The Data Protection Directive (officially known as Directive 95/46/EC) was a European Union directive adopted on October 24, 1995, to regulate the processing of personal data within the EU. It was designed to protect the rights and freedoms of individuals, particularly their right to privacy with respect to the processing of personal data.
Key Objectives
- To harmonize the protection of fundamental rights and freedoms of natural persons in respect of processing activities within the EU.
- To ensure the free flow of personal data between EU member states while maintaining high standards of data protection.
Main Provisions
- Data Quality: Personal data must be processed fairly and lawfully; collected for specified, explicit, and legitimate purposes; and must be relevant, adequate, and not excessive in relation to the purposes for which they are collected and/or further processed.
- Transparency: Individuals must be informed when their personal data is being collected, about the purpose of the collection, and who will receive the data.
- Legitimate Grounds: Data can only be processed if there is a legal basis for doing so, such as consent, necessity for the performance of a contract, or legitimate interests pursued by the controller or by a third party.
- Data Subject Rights: Individuals have rights to access, correct, or delete their personal data, known as the "right to be forgotten."
- Security: Appropriate technical and organizational measures must be taken against unauthorized or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
- Data Transfers: Transfer of personal data to countries outside the EU is restricted unless those countries ensure an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
History and Context
The Data Protection Directive was a response to the increasing use of personal data in the electronic form, especially with the advent of the internet and digitalization. It was influenced by the Council of Europe's Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, which was the first legally binding international instrument in the field of data protection.
The Directive was intended to be transposed into national law by each member state, leading to a somewhat fragmented approach to data protection across the EU, as member states had some leeway in how they implemented the Directive's principles.
Repeal and Succession
The Data Protection Directive was repealed and replaced by the General Data Protection Regulation (GDPR), which came into effect on May 25, 2018. The GDPR aimed to unify data protection laws across Europe, making them more coherent, strengthening individual rights, and adapting to the changes in technology and globalization of data flow.
External Links
Related Topics