborated in art. 24)

Question 2

Name the 5 type of conditions for a Member states can make restrictions to the principles in art. 5?

Answer 2

1) provided for by law
2) Correspond to rights and obligations provided for in art. 12 - 22,
3) respect the essence of the fundamental rights and freedoms,
4) pursue a legitimate aim specified in art. 23(1) a)-j) and
5) be necessary and proportionate measures in a democratic society.

Question 3

What does this principle contain with regards to processing? “Lawfulness, fairness and transparency” and where is that in the GDPR?

Answer 3

Art. 5(1)(a): Lawfulness, fairness and transparency:
● Lawfulness: Requires a legitimate ground provided in the data protection legislation (art. 6(1) and 9(2)) and must be consistent with all applicable laws.
● Fairness: Data must not be obtained nor otherwise processed through unfair means, by deception or without the data subject’s knowledge
● Transparency (clear, concise and easy to understand) It must be clear to the people concerned what are the risks, rules, safeguards and rights regarding the processing of their personal data.

Question 4

What is the purpose limitation and where is it found in the GDPR?

Answer 4

Art. 5(1)(b): Purpose limitation:
● 1) The purpose must be defined before processing is started, and must be:
○ Specified
○ Explicit – the purpose must be sufficiently unambiguous and clearly expressed
○ Legitimate – legal ground for processing, applicable law and interpreted within the context of the processing

● 2) Must not be further processed in a manner that is incompatible with those purposes (“Compatible use”)

Question 5

What is the data minimisation and where is it found in the GDPR?

Answer 5

Art. 5(1)(c):
● A controller should strictly limit collection of data to such information that is directly relevant for the specific purpose pursued by the processing (must be necessary in order to achieve the declared overall aim of the processing operations)
● Processing must be limited to what is necessary to fulfil a legitimate purpose (must only collect and process personal data that is relevant, necessary and adequate to accomplish the purposes)

Question 6

What is the accuracy principle and where is it found in the GDPR?

Answer 6

Art. 5(1)(d):

● Must be accurate and, where necessary, kept up to date

Question 7

What is the storage limitation principle and where is it found in the GDPR?

Answer 7

Art. 5(1)(e): Storage limitation:

● Personal data must not be kept for longer than necessary for the purposes

Question 8

What is the Integrity and confidentiality principle and where is it found in the GDPR?

Answer 8

Art. 5(1)(f): Integrity and confidentiality:
Appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures)

Question 9

What is the Accountability principle and where is it found in the GDPR?

Answer 9

Art. 5(2): Accountability
● The controller is responsible and must be able to demonstrate that the processing is in compliance with GDPR (new principle in the GDPR)

Question 10

Name an example of how to have higher security when processing data?

Answer 10

• Two-step verification can provide better protection of personal information against unauthorized access to personal accounts via hacking.
• Pseudonymisation

Question 11

Why is Digital Rights Ireland relevant when discussing Data Protection Principles?

Answer 11

Digital Rights Ireland: “limitation on the exercise of the rights and freedom must be provided for by law, respect their essence and, subject to the principle of proportionality, necessary and meet the objectives of general interest” (first EU court case analyzing the Charter and data protection)

Remember three-fold test!!

Question 12

What was examined in DRI (what provisions)?

Answer 12

In Digital Rights Ireland the Court of Justice of the European Union (CJEU) examined the compatibility of Directive 2006/24/EC (Data Retention Directive) with

Articles 7 (Right to Privacy) and 
8 (Right to Data Protection) of the EU Charter of Fundamental Rights and 52 of Charter.

Question 13

What is the Three fold test in the judgement from DRI?

Answer 13

i. Three fold test in the judgement
1. Whether the essence of the right are respected
2. Whether it meets the objective or general interest and
3. Whether it respects the boundaries of proportionality