Origins of Data Protection Law

Study Notes

Technological advancements in the 1960s-1970s led to the widespread collection, storage, and processing of personal data, raising privacy concerns.
International data processing created challenges regarding privacy controls, highlighting inadequacies in national laws to address automated data complexities.
Increased public concern emerged as personal data became valuable, with fears of misuse by governments and private entities driving demands for stronger protections.

Universal Declaration of Human Rights (UDHR, 1948):
- Article 12: Protects against arbitrary interference with privacy.
- Article 19: Ensures freedom of expression and the right to information.
- Article 29(2): States rights may be limited to respect others' rights.
European Convention on Human Rights (ECHR, 1950):
- Article 8: Guarantees respect for private and family life but allows lawful interference when necessary in a democratic society.
- Article 10: Protects freedom of expression while allowing restrictions to balance privacy rights.
- European Court of Human Rights (ECtHR) enforces these rights across Europe.

1960s-1970s Initiatives:
- Council of Europe adopted Recommendation 509 (1968) to outline principles for data protection.
- Resolutions 73/22 and 74/29 established initial principles for protecting data in automated databanks.
1980 OECD Guidelines:
- Collaborated with the Council of Europe to create framework principles for transborder data flow and personal information protection.
1981 Convention 108:
- First binding international treaty focused on data protection, requiring signatory nations to adopt protective principles into national laws.
- Open to non-European countries, it aimed for broader international applicability.
Key Features of Convention 108:
- Legally binding obligations for data protection.
- Striking a balance between privacy needs and free data flow for trade.
- Provided a consistent framework for nations to adopt unified data protection measures.

Diverse national implementations of data protection laws resulted in a fragmented legal landscape in Europe, complicating cross-border business operations and individual rights protection.
The Data Protection Directive (95/46/EC, 1995) was established to harmonize data protection laws within EU member states, mitigating inconsistencies from Convention 108 implementations.
Key provisions of the Directive included the establishment of Data Protection Authorities (DPAs) in member states to enforce data protection laws effectively.