The legal reference of the Personal data protection in the European Institutions and Bodies is the "Regulation (EC) 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data".
The Regulation 45/2001 is the legal framework which regulates the processing of personal data by the EU Institutions and bodies. Text here
- Indexed version of the Regulation 45/2001. This is a useful version as the legal stipulations are linked to other legislative acts that makes reference or is connected to. Text here .
- Implementing rules
Concerning the Data Protection Officer pursuant to Article 24(8) of Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data. Text here.
- Charter of fundamental rights of the European Union
The European Union recognises the rights, freedoms and principles set out in this charter, granting for the first time a distinct right to protection of personal data. Text here .
- European Convention for the Protection of Human Rights and Fundamental Freedoms,
considering that the aim of the Council of Europe to maintain, protect and further recognize human rights and fundamental freedoms such as the right to respect for private life. Text here .
- Convention 108 of The Council of Europe
Provides safeguards for everyone's rights and fundamental freedoms, in particular the right to the respect for privacy, considering the increasing flow across frontiers of personal data undergoing automatic processing. Text here.
- Consolidated version of the Treaty of The European Union. Text here.
- Article 16 of the Treaty on the Functioning of the European Union clearly states that "Everyone has the right to the protection of personal data concerning him or her". Text here.
It is the legal framework on the protection of individuals with regard to the processing of personal data and on the free movement of such data in the private sector. Text: here.
- Status of implementation of Directive on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Text.
- Follow-up of the Work Programme for better implementation of the Data Protection Directive (95/46/EC). Text.
- Application to the EFTA countries Norway, Iceland and Liechtenstein under the EEA AGREEMENT - Decision of the EEA Joint Committee No 83/1999 of 25 June 1999 amending Protocol 37 and Annex XI (Telecommunication services) to the EEA Agreement OJ L 296/41, of 23.11.2000. Text.
- Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector. Text.
- Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC. Text.
- Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users' rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws. Text.
Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters. Text.
The EU policy on personal data protection seeks to strike a balance between a high level of protection for the privacy of individuals and the free movement of personal data within the EU. The Commission's Decisions represent another tool in establishing the adequacy of a third country for compliance with the EU data protection law.
There are several categories of decisions, such as:
- Council Decision of 13 July 2010 on the conclusion of the Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program (TFTP Agreement. Text here.
- Commission's Decisions on validating third countries which meet the adequacy requirement when data transferred from EU. Text here,
- Commission's Decisions on standard contractual clauses for the transfer of personal data to third countries. Text here
- Commission's Decisions on the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries. Text here.
The ECJ rulings represent another source of community law and therefore are very important for implementing the community law in practice. For this reason, here are provided some of the most representative opinions, judgments and addressed questions.
European Court of Justice: Joined Cases C‑468/10 and C‑469/10 - Asociación Nacional de Establecimientos Financieros de Crédito (ASNEF) (C‑468/10), Federación de Comercio Electrónico y Marketing Directo (FECEMD) (C‑469/10) v Administración del Estado (judgement of 24 November 2011).
Processing of personal data – Directive 95/46/EC – Article 7(f) – Direct effect. Text
European Court of Justice: C-70/10 - Scarlet Extended SA v Société belge des auteurs, compositeurs et éditeurs SCRL (SABAM) (judgement of 24 November 2011).
Information society – Copyright – Internet – "Peer-to-peer" software – Internet service providers – Installation of a system for filtering electronic communications in order to prevent file sharing which infringes copyright – No general obligation to monitor information transmitted. Text
Protection of natural persons with regard to the processing of personal data - Publication of information on beneficiaries of agricultural aid - Validity of the provisions of European Union law providing for that publication and laying down detailed rules for such publication - Charter of Fundamental Rights of the European Union - Articles 7 and 8 - Directive 95/46/EC - Interpretation of Articles 18 and 20. Text
European Court of Justice: C-518/07 European Commission supported by European Data Protection Supervisor v Federal Republic of Germany (judgement of 9 March 2010).
Failure of a Member State to fulfil obligations - Directive 95/46/EC - Protection of individuals with regard to the processing of personal data and the free movement of such data - Article 28(1) - National supervisory authorities - Independence - Administrative scrutiny of those authorities. Text
European Court of Justice: C-28/08 P - European Commission v The Bavarian Lager Co. Ltd, European Data Protection Supervisor (judgement of 29 June 2010).
Appeal - Access to the documents of the institutions - Document concerning a meeting held in the context of a procedure for failure to fulfil obligations - Protection of personal data - Regulation (EC) No 45/2001 - Regulation (EC) No 1049/2001. Text
European Court of Justice: C-553/07 College van burgemeester en wethouders van Rotterdam v M.E.E. Rijkeboer Netherlands (judgement of 7 May 2009).
Protection of individuals with regard to the processing of personal data - Directive 95/46/EC - Respect for private life - Erasure of data - Right of access to data and to information on the recipients of data - Time-limit on the exercise of the right to access. Text
European Court of Justice: C-557/07 (order of the Court of 19 February 2009 (reference for a preliminary ruling from the Oberster Gerichtshof (Austria).
LSG-Gesellschaft zur Wahrnehmung von Leistungsschutzrechten GmbH v Tele2 Telecommunication GmbH) "Article 104, paragraph 3 of the Rules of Procedure - Information society - Copyright and related right - Retention and disclosure of certain traffic data - Protecting the confidentiality of electronic communication - 'Intermediaries' within the meaning of Article 8, paragraph 3 of Directive 2001/29/EC. Text
Court of First Instance: T-259/03 (judgment of 12 September 2007) Nikolaou v Commission.
Non-contractual liability - Inquiry of the European Anti-Fraud Office (OLAF) concerning a Member of the Court of Auditors - Divulgence of information - Protection of personal information - Access to the inquiry file and to OLAF's report - Sufficiently serious breach of the rules of law conferring rights on individuals - Causal link - Loss) / Re: Action for damages, pursuant to the second paragraph of Article 288 EC, for the loss suffered by the applicant following publication of information concerning an inquiry carried out concerning her by the European Anti-Fraud Office (OLAF) and OLAF's refusal to grant her access to the inquiry file and to supply her with a copy of its final report. Text
European Court of Justice: C-524/06 Heinz Huber v Bundesrepublik Germany (judgment of 16 December 2008).
Protection of personal data - European citizenship - Principle of non-discrimination on grounds of nationality - Directive 95/46/EC - Concept of necessity - General processing of personal data relating to citizens of the Union who are nationals of another Member State - Central register of foreign nationals. Text
European Court of Justice: C-73/07 Tietosuojavaltuutettu v Satakunnan Markkinapörssi Oy, Satamedia Oy (judgment of 16 December 2008).
Directive 95/46/EC - Scope - Processing and flow of tax data of a personal nature - Protection of natural persons - Freedom of expression. Text
European Court of Justice: Case C-275/06 (Judgment of 29 January 2008) /Reference for a preliminary ruling from the Juzgado de lo Mercantil No 5 de Madrid - Spain/ Productores de Música de España (Promusicae) v Telefónica de España SAU.
Information society - Obligations of providers of services - Retention and disclosure of certain traffic data - Obligation of disclosure - Limits - Protection of the confidentiality of electronic communications - Compatibility with the protection of copyright and related rights - Right to effective protection of intellectual property. Text
European Court of Justice: Joined Cases C-317/04 and C-318/04 (judgment of 30 May 2006/ European Parliament v Council of the European Union.
The court annuls the council decision concerning the conclusion of an agreement between the European Community and the United States of America on the processing and transfer of personal data and the Commission decision on the adequate protection of those data - Protection of individuals with regard to the processing of personal data - Air transport - Decision 2004/496/EC -Agreement between the European Community and the United States of America - Passenger Name Records of air passengers transferred to the United States Bureau of Customs and Border Protection - Directive 95/46/EC - Article 25 -Third countries - Decision 2004/535/EC - Adequate level of protection. Text
European Court of Justice: Joined Cases C-465/00, C-138/01 and C-139/01 (Judgment of 20 May 2003) / Reference for a preliminary ruling from the Verfassungsgerichtshof and Oberster Gerichtshof: Rechnungshof (C-465/00) v Österreichischer Rundfunk and Others and between Christa Neukomm (C-138/01), Joseph Lauermann (C-139/01) and Österreichischer Rundfunk
Protection of individuals with regard to the processing of personal data - Directive 95/46/EC - Protection of private life - Disclosure of data on the income of employees of bodies subject to control by the Rechnungshof. Text
European Court of Justice: C-101/01 (judgment of 6 November 2003) / Reference for a preliminary ruling from the Göta hovrätt: Bodil Lindqvist.
Directive 95/46/EC - Scope - Publication of personal data on the internet - Place of publication - Definition of transfer of personal data to third countries - Freedom of expression - Compatibility with Directive 95/46 of greater protection for personal data under the national lgislation of a Member State. Text