EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws EU data protection law is grounded in EU constitution - al sources, notably Article 16, Treaty on the Function - ing of the European Union (TFEU) which constitutes the legal basis for legislation and fundamental rights protection (Article 7 of the Charter of Fundamental Rights of the EU which consecrates respect for pri - vate life and family life, and Article 8 which directly consecrates the protection of personal data). These establish both EU legislative competence and the constitutional status of data protection as a funda - mental right). The centrepiece of the data privacy framework is the General Data Protection Regulation (Regulation (EU) 2016/679 (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data), which was adopted by the EU and became directly applicable across all member states on 25 May 2018 without the need for national transposition. The GDPR prevails over incompatible national pro - visions. Its objective is to ensure an equal and har - monised level of protection for personal data across the Union while safeguarding the free movement of such data. It operates as the EU’s general (horizontal) regime for personal data processing. These sources interact through the primacy and direct applicability of EU law: the GDPR serves as the default framework, while sectoral instruments either displace it for specific scopes or add rules consistent with GDPR principles (lex specialis). EU-level interpretation is also shaped materially by Court of Justice of the European Union (CJEU) case law. The CJEU’s jurisprudence has been central in defining core concepts of data protection law. Additionally, EU regulatory convergence is promoted through EDPB soft-law instruments (for example, Guidelines 05/2021). While formally non-binding, these guidelines play a significant harmonising role in enforcement practice.
The GDPR has explicit extraterritorial reach where processing relates to the offering of goods or services to individuals in the EU or monitoring their behaviour in the EU (Article 3 (2), GDPR), and its international transfer regime can significantly extend compliance requirements beyond the EU (Chapter V, GDPR), as reflected in leading transfer case law (CJEU, Schrems II, Case C-311/18). The EU privacy/data protection framework also over - laps with EU regimes on non-personal data, cyberse - curity and AI: non-personal and mixed datasets are addressed through the free flow framework and data economy rules (Regulation (EU) 2018/1807 (Free Flow of Non-Personal Data); Regulation (EU) 2022/868 (Data Governance Act); Regulation (EU) 2023/2854 (Data Act)), while security obligations intersect with GDPR security requirements (Directive (EU) 2022/2555 (NIS2 Directive); Article 32, GDPR). AI governance adds fur - ther product- and risk-based obligations that must be implemented alongside GDPR where personal data is used (Regulation (EU) 2024/1689 (AI Act)). 1.2 Rights and Obligations Under EU law, the general principles governing the processing of personal data are set out in the GDPR. Article 5, GDPR establishes core principles which structure all processing activities: lawfulness, fairness and transparency; purpose limitation; data minimisa - tion; accuracy; storage limitation; integrity and confi - dentiality; and accountability (Article 5 (1)-(2), GDPR). Chapter 2 (Articles 6-11), GDPR sets out the substan - tive conditions for lawful processing. Processing must be based on one of the lawful grounds listed in Arti - cle 6, GDPR (consent, contract, legal obligation, vital interests, public task or legitimate interests) (Article 6 (1), GDPR), with stricter conditions for special catego - ries of data (Article 9, GDPR). Chapter 4 (Articles 24-43), GDPR establishes obliga - tions for controllers and processors. Controllers bear primary responsibility for ensuring and demonstrating compliance (Articles 5 (2) and 24), must implement data protection by design and by default (Article 25), conduct data protection impact
88 CHAMBERS.COM
Powered by FlippingBook