Data Protection Directive

Data Protection Directive

The Data Protection Directive (Directive 95/46/EC) was a European Union directive adopted in 1995 which regulated the processing of personal data within the European Union (EU). It was a critical piece of legislation aimed at protecting the privacy and personal data of individuals.

Background

The directive was established to harmonize the protection of fundamental rights and freedoms of natural persons in respect to processing activities and to ensure the free flow of personal data between member states. It was a response to the increasing importance of data processing in the digital age and the need for a consistent approach across the EU.

Key Provisions

Scope and Definitions

The directive applied to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.

• Personal Data: Any information relating to an identified or identifiable natural person ("data subject").
• Processing: Any operation or set of operations performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

Principles Relating to Data Processing

The directive established several key principles for data processing:

• Data Quality: Personal data must be processed fairly and lawfully, collected for specified, explicit and legitimate purposes, and not further processed in a way incompatible with those purposes.
• Legitimacy: Processing is only lawful if the data subject has unambiguously given their consent or if processing is necessary for the performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task carried out in the public interest, or the legitimate interests pursued by the controller.

Rights of the Data Subject

The directive granted several rights to data subjects, including:

• Right of Access: Data subjects have the right to obtain from the data controller confirmation as to whether or not data relating to them is being processed, and information about the purposes of the processing, the categories of data concerned, and the recipients to whom the data are disclosed.
• Right to Rectification, Erasure, or Blocking: Data subjects have the right to request the rectification, erasure, or blocking of data that is inaccurate or processed in violation of the directive.

Obligations of Data Controllers

Data controllers were required to implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

Impact and Legacy

The Data Protection Directive laid the groundwork for data protection laws across the EU and influenced data protection legislation worldwide. It was eventually replaced by the General Data Protection Regulation (GDPR) in 2018, which introduced more stringent requirements and expanded the rights of data subjects.

See Also

• General Data Protection Regulation
• Privacy and Electronic Communications Directive
• European Union law

References

• Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data

External Links

• European Commission - Data Protection