CIPP/E · Domain 1
European Data Protection Law
About 30% of the exam
Where the law comes from
- Council of Europe
- a human rights body, not the Union
- Convention 108
- first binding data protection treaty
- Modernized convention
- the updated version of that treaty
- Convention Article 8
- respect for private and family life
- Charter Article 7
- private and family life again
- Charter Article 8
- a standalone data protection right
- Court of Justice
- interprets Union law for everyone
- Human Rights Court
- hears convention complaints in Strasbourg
The Council of Europe and the European Union are separate bodies, and the exam rewards candidates who never confuse their courts or their instruments
From directive to regulation
- The 1995 directive
- transposed differently in each state
- Fragmentation
- the problem the regulation solved
- Adopted
- April 2016 after long negotiation
- Applicable
- May 2018 after a transition
- Regulation
- directly applicable, no national statute needed
- Opening clauses
- areas states may still legislate
- Law enforcement directive
- policing and criminal justice processing
- ePrivacy Directive
- still a directive, still transposed
Territorial scope, Article 3
- Establishment here, wherever processing happens
- Offering goods or services to people here
- Monitoring behavior taking place in the Union
- Public international law application also covered
- Targeting matters, not accidental accessibility
- A representative required for many outside controllers
Material scope
- Wholly or partly automated processing
- Filing systems held on paper
- Purely household activity is excluded
- Union institutions have their own regulation
- Deceased persons left to national law
- Anonymous data falls outside entirely
Core definitions
- Personal data
- relates to an identifiable living person
- Processing
- any operation performed on data
- Filing system
- structured and accessible by criteria
- Third party
- outside the controller's direct authority
- Recipient
- anyone data is disclosed to
- Restriction
- marking data to limit use
Special categories
- Prohibited unless a condition applies
- Race, politics, religion, union membership
- Genetics and biometrics used to identify
- Health, sex life and orientation
- Convictions handled in a separate article
- National law adds sector conditions
Cases the exam names
- Google Spain
- delisting and the erasure right
- Digital Rights Ireland
- blanket retention was disproportionate
- Schrems I
- Safe Harbor invalidated
- Schrems II
- Privacy Shield invalidated, clauses conditioned
- Breyer
- dynamic addresses can be personal
- Nowak
- opinions about a person included
- Fashion ID
- plugin operators as joint controllers
- Austrian Post
- recipients named, not just categories
Room left to member states
- Employment context rules vary widely
- Research and archiving derogations differ
- The digital consent age varies
- Criminal data conditions set nationally
- Freedom of expression reconciled locally
- Always check the national statute
The principles, quickly
- Lawfulness
- a basis chosen before collection
- Fairness
- no hidden or unexpected uses
- Transparency
- explained in plain accessible language
- Purpose limitation
- specified, explicit and legitimate
- Minimization
- adequate, relevant and limited
- Accuracy
- corrected or erased without delay
- Storage limitation
- retained only while necessary
- Accountability
- able to demonstrate all of it
Soft law that matters
- Board guidelines shape supervisory practice
- Opinions from the earlier working party
- Approved codes of conduct for sectors
- Certification schemes valid for three years
- National authority guidance and blacklists
- None of it binds the courts
Interpretation techniques
- Read articles alongside their recitals
- Interpret consistently with the Charter
- Proportionality tests limit any interference
- The essence of a right survives
- A margin of appreciation for national choices
- Effectiveness favors the individual
Framing errors to avoid
- Treating recitals as binding obligations
- Confusing the two European courts
- Assuming one rule across every state
- Ignoring the older convention entirely
- Reading scope from server location
- Forgetting sector law sits on top
Placing a question, step by step
- Ask which instrument governs
- Check territorial and material scope
- Identify the roles involved
- Find the principle or article at issue
- Check for national variation
- Look for relevant case law
- Answer from the text, not intuition
- Scope questions come before basis questions
- Naming the article scores the point
- Sector rules narrow the general answer
- Case names carry their reasoning with them
Institutions in one place
- Commission
- proposes law, adopts adequacy decisions
- Parliament and Council
- adopt the legislation together
- Court of Justice
- binding interpretation of Union law
- European Board
- guidelines and binding dispute rulings
- Data Protection Supervisor
- oversees the Union institutions
- National authorities
- supervise and enforce locally
Dates worth knowing
- 1950
- European Convention on Human Rights
- 1981
- Convention 108 opened for signature
- 1995
- the data protection directive
- 2000
- the Charter of Fundamental Rights
- 2016
- the regulation adopted
- 2018
- the regulation became applicable
Reference strip: sources, scope, definitions, principles, cases
Sources
- Convention, Charter, regulation, directives
- Two European courts, distinct roles
- Guidelines persuade, they do not bind
Scope
- Establishment, offering, monitoring
- Household activity excluded
- Anonymous data outside
Definitions
- Identifiable includes online identifiers
- Processing is almost anything
- Filing systems include paper
Principles
- Seven, accountability closing them
- Purpose set before collection
- Minimization limits the fields
Cases
- Google Spain on delisting
- Schrems on transfers
- Breyer on identifiability
Quick exam traps
- Trap: The Council of Europe is a body of the European Union
- Trap: The regulation applies identically everywhere with no national variation
- Trap: A website reachable from Europe is automatically targeting European users
- Trap: Convention 108 was replaced entirely by the regulation
- Trap: Paper files fall outside European data protection law
- Trap: The Charter and the European Convention are the same instrument
- Trap: Board guidelines are legally binding on national courts
cybercertprep.com · original revision sheet written from the public body of knowledge