Accessibility Tools

Legislation


In the 1990s, protection of personal data was regulated by non-harmonised laws in the Member States. Although based on the same basic principles laid down in the Council of Europe Convention No. 108 on data protection, these laws differed considerably in detail. Because this was considered to influence competition and thus the well functioning of EU's internal market, pressure increased for a more harmonised environment. Developments in the ICT-field added to the need for a common set of data protection rules, specifying the Council of Europe Convention.
 
This led to the adoption in 1995 of Directive 95/46/EC. It is the central piece of legislation on the protection of personal data in Europe. The Directive stipulates general rules on the lawfulness of personal data processing and rights of the people whose data are processed (‘data subjects’). The Directive also provides that at least one independent supervisory authority in each Member State shall be responsible for monitoring its implementation.
 
Two years later, a Directive on privacy and electronic communications was adopted. Updated in 2002 as Directive 2 002/58/EC, it regulates areas which were not sufficiently covered by Directive 95/46/EC, such as confidentiality, billing and traffic data, rules on spam, etc.
 
These two directives created a general and technology neutral system of data protection in all EU Member States. However, protection on the level of the European institutions and bodies was not guaranteed. To remedy this, Article 286 of the EC Treaty was adopted.
 
Article 286 of the EC Treaty stipulates that the European institutions and bodies shall protect personal data and provides for the establishment of an independent supervisory authority. It was implemented in Regulation (EC) No 45/2001.
 

Combining the relevant features of Directives 95/46/EC and 2002/58/EC, Regulation (EC) No 45/2001 regroups the rights of the data subjects and the obligations of those responsible for the processing into one legal instrument. It also establishes the EDPS as an independent supervisory authority with the responsibility to monitor the processing of personal data by the Community institutions and bodies (see also Decision 1247/2002).

In November 2008, the Council of the European Union adopted the Framework Decision on the protection of personal data in the field of police and judicial cooperation in criminal matters. It is the first general data protection instrument in the EU third pillar.

Regulation (EC) No 45/2001

Regulation (EC) No 45/2001 of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, OJ L 8, 12.01.2001, p. 1

[pdf]

Decision No 1247/2002/EC

Decision No 1247/2002/EC of 1 July 2002 on the regulations and general conditions governing the performance of the European Data protection Supervisor's duties, OJ L 183, 12.07.2002, p. 1

[pdf]

Directive 95/46/EC

Directive 95/46/EC of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281, 23.11.1995, p. 31

[pdf]

Directive 2002/58/EC

Directive 2002/58/EC of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ L 201, 31.07.2002, p. 37

[pdf]

Directive 2009/136/EC

Directive 2009/136/EC of 25 November 2009 amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws, OJ L 337, 18.12.2009, p. 11

[pdf]

Council framework Decision 2008/977/JHA

Council framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, OJ L 350, 30.12.2008, p. 60

[pdf]

Council of Europe Convention No. 108 on data protection

 
Convention for the protection of individuals with regard to automatic processing of personal data (ETS No. 108, 28.01.1981)

Other international instruments

OECD Guidelines governing the protection of privacy and transborder flows of personal data (July 2013)

[pdf]

OECD Recommendation on Cross-border Co-operation in the Enforcement of Laws Protecting Privacy (2007)

[pdf]
 
Privacy and data protection - two separate fundamental rights
 
Protection of personal data is a right which is separate, but closely linked to the right to privacy:
 
Respect for private life was established in 1950 with the adoption of the European Convention of Human Rights - in the framework of the Council of Europe. Put in short terms, the right to privacy may be described as a right which prevents public authorities from measures which are privacy invasive, unless certain conditions have been met.
 
The right to data protection was introduced in the 1980s as a consequence of technical developments. Put in short terms, data protection principles aim to establish conditions under which it is legitimate and lawful to process personal data. Data protection legislation obliges those responsible to respect a set of rules and empowers the people concerned by granting them rights. Finally, it provides for supervision by independent authorities.
 
 

 
  • 26 May 2016

    Time for Europe's data protection authorities to raise their game. Read the new blog post by Giovanni Buttarelli.

  • 24 May 2016

    Data protection for the digital generation: the countdown to the GDPR begins. Read the EDPS Annual Report 2015 and the press release.

  • 23 May 2016

    To celebrate Europe Day, the EU institutions will hold the annual EU Open Day on 28 May 2016. The EDPS stand will be located on the first floor of the European Parliament, so make sure you pass by and check out our fun and interactive activities! More information about EU Open Day and the EDPS stand can be found on the EDPS Events page.

  • 20 May 2016

    Key Challenges for Privacy in the Digital Age. Read the speech by Giovanni Buttarelli given at Europol - EIPA conference on Privacy in the Digital Age of Encryption and Anonymity Online.

  • 19 May 2016

    New Regulation boosts the roles of EDPS and Europol. Read the press release.

  • 26 May 2016

    Spring Conference, Participation and keynote speech by Giovanni Buttarelli, Budapest, Hungary

  • 26 May 2016

    Spring Conference, Participation and speech by Wojciech Wiewiórowski on GDPR – what next? Practical implications for national legislators, DPAs, data controllers, Budapest, Hungary

  • 25 May 2016

    Wojciech Wiewiórowski visits the European Institute of Innovation and Technology, Budapest, Hungary

  • 25 May 2016

    General Data Protection Regulation and Startups, Speech by Giovanni Buttarelli, European Parliament, Brussels, Belgium

  • 25 May 2016

    AmCham EU’s Plenary Meeting, Keynote speech by Giovanni Buttarelli, Brussels, Belgium

  • 24 May 2016

    Giovanni Buttarelli presents the EDPS Annual Report 2015 to the LIBE Committee, European Parliament, Brussels, Belgium

  • 23 May 2016

    Association of Corporate Counsel Annual Conference, Giovanni Buttarelli gives a keynote speech on EU Data Protection Regulation, Rome, Italy

  • 23 May 2016

    Cyber 2016: Evolving Threats, Security Developments and Improving Cooperation, Chatham House Cyber Conference, Speech and panel discussion by Wojciech Wiewiórowski on Data Protection, Privacy and National Security, London, UK