What is data protection law?

Many US scholars and practitioners misunderstand the nature of data protection law. They conceptualize it as a branch of informational privacy law ignoring the fact that data protection law regulates both public and private personal information and was created to protect interests other than the interest of individuals in preserving their privacy.

One helpful analogy to understand the right to data protection in Europe is this: In the same way that US citizens have a constitutional right to bear arms, which is different and distinct from, but connected with, their right to self defense; Europeans have a right to data protection, which is different and distinct from, yet connected with, their right to privacy.

But, what is the history, essence and present implementation of data protection all about?

Data protection law originated in several European jurisdictions in the 1970s as a reaction to the rise of computers. The consensus in Europe at the time was that existing law (including privacy law) would not be able to effectively protect individual rights from the risks brought about by the use of automated data processing systems.

The Council of Europe (an international organization to which all EU countries belong) played a key role in the development of data protection law. In 1973 and 74 it issued two influential resolutions that were the seeds from which data protection law sprouted and laid down the data protection processing principles that to this day are at the core of EU data protection law. Most importantly, on January 28 of 1981, the Council opened for signature the ‘Convention for the Protection of Individuals with regard to Automated Processing of Personal Data’ (known as ‘Convention 108’). This convention is remains to this day the only international binding agreement in the field of data protection law. Incidentally it is the reason why Europeans celebrate Data Protection Day annually on January 28th. The original name given to this new legal field was ‘protection of individuals with regard to automated processing of personal data’. This name was clearly too long and was eventually shortened to ‘Data Protection Law’.

Read more about Convention 108

Early data protection laws regulated only the automated processing of personal data (that is to say, digitized personal data), but in 1995 the EU data protection directive expanded the material scope of data protection law to include filing systems.

The approach that EU data protection law took to ensuring individuals would be protected from the risk of computers was twofold: on one hand the law was designed to, quite literally, control how computers are allowed to “think” about humans (what they can learn about us, what they must forget about us and when, for what purposes they can use what they know about us, what decisions they can make about us, and how they are supposed to explain all of that to us) and, on the other hand, the law granted specific rights to individuals that could be exceeded against any entity that had control over the processing of personal data related to the individual.

The key point is that, as opposed to informational privacy law, data protection law was not designed to protect private information from disclosure but to protect people from a specific form of technology: computers. Perhaps the history of Europe best explains the European desire to ensure information technologies are used in an ethical manner and their inherent mistrust towards computers. Although the potential for good in new technology surely did not escape European lawmakers, the question of how the holocaust would have looked, if a database capable of tracking the whereabouts and religion of all european citizens existed at the time, was likely not far from their minds either.

Read more about the history of data protection law

There are several examples of early data protection laws in the EU but the first pan-European data protection law was enacted in 1995 and remained in effect until it was derogated in 2016. It’s framework was built on four core tenets that have proven strong enough to drive effective compliance yet flexible enough to adapt to the ever-changing nature of technology. These tenets were not changed by the General Data Protection Regulation (GDPR).

(1) Technology must be built to serve humankind

The overarching goal of data protection law is to ensure that technology is designed ‘to serve mankind’. To prevent unethical uses of technology, data protection distinguishes between permissible and non permissible purposes. EU data protection law identifies six categories of purposes (called ‘lawful basis’) that constitute the universe of what is permissible and outlaws the use of digitized personal data for any purposes that fall outside of those six categories. It could be said that the general rule under data protection law is that you are ‘guilty’ of unlawful processing unless you can prove your ‘innocence’ by identifying your lawful basis for processing.

As opposed to privacy law, data protection law is purpose-centric not consent-centric. Data protection laws across the globe today define what purposes are permitted typically following the EU example of including a list of permitted “lawful basis” for processing. The specific list varies from country to country but, as a general rule, what data protection outlaws is any processing that does not revert back to the benefit of the individual involved or society as a whole. In other words, the pure monetization of personal data is outlawed under data protection law.

Perhaps the history of Europe best explains this restrictive approach. Although the potential for good in new technology surely did not escape European lawmakers, the question of how the holocaust would have looked, if a database capable of tracking the whereabouts and religion of all european citizens existed at the time, was likely not far from their minds either.

(2) Factual control = accountability

Under EU Data Protection Law accountability for data handling is directly proportional to factual control. Any entity that “alone or jointly with others, determines the purposes and means of the processing of personal data” is considered a “controller”. Entities that act “on behalf” of “controllers” are considered “processors”.

Data protection law applies almost the exact same obligations and principles to both the public and private sectors. From the point of view of data protection law, who controls the computer is irrelevant as long as a computer is involved.

Because Europeans see data protection as a fundamental right, very few organizations are exempted from complying with data protection law. By limiting the exemptions and equating control to accountability, EU data protection law effectively creates an unbreakable ‘chain of custody’ over digitized personal data.

(3) Personal does not mean private

Since the goal of data protection law is to protect the individuals from unethical technology, data protection law regulates all digitized information that can be connected to a natural person.

European data protection law has always restricted the processing of ‘personal data’ and, defines the term to mean ‘‘information relating to an identified or identifiable natural person’. This definition is rather short but its scope as interpreted by European courts and data protection authorities is extremely broad

It is important to note that:

• Information need not be private or confidential to be subject to data protection law. In fact, some of the most widely known things about us -such as our names- and the most public moments of our lives — such as our wedding day— are also unquestionably personal. Proof of a special interest to prevent dissemination or misuse is not needed, and establishing a ‘reasonable expectation of privacy’ is not required. Therefore, publicly available data is subject to data protection law so long as it is ‘personal’ in nature.
• Information need not be sensitive to be subject to data protection law. EU data protection law has traditionally placed additional restrictions on the processing of ‘special categories’ of information with the goal to prevent discrimination. ‘Special categories’ include data that historically has been a vector for discrimination such as race, religion, political affiliation or sexual orientation (See, Article 9 of the GDPR). However, there is no minimum threshold of sensitivity below which data protection law does not apply.

(4) Transparency is key

A key goal of data protection law has always been to enhance the transparency of data processing.

Transparency is seen as a prerequisite for fairness because, in many ways, compliance with data protection law is a ‘black box’. From granting rights on individuals to requiring the creation and implementation of data management policies, imposing record keeping obligations, and enabling a private right of action, many provisions in data protection law are designed to ensure transparency.

Modern data protection law in the EU is composed of a constitutional right to data protection, statutory data protection law and case law.

Relevant guidelines on data protection law have been provided and will continue to be provided by Supervisory Authorities (SAs), the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS). Although they are informative interpretations of EU data protection law and constitute a road-map for enforcement, they are not in and of themselves ‘law’

Additional resources

Laws

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA

Brexit

UK GDPR https://ukgdpr.fieldfisher.com/

Resources

• “The EU Data Protection Regime: Setting Global Standards for the Right to Personal Data Protection”. Report of the XXIX FIDE Congress 2020, with overview reports by Orla Lynskey, Anna Buchta and Herke Kranenborg, in addition to country reports by prominent lawyers from each Member State. Includes analysis, trends, European and national case-law, approaches in national implementation.
• Data protection officer handbook (2019): By Douwe Korff and Marie Georges This Handbook was prepared for and is used in the EU‐funded “T4DATA” training‐of-trainers programme. Part I explains the history and development of European data protection law and provides an overview of European data protection instruments including the Council of Europe Convention and its “Modernisation” and the various EU data protection instruments relating to Justice and Home Affairs, the CFSP and the EU institutions, before focusing on the GDPR in Part II. The final part (Part III) consists of detailed practical advice on the various tasks of the Data Protection Officer now institutionalised by the GDPR. Although produced for the T4DATA programme that focusses on DPOs in the public sector, it is hoped that the Handbook will be useful also to anyone else interested in the application of the GDPR, including DPOs in the private sector. It is made publicly available under a “Creative Commons” (CC) License.