Data Protection Directive 95/46/EC

Data Protection Directive 95/46/EC was a foundational legal instrument of the European Union that harmonized the protection of fundamental rights to privacy concerning the processing of personal data. Adopted under the Treaty establishing the European Community, it established a comprehensive regulatory framework for data controllers and processors operating within the European Economic Area. The directive sought to ensure the free flow of personal data between member states while setting high standards of protection, profoundly influencing global data privacy law until its replacement by the General Data Protection Regulation.

Background and legislative history

The initiative for a harmonized data protection law emerged from concerns over diverging national laws, such as those in France and Germany, and the need to facilitate the single market following the Maastricht Treaty. Early efforts included the Council of Europe's Convention 108 and non-binding OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. The European Commission, led by commissioners like Frans Andriessen, published a formal proposal in 1990. Negotiations involved the European Parliament, with notable input from MEP Michele Alliot-Marie, and the Council of the European Union, culminating in adoption in 1995. The directive was implemented following a transition period, with full effect from October 1998.

Key principles and provisions

The directive established core principles for lawful processing, including requirements for fairness, purpose limitation, and data minimization. It mandated a legal basis for processing, such as unambiguous consent or a contract, and introduced special categories for sensitive data akin to provisions in the German Federal Data Protection Act. Key rights for the data subject included rights of access, rectification, and objection, influenced by concepts from the CNIL. It required member states to establish independent supervisory authorities, like the Information Commissioner's Office in the United Kingdom. The directive also regulated transfers of data to third countries, permitting them only if an adequate level of protection was ensured, a standard later tested in cases like Schrems I.

Impact and implementation

The directive compelled all member states to enact or amend national legislation, leading to laws such as the Data Protection Act 1998 in the United Kingdom and the Bundesdatenschutzgesetz in Germany. It elevated the role of national authorities like the Garante per la protezione dei dati personali in Italy. The Article 29 Data Protection Working Party was established to provide consistent advice across the European Economic Area. The directive's adequacy mechanism for third-country transfers led to landmark decisions like the European Commission's EU-US Safe Harbor agreement and significantly influenced data protection frameworks in nations from Canada to Argentina.

Criticism and legal challenges

Critics argued the directive created a fragmented regulatory landscape due to its minimum harmonization approach, allowing variations between implementations in Sweden and Greece. The Court of Justice of the European Union addressed several shortcomings, notably in the Google Spain v AEPD case, which established the "right to be forgotten." The adequacy of protections for data transferred to the United States was fiercely contested, leading to the Max Schrems litigation that resulted in the Schrems I decision invalidating the Safe Harbor agreement. These cases highlighted tensions with intelligence activities under programs like PRISM and the jurisdiction of agencies like the National Security Agency.

Supersession by the General Data Protection Regulation

Recognizing the directive's limitations in the digital age, the European Commission began reform efforts, culminating in the adoption of the General Data Protection Regulation in 2016. The GDPR, developed under commissioners like Viviane Reding and Jan Philipp Albrecht, introduced direct applicability, eliminating the need for national transposition. It expanded the territorial scope, increased fines, and strengthened individual rights. The directive was formally repealed on 25 May 2018 when the GDPR became fully enforceable, marking a major evolution in the European Union's data protection regime influenced by the foundational work of its predecessor.

Category:European Union directives Category:Data protection Category:1995 in law