Sign in Subscribe

Data Protection Law

The right to the protection of individuals in the context of automated data processing is a distinct legal right that originated in Europe in the 1970s. It regulates how personal data is processed whether or not the information is private. In the EU, data protection and privacy are separate fundamental rights. Data protection laws now exist in many countries worldwide. The United States does not recognize an equivalent, as a distinct legal right separate from privacy.

Commission v Austria Why Formal Independence Is Not Enough

Commission v Austria Why Formal Independence Is Not Enough

The CJEU held that freedom from instructions did not make Austria’s data protection authority completely independent. Its personnel, staffing structure, and the Chancellor’s access to information still created unacceptable risks of indirect influence.

ASNEF: When Member States Cannot Rewrite the Lawful Bases for Processing

ASNEF: When Member States Cannot Rewrite the Lawful Bases for Processing

ASNEF established that Member States cannot rewrite EU lawful bases for processing or predetermine the legitimate-interest balance. The CJEU held that legitimate interests require a case-specific assessment of necessity and the individual’s competing rights and freedoms.

Ireland v. Parliament: The EU Had Power to Require Data Retention—But That Wasn’t the End of the Story...

Ireland v. Parliament: The EU Had Power to Require Data Retention—But That Wasn’t the End of the Story...

In Ireland v. Parliament and Council, the CJEU upheld the Data Retention Directive’s legal basis because it harmonized obligations on communications providers—but left unresolved whether mass data retention violated fundamental rights, the question later decided in Digital Rights Ireland.