Article 6: member states
must ensure that data is
collected and processed
for specific, legitimate and
explicit purposes.
Article 25: data
transfer allowed to
third countries that
ensure adequate
protection
Article 26: derogations, three sets
of standard clauses
regarding data
transfer
Article 7: criteria for legitimising
processing: requires unambiguous
consent, or processing is necessary
for performance of a contract whic
the data subect is party in, or if its
necessary for legal compliance.
Charter of Fundamental Rights of EU 2002/58/EC
Article 7: family and private life
Article 8: protection of personal data
consent
TFEU: Treaty of the Functioning of the EU
Part 3: Union policies and internal actions
Title I: Internal Market: article
26, adoption of internal market,
no internal frontiers, freedom of
goods, persons, services and
capital
Title II: free movement of goods
Title V: area of freedom, justice and security
Article 288: adoption of
directives, regulations
Directive: secondary
legislation which allows
state discretion on
implementation
direct effect: only vertical
For direct effect to take place, along with the
Van Geld criteria, the Ratti criteria must be
met: that the deadline for implementation of
the directive has been passed by the member
state.
for direct effect to take place, the
three Van Geld criteria must be met: 1)
clear in intention, specific in language
and unconditional in implementation.
Decisions: binding in
entirety , to those it
addresses
Recommendations/opinions
have no binding force
Options for third
countries, after
Safe Harbour
removed
BCR: Developed by working party 29 in
2003, and considered a code of conduct,
binding corporate rules allow
multinational corporations to send
intra-organizational personal data
transfers across borders in compliance
with EU data protection laws. They must
be approved by each member states data
protection authority which the
corporation will handle personal data
from. BCR form a framework of several
elements to comply with EU standards.
stringent, corporate-wide global privacy policies
set of practices
processes and guidelines
Two conditions
binding nature: across the entire corporation
Legal enforceability: any EU citizen can
take the corporation to court if privacy
is breached.
Standard contractual clauses:
these are single sets of
contracts that are to
correspond with requirements
of article 26 (95/46/EC)
Other derogations: article 26 of the DPD
95/46/EC, conditions for transfer to
non-adequate third nations
consent
necessary for
performance
of contract
necessary/legally
required on public
interest grounds
that outweigh the
importance of the
citizen's privacy
protect vital
interests of data
subject
adequate
safeguards
DSM: Digital Single Market
Strategy is a priority for EU, and it
is to help the single market exist
online. Consists of three main
areas: better online access to
goods/services (level marketplace),
environment where goods/services
can prosper (good rules), and using
internet for economic growth.
Three priorities are geo-blocking,
roaming and leveling playing field
The digital agenda, one of
seven pillars outlined for
the EU 2020 strategy, seeks
to optimise and exploit the
use of Information and
Communication
Technologies (ICTs)
importances: EU
citizens should be fully
protected and receive
high service throughout
the EU. Benefit from
best content, deals and
services. Strength of
trust and security.
1) to level market place, better online
access to goods and services
2) create an environment where
goods and services can prosper (good
rules and laws)
3) the use of the internet for
economic growth
E-Commerce Directive:
sets up an internal market
framework for electronic
commerce, providing legal
certainty for businesses
and consumers alike.
E-commerce Directive: sets up an internal market
framework for electronic commerce, giving legal certainty
to both businesses and consumers. It establishes
harmonised rules on issues such as transparency and info
requirements for online service providers, commercial
communications, electronic contracts and limitations of
liability of intermediary service providers.