Law & Data Course Overview 2024/2025

The process by which a European state can officially join the European Union.

The fundamental values that a state must respect to be eligible for EU membership.

These values include human dignity, freedom, democracy, equality, the rule of law and respect for human rights, including the rights of persons belonging to minorities.

The specific article in the Treaty on European Union (TEU) outlining the process of EU membership.

A state applying to the EU must formally address its application to the Council of the European Union.

The Council, acting unanimously, must consult the European Commission and receive consent from the European Parliament.

The European Parliament must vote by majority to approve the application.

The conditions for eligibility agreed upon by the European Council will be taken into account during the membership application process.

The principle states that limitations on fundamental rights must be proportionate, meaning necessary and genuinely meeting objectives of general interest or protecting the rights and freedoms of others.

EU law is derived from the constitutional traditions of its member states, and these traditions are reflected in the EU's legal principles.

The EU can conclude agreements with other countries or international organizations when the Treaties allow it or when it's needed to achieve EU policy objectives.

A legal principle that ensures clarity and predictability in the law, making it possible for individuals and businesses to understand and comply with legal rules.

The EU takes its legal obligations seriously and ensures that everyone involved is treated fairly and consistently.

EU law takes precedence over national laws when the two conflict, ensuring uniform application of EU rules across member states.

Individuals can directly rely on EU law before national courts, meaning they can claim their rights under EU law.

Fundamental rights are protected in EU law, drawing upon the European Convention of Human Rights and the constitutional traditions of member states.

The right to privacy, also known as the right to be let alone, encompasses personal freedoms and autonomy over one's private life. It protects individuals from unwanted intrusion into their personal affairs, including their reputation, honour, image, family life, and personal information.

Privacy rights are rooted in the common law tradition, which emphasizes individual liberties and the right to be free from unreasonable interference. This tradition acknowledges the inherent value of autonomy and self-determination.

The right to privacy in civil law traditions is often grounded in the right to dignity. This concept emphasizes the inherent worth and respect due to every individual.

Personal data refers to any information related to an identifiable person, including name, identification numbers, location data, online identifiers, or factors revealing physical, physiological, genetic, mental, economic, cultural, or social identity. It is essentially any information that can be used to identify someone personally.

Personal data, according to the GDPR, is subject to the right to protection. This means individuals have rights over their personal data, including the right to access, correct, and erase their data.

The right to privacy and the right to personal data protection are distinct but interconnected. They both aim to protect individuals' autonomy and control over their personal sphere, but focus on different aspects: privacy on a broader personal life, personal data on specific information.

Human rights are fundamental rights inherent to all individuals, regardless of their background or status. They are universal, inalienable, and indivisible, and they encompass a broad range of rights, including the right to life, liberty, and security of person.

The Universal Declaration of Human Rights (UDHR), adopted in 1948, articulates the fundamental rights of every human being. Article 12 of the UDHR specifically addresses the right to privacy, stating that no one shall be subjected to arbitrary interference with their privacy, family, home, or correspondence, or attacks upon their honor and reputation.

The Brandeis definition of privacy emphasizes the right to be let alone, considering it a comprehensive and highly valued human right.

The right to privacy encompasses various facets, including the right to reputation, honor, image, private and family life, non-interference, personal identity and dignity, and control over personal information, all aiming to protect individuals' autonomy and personal space.

OECD Privacy Guidelines were established in 1980 and set the foundation for universal data protection standards.

The Collection Limitation Principle (OECD) states that personal data should only be collected for specified, explicit, and legitimate purposes.

The Data Quality Principle (OECD) ensures data is accurate, complete, and up-to-date.

The Purpose Specification Principle (OECD) dictates that personal data can only be processed for the purposes stated at collection.

The Use Limitation Principle (OECD) restricts the use of personal data to the specified purposes and prohibits further processing without consent.

The Security Safeguards Principle (OECD) mandates reasonable technical and organizational security measures to protect personal data from unauthorized access, processing, or disclosure.

The Openness Principle (OECD) requires clear and accessible information about data processing practices.

The Individual Participation Principle (OECD) grants individuals the right to access, rectify, or erase their personal data.

The Accountability Principle (OECD) holds data controllers accountable for complying with privacy principles.

The CoE Convention 108, adopted in 1981, is the first legally binding international instrument addressing data protection, including the right to personal data protection.

The European Electronic Communications Code (Recast) aims to create a harmonized framework for regulating electronic communications networks, services, and equipment within the EU.

The Directive 2016/680/EU provides data protection guidelines for law enforcement agencies, ensuring their compliance with the General Data Protection Regulation (GDPR) and establishing procedures for processing personal data in police and judicial cooperation.

The GDPR (General Data Protection Regulation) and Regulation 2018/1725/EU establish rules for processing personal data within the EU, ensuring data protection for individuals and organizations.

A data subject is any individual who is identifiable or can be identified from information processed by a controller or processor.

The data controller is responsible for deciding how and why personal data is processed, making key decisions about how that data is used.

A data processor is a party that processes personal data on behalf of the data controller, following their instructions.

Data subjects have the right to access, rectify, erase, restrict, and object to the processing of their personal data. They also have the right to data portability. This means they can request a copy of their personal data in a portable format.

The GDPR mandates that controllers adopt technical and organizational measures (TOMs) to protect personal data, including security policies and procedures.

A data protection management system (DPMS) is a risk-based compliance system that helps organizations implement and monitor their data protection measures.

The data processor must process personal data according to the data controller's instructions, implement appropriate technical and organizational measures (TOMs), and maintain a record of processing activities.

A data protection officer (DPO) acts as an independent expert, advising and monitoring controllers and processors on data protection compliance.

The GDPR outlines several principles for processing personal data, including lawfulness, fairness, and transparency. These principles ensure that personal data is handled ethically and responsibly.

The GDPR requires controllers to provide data subjects with clear information about their personal data processing practices and choices.

Controllers and processors need to maintain records of their processing activities, detailing the data involved, purposes, recipients, and any transfers to third countries.

The GDPR grants data subjects the right to erase their personal data, known as the "right to be forgotten," under certain circumstances.

Any operation performed on personal data, whether automated or not, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, alignment, combination, restriction, erasure, or destruction.

A legal document that outlines the rules for processing personal data, focusing on safeguarding individuals' rights.

Special categories of personal data, such as racial origin, political opinions, religious beliefs, health information, and sexual orientation.

A statement that explicitly outlines the purpose for which personal data will be collected and processed.

A freely given, specific, informed, and unambiguous indication of a data subject's consent to the processing of their personal data. This can be expressed through a statement or a clear affirmative action.

A person who advises organizations on data protection compliance and ensures their data processing activities adhere to GDPR regulations.

An assessment of the risks to individuals' rights and freedoms posed by the processing of personal data. This includes identifying and mitigating potential risks.

The principle requires that personal data be relevant and limited to what is necessary for the stated purposes of processing. It emphasizes proportionality and avoiding excessive data collection.

This principle ensures that personal data is accurate and kept up-to-date. If inaccurate, the data should be corrected or erased.

Personal data should be kept only for as long as necessary for the stated purposes of processing. This minimizes the storage period and helps protect privacy.

This comprises a set of principles crucial to data protection. These principles establish guidelines for processing personal data and safeguard individuals' rights.

The principle of "accountability" outlines the responsibility of both the controller and the processor in ensuring compliance with data protection laws.

A document that provides information about how personal data will be collected, processed, and stored.