EU Law Overview

The legal framework governing the European Union, ensuring the law is upheld across member states.

The foundational legal acts of the EU, including treaties and the Charter of Fundamental Rights.

EU legal acts derived from primary law, like regulations, directives, and decisions.

A binding legal act applying equally to all EU member states, immediately effective.

A binding legal act setting goals for member states, leaving them to choose methods.

The EU's highest court, upholding EU law and providing preliminary rulings.

A ruling requested from CJEU on the interpretation and validity of EU law, for national courts.

The General Data Protection Regulation (GDPR) is guided by EU fundamental rights, like privacy and freedom of expression.

Data must be protected against unauthorized access, loss, or damage, using proper technology and procedures.

Different kinds of personal data need different reasons for processing, like contracts or legal compliance.

Data controllers are responsible for showing they comply with data protection rules and can prove it.

Businesses can store personal data for marketing, as long as the company exists.

Companies must implement security measures suitable for the risk involved when handling personal data.

The GDPR (General Data Protection Regulation) does not list specific categories of data that may not be processed.

Consent to process personal data must be freely given, specific, informed, and unambiguous. It's a specific way individuals show agreement to data processing.

Consent must be genuine and free-willed, without negative consequences for refusing. Right to withdraw at any time.

Consent given after understanding the data being processed, its purpose, and who will process.

Consent isn't a suitable legal basis when the power between individuals and controllers (like public authorities or employers) is unequal.

The individual's right to have personal data removed under specific conditions.

Data no longer needed for its original purpose.

Data processing permitted based on the individual's agreement.

Data processing justified by a valid need, overriding any objections.

Data processing in violation of legal requirements.

Data retention required by law.

If data shared, recipients must also erase it, unless impractical.

Processing allowed if the individual permits data usage.

Data transfers within a company group must be safe, following privacy principles and approved by the supervisory authority.

Data transfers to third countries require international agreements, like mutual legal assistance treaties or PNRs if necessary by a third-country court or administration.

Appropriate safeguards or adequacy decisions must be present, while explicit consent, contract performance, or vital interests must be evaluated for transfer justification.

Data transfers may still occur without adequacy decisions or safeguards if explicit consent, contract performance, public interest, legal claims, or vital interests apply.

Formal EU recognition that a third country provides an adequate level of personal data protection, allowing risk-free transfer without extra measures.

Supplemental measures put in place by data controllers to ensure adequate protection of personal data when transferring to countries without recognition (adequacy decisions).

A strong, justifiable reason (e.g., public health or investigation) to transfer data that outweighs the individual's privacy rights, considering all aspects.

Data controllers must inform the supervisory authority and data subjects about transfers, emphasizing the legitimate interest driving the transfer.

The legal basis for processing personal data by a public entity in the workplace under EU law.

The basis for private employers processing data in the workplace, focusing on 'legitimate interest'.

Explicit permission needed for direct marketing activities.

A lawful basis for marketing, sometimes used to process data.

Consent cannot be used as the basis for marketing activities related to a contract.