European Union: Data Protection Directive Takes Effect

IRIS 1998-10:1/4

Natali Helberger

Institute for Information Law (IViR), University of Amsterdam

The Directive on the protection of individuals with regard to the processing of personal data and on the free movement of such data came into force on 25 October 1998. This obliges member states to take the legal, technical and organisational measures needed to provide a uniform level of protection throughout the Community concerning automated processing and storage of personal data in data banks. The Directive states that personal data may, in principle, be processed only with the consent of the person concerned, or for one of the special reasons which it lists. The processing of certain sensitive data may be totally prohibited in some circumstances. The processing of personal data is closely bound up with the purpose for which they were collected. Exceptions to the rules laid down in the Directive are permissible, with a view to freedom of opinion and information, for journalistic, literary or artistic purposes - particularly in the audiovisual field.

The Directive gives the persons concerned a broad range of rights, from information rights, through access and deletion rights, to the right to object to processing and the right to compensation. The processor must also notify a national supervisory authority which is to be set up, and which will have comprehensive powers of investigation and intervention and a right of access to data.

Personal data may be transferred to non-EU states only if these states provide an adequate level of protection. The obligation on member states of ensuring that data are not transferred to outside states where the level of protection is regarded as unsatisfactory, has already led to negotiations between the EU and the USA and to provisional postponement of a possible data embargo.

So far, only Greece, Portugal, Sweden, the United Kingdom and Italy have implemented the Directive, or at least its main provisions. In the other member states - apart from Germany, France and Luxembourg - the necessary legislation is on the way.