EU LAW RELATED TO ARTICLE 8 - PROTECTION OF PERSONAL DATA
LEGISLATION
EU-TREATIES
Article 39
In accordance with Article 16 of the Treaty on the Functioning of the European Union and by way of derogation from paragraph 2 thereof, the Council shall adopt a decision laying down the rules relating to the protection of individuals with regard to the processing of personal data by the Member States when carrying out activities which fall within the scope of this Chapter [Specific Provisions on the Common Foreign and Security Policy], and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities.
Article 16 (ex Article 286 TEC)
1. Everyone has the right to the protection of personal data concerning them.
2. The European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities. The rules adopted on the basis of this Article shall be without prejudice to the specific rules laid down in Article 39 of the Treaty on European Union. … Declarations Concerning Provisions of the Treaties
20. Declaration on Article 16 of the Treaty on the Functioning of the European Union
The Conference declares that, whenever rules on protection of personal data to be adopted on the basis of Article 16 could have direct implications for national security, due account will have to be taken of the specific characteristics of the matter. It recalls that the legislation presently applicable (see in particular Directive 95/46/EC) includes specific derogations in this regard.
21. Declaration on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation.
The Conference acknowledges that specific rules on the protection of personal data and the free movement of such data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 of the Treaty on the Functioning of the European Union may prove necessary because of the specific nature of these fields.
EU-REGULATIONS
laying down technical specifications for online collection systems pursuant to Regulation (EU) No 211/2011 of the European Parliament and of the Council on the citizens’ initiative This implementing regulation lays down technical specifications governing the treatment of statements of support for citizens’ initiatives so that personal data and family and private life are protected.
on the investigation and prevention of accidents and incidents in civil aviation and repealing Directive 94/56/EC Text with EEA relevance The Regulation includes provision for the protection of sensitive safety information and requires that ‘cockpit voice and image recordings and their transcripts, as well as voice recordings inside air traffic control units’ ‘shall not be made available or used for purposes other than safety investigation’ whilst ‘ensuring also that information not relevant to the safety investigation, particularly information with a bearing on personal privacy, shall be appropriately protected’ (Article 14(1))
on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data Official
establishing the European Network and Information Security Agency
EU-DIRECTIVES
on the application of patients’ rights in cross-border healthcare This Directive provides rules for facilitating the access to safe and high-quality cross-border healthcare and promotes cooperation on healthcare between Member States, in full respect of national competencies in organising and delivering healthcare. This Directive also aims at clarifying its relationship with the existing framework on the coordination of social security systems, Regulation (EC) No 883/2004, with a view to application of patients’ rights. (Article 1(1)) In particular, the Member State of treatment shall ensure that ‘the fundamental right to privacy with respect to the processing of personal data is protected in conformity with national measures implementing Union provisions on the protection of personal data’ (Article 4(2)(e)).
on the protection of individuals with regard to the processing of personal data and on the free movement of such data
concerning the processing of personal data and the protection of privacy in the electronic communications sector amending Directive 98/34/EC, laying down a procedure for the provision of information in the field of technical standards and regulations
concerning the processing of personal data and the protection of privacy in the electronic communications sector
2009/136/EC Directive of the European Parliament and of the Council amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services, Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws
EU-DECISIONS
- FRAMEWORK DECISIONS
on attacks against information systems
on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters
- DECISIONS
on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council (notified under document C(2010) 593) Text with EEA relevance This decision sets out standard contractual clauses for the transfer of personal data to processors established in third countries so that ‘respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding
establishing a secretariat for the joint supervisory data-protection bodies set up by the Convention on the Establishment of a European Police Office (Europol Convention), the Convention on the Use of Information Technology for Customs Purposes and the Convention implementing the Schengen Agreement on the gradual abolition of checks at the common borders
on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC
on the regulations and general conditions governing the performance of the European Data-protection Supervisor's duties
adopting a multiannual programme (2003-2005) for the monitoring of the eEurope 2005 action plan, dissemination of good practices and the improvement of network and information security (MODINIS)
appointing the independent supervisory body provided for in Article 286 of the EC Treaty (European Data Protection Supervisor)
adopting implementing rules concerning the Data Protection Officer pursuant to Article 24(8) of Regulation (EC) No 45/2001 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data
adopting the implementing rules governing Europol’s relations with partners, including the exchange of personal data and classified information
on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council
OTHER EU-LAW RELATED INSTRUMENTS
Safeguarding Privacy in a Connected World A European Data Protection Framework for the 21st Century
This communication recognised that ‘[m]odern, coherent rules across the EU are needed for data to flow freely from one Member State to another. Businesses need clear and uniform rules that provide legal certainty and minimise the administrative burden. This is essential if the Single Market is to function and to stimulate economic growth, create new jobs and foster innovation. A modernisation of the EU's data protection rules, which strengthens their internal market dimension, ensures a high level of data protection for individuals, and promotes legal certainty, clarity and consistency, therefore plays a central role in the European Commission's Stockholm Action Plan, in the Digital Agenda for Europe and, more broadly, for the EU's growth strategy Europe 2020’ The Commission proposed that a new Regulation replacing Directive 95/46/EC setting out the general EU framework for data protection and a new Directive setting out rules on the protection of personal data processed for the purposes of prevention, detection, investigation or prosecution of criminal offences and related judicial activities, should be adopted.
on data protection guidelines for the Early Warning and Response System (EWRS) (notified under document C(2012) 568) The Commission presented a set of data protection guidelines for the EWRS, which should help to clarify the respective roles, tasks and obligations of the various actors of this system and in that way guarantee effective compliance with the data protection rules and ensure the provision of clear information and easily available mechanisms for data subjects to assert their rights
Establishing the European Border Surveillance System (EUROSUR)
This proposal shall provide for the necessary legal framework to respond to the request of the European Council of 23-24 June 2011 to further develop the European Border Surveillance System (EUROSUR) as a matter of priority in order to become operational by 2013, allowing Member States' authorities carrying out border surveillance activities and the European Agency for the Management of Operational Cooperation at the External Borders of the Member States
The proposal acknowledges that ‘In exceptional cases personal data may form part of the data shared by Member States with the Agency provided that the conditions of Regulation (EC) No 2007/2004 of 26 October 2004 are met. To the extent personal data forms part of the national situational picture of neighbouring external border sections, it may be exchanged between neighbouring Member States only, under the conditions set by the horizontal EU legal framework on data protection.’
guidelines for the implementation of data protection rules in the Consumer Protection Cooperation System (CPCS) ‘These guidelines aim at addressing the central concern of ensuring a balance between efficient and effective enforcement cooperation amongst Member States competent authorities [engaged in national consumer protection] whilst respecting fundamental rights to privacy and the protection of personal data.’ (para. 2)
on the processing and transfer of Financial Messaging Data from the European Union to the United States for the purposes of the Terrorist Finance Tracking Program
‘The purpose of this Agreement is to ensure, with full respect for the privacy, protection of personal data, and other conditions set out in this Agreement, that: (a) financial payment messages referring to financial transfers and related data stored in the territory of the European Union by providers of international financial payment messaging services, that are jointly designated pursuant to this Agreement, are provided to the U.S. Treasury Department for the exclusive purpose of the prevention, investigation, detection, or prosecution of terrorism or terrorist financing; and (b) relevant information obtained through the [United States Department of the Treasury’s Terrorist Finance Tracking Program] is provided to law enforcement, public security, or counter terrorism authorities of Member States, or Europol or Eurojust, for the purpose of the prevention, investigation, detection, or prosecution of terrorism or terrorist financing.’
on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) COM/2012/011 final - 2012/0011 (COD) A new legal framework for the protection of personal data in the EU and its ‘free movement’ is proposed in this document. All aspects are relevant to the right to family and private life.
on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data
This is a proposal for a Directive of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data. All aspects are relevant to the right to family and private life.
Delivering an area of freedom, security and justice for Europe's citizens - Action Plan Implementing the Stockholm Programme The Commission noted that its Action Plan should reflect that ‘The Union must ensure that the fundamental right to data protection is consistently applied. We need to strengthen the EU’s stance in protecting the personal data of the individual in the context of all EU policies, including law enforcement and crime prevention as well as in our international relations.’
on ‘Respect for fundamental rights in European immigration policies and legislation’ (own-initiative opinion)
The Committee sees the ‘right to family life as one of the human rights that the EU and the Member States must protect and guarantee in their policies and legislation on immigration’. It suggests that the ‘minimalist nature of Council Directive 2003/86/EC on the right to family reunification enables some national laws not to fully guarantee the right to family reunification to third-country nationals. This was confirmed in the Commission report on the application of the directive [COM(2008) 610 final] which, raises doubts about the compatibility of applying integration measures as a precondition for admission to the territory under the right to family life (Charter Article 7) and the principle of proportionality.’ (para 4.4)
based on Article 29 (2) of the Council Framework Decision of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters COM/2012/012 final
A comprehensive approach on personal data protection in the European Union COM(2010) 609 final
| Comments: |
Last update June 2012 |