Search results

defined under Article 2(1)(a) Directive 95/46 where a third party has additional knowledge required to identify a data subject. b) Whether Article 7(1)(f) prevents

under Article 3(1) Directive 95/46. The court looked at the term personal data under Article 3(1) Directive 95/46 and Article 2(a) Directive 95/46 which

light of Article 4 of Directive 95/46, which sets out that each Member State has to apply the national provisions it adopts pursuant to Directive 95/46 to the

to transfer of personal data according to Article 25 Directive 95/46. Whether the provisions of Directive 95/46 are in conflict with the general principles

scope of the Data Protection Directive 95/46 under the exceptions stipulated in Article 3(2) of the Data Protection Directive 95/46? (2) Whether personal data

binding obligation of secrecy. Recital 171: Repeal of Directive 95/46/EC and Transition Phase Directive 95/46/EC should be repealed by this Regulation. Processing

particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’), Directive 2001/29/EC of the European Parliament and of the Council

previous Data Protection Directive 95/46/EC. Some of the principles are also reflected in Article 8 of the EU Charter of Fundamental Rights (EU Charter),

referred to in point (a) of Article 46(3); (i) to authorise administrative arrangements referred to in point (b) of Article 46(3); (j) to approve binding

implement aspects of the GDPR and the Law Enforcement Directive. Article 3(2) of the previous Directive 95/46/EG already exempted the rather sensitive area of

requirements from Article 9(2) and Article 9 (3) GDPR, but will also require an additional concomitant legal basis contained in Article 6(1) GDPR. However

previously existing definition under Article 2 (a) Directive 95/46/EC. The Directive itself derives the definition from Article 2 (a) Convention 108, according

between Article 21(3) GDPR and Article 17 GDPR on the right to erasure must be considered. The tight relationship between Article 21(3) and Article 17(1)(c)

establishes that Directive 95/46/EC applies to matters not covered by the provisions of the EPD. Given that Article 94 GDPR repeals Directive 95/46/EC and replaces

Article 94 - Repeal of Directive 95/46/EC 1. Directive 95/46/EC is repealed with effect from 25 May 2018. 2. References to the repealed Directive shall

access (Article 15 GDPR), rectification (Article 16 GDPR), deletion (Article 17 GDPR), restriction of processing (Article 18 GDPR), objection (Article 21 GDPR)

subject (Article 12(2) GDPR), respond and communicate the measures taken (Article 12(3) and (4) GDPR), the principle of freedom from costs (Article 12(5)

pass a national data protection act that was aligned with Directive 95/46/EC. Directive 95/46/EC allowed Member States to adapt the rules to national frameworks

and to the well-being of natural persons. Recital 3: Directive 95/46/EC Harmonisation Goal Directive 95/46/EC of the European Parliament and of the Council

legislator or intended. Compared with the previous Directive 95/46, Article 15(3) GDPR constitutes an additional right to receive a copy of all personal data

GDPR (Article 3)’, 12 November 2019 (Version 2.1), p. 6-7 (available here). EDPB, ‘Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)’, 12

for such performance. Article 7 GDPR regulates the "conditions for consent". It specifies the definition of consent set out in Article 4(11) GDPR and, by

decisions adopted pursuant to Article 45(3) of this Regulation and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC; (b) Chapter VII on cooperation

(“EDPB”). The EDPB replaces the Article 29 Working Party (“WP29”), the former advisory body established under Directive 95/46/EC. Notably, the powers granted

decisions adopted pursuant to paragraph 3 of this Article and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC. 5. The Commission shall, where

operations. Recital 89: Abolishment of Indiscriminate General Notification Directive 95/46/EC provided for a general obligation to notify the processing of personal

processing (Article 36(3)(c) GDPR); the contact details of the Data Protection Officer (DPO) (Article 36(3)(d) GDPR); a copy of the DPIA (Article 36(3)(e) GDPR)

processed. 3. Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may

Category:Article 33 GDPR There was no equivalent to Article 33 GDPR under the Data Protection Directive 95/46/EC. Indeed, Article 17 of the Directive only

Individuals with Regard to the Processing of Personal Data established by Directive 95/46/EC. It should consist of the head of a supervisory authority of each

Laundering Directive and the Europol Regulation. Noting that a broader reading of Article 98 GDPR is supported by the wording of Article 2(3) GDPR, which

decisions in Category:Article 25 GDPR The Data Protection Directive did not contain a similar provision. Although Article 17 DPD Recital 46 had a similar thrust

and freedoms of individuals", as stated in Article 35(1) and further elucidated in Article 35(3) and Article 35(4) GDPR. The WP29 developed a list of criteria

those answers prove to be inaccurate, within the meaning of Article 6(1)(d) of Directive 95/46, for example due to the fact that, by mistake, the examination

other binding obligation of secrecy. Article 10 GDPR is a complementary provision to the Law Enforcement Directive (LED). It aims to ensure that criminal

Charter of Fundamental Rights of the European Union ("CFR"), as well as Directive 95/46/EC. In the event that such verification is successful, the agreement

exercising of powers of SAs. It concerned the interpretation of Article 28 GDPR of Directive 95/46, the GDPR predecessor. It stays relevant with regard to concepts

point of legislative history, Article 85 GDPR is a development of Article 9 of the 95/46 directive of the European Union. Article 9 obliged Member States to

The roots of Article 39 GDPR can be partially retraced to the GDPR’s predecessor, the Directive 95/46/EC (DPD). In particular, Article 18 DPD mentioned

Regulation (GDPR): A Commentary, Article 38 GDPR, p. 702 (Oxford University Press 2020). In addition, although Directive 95/46/EC did not require organisations

withdraw consent under Article 7(3), object under Article 21 GDPR or if the processing is in fact compliant with the principles of Article 5(1) GDPR. Simply

decisions in Category:Article 34 GDPR As with that provision, there was no equivalent to Article 34 GDPR in the Data Protection Directive 95/46/EC. Additionally

policy under Article 13 should not be too long. Article 12 GDPR may be limited by Union or national Law in accordance with Article 23 GDPR. Article 12(1) GDPR

(e.g. Article 25 (1) and (2), Article 28(1), Article 32(1) GDPR, Article 89(1) GDPR). These measures can also be regarded as measures under Article 24(1)

proceedings under Article 79 GDPR can be brought both against a controller (as defined under Article 4(7) GDPR) and a processor (as defined under Article 4(8) GDPR)

point, it is important to note that Article 13(1)(f) GDPR, Article 14(1)(f) GDPR, Article 15(1)(c) GDPR and Article 15(2) GDPR, make specific reference

the relevance of Article 29 GDPR were rooted in the fact that Article 28(3)(b) GDPR already seems to cover much of the scope of Article 29 GDPR. More specifically

practices published under Article 70(3) GDPR. Though Article 70(3) GDPR already obliges the EDPB to make these public, Article 71(2) GDPR ensures that the

the processing prohibition in Article 58 (2) (f) of the GDPR. Article 58 of the GDPR replaced Article 28(3) of Directive 95/46/EC on the protection of individuals

see commentary to Article 51(3) GDPR bellow. Article 8(3) of the Charter of Fundamental Rights of the European Union ("CFR") and Article 16(2) of the Treaty

to Article 42(7); (p) specify the requirements referred to in Article 43(3) with a view to the accreditation of certification bodies under Article 42;

Individuals with Regard to the Processing of Personal Data established by Directive 95/46/EC. It should consist of the head of a supervisory authority of each

shall apply from 25 May 2018. There is no relevant recital for Article 99 GDPR. Article 99 GDPR sets out the dates of the Regulation's entry into force

Buchner, DS-GVO BDSG, Article 59 GDPR, margin number 7 (C.H. Beck 2020, 3rd Edition). See Ziebarth, in Sydow, Marsch, DS-GVO/BDSG, Article 59 GDPR, margin numbers

information society service(s)." According to Article 4(25) GDPR, which in turn refers to Article 1(1) of Directive (EU) 2015/1535, an "information society service"

ECJ on household exceptions under the GDPR (Article 3(2) Directive 95/46/EC), which corresponds to Article 2(2)(c) GDPR. While the Austrian legislator

and (3) GDPR), inform him or her about the measures taken (Article 12(3) and (4) GDPR), the right to receive this service free of charge (Article 12(5)

Category:Article 37 GDPR The notion of appointing a DPO has its roots in Article 18(2) of the Data Protection Directive 1995 (Directive 95/46/EC) (DPD)

assessment should not be mandatory. Article 22 GDPR has its roots in Articles 12a and 15 of the 95/46/EC Data Protection Directive (DPD). One of the main differences

procedure under Article 65(3)(2) GDPR could also be applied to decisions made by the EDPB. The procedural regulations in Article 65(3)(2) GDPR establish

with Article 13, Article 14 GDPR gives expression to the principle of transparency enshrined in Article 5(1)(a) GDPR and further defined in Article 12 GDPR

to in Article 46(2)(d) GDPR, contractual clauses referred to in Article 46(3)(a) GDPR, or binding corporate rules within the meaning of Article 47 GDPR

compliance. Article 40 GDPR elaborates upon a pre-existing provision under the Directive 95/46/EC (Data Protection Directive – DPD), specifically Article 27(1)

that process them. This was already the case under Article 8(7) of the DPD, the precursor of Article 87 GDPR. In many Member States, the processing of NIN

Chair of the Board. Article 75 GDPR establishes the existence of, and governs the functioning of the secretariat of the Board. Article 75 GDPR outlines the

the code. Although the Data Protection Directive 95/46/EC (DPD) included a provision on codes of conduct (Article 27(1) DPD), this did not include any information

organisation), Article 45(5) GDPR (revocation, change of such determinations); Articles 46(2)(c) and (d) GDPR (standard protection clauses); Article 47(3) GDPR

approach in regards to the EDPB. Article 42 of the Charter of Fundamental Rights of the European Union ("CFR") and Article 15(3) Treaty on the Functioning of

decisions in Category:Article 74 GDPR For more on this point, see Article 72 GDPR. Dix in Kühling, Buchner, DS-GVO BDSG, Article 74 GDPR, margin number

hybrid of regulation and directive.” Whilst it establishes an EU-wide penalty regime for violations under Article 83 GDPR, Article 84(1) GDPR dispenses with

dispute resolution mechanism under Article 65 GDPR in connection with Article 63 GDPR is triggered (Article 60 (4) GDPR). Article 60(2) GDPR clarifies that also

in point (d) of Article 46(2) and in Article 28(8); (e) aims to authorise contractual clauses referred to in point (a) of Article 46(3); or (f) aims to

right to receive compensation under Article 82 GDPR was not included in the initial draft of Article 80 GDPR (then Article 73) and was only inserted later

that falls outside the scope of Article 57 GDPR should be deemed inadmissible for the purposes of Article 31 GDPR. Article 31 GDPR can be read as a supporting

out pursuant to Article 83(1) GDPR. This part of Article 83 concerns the principle of "unity of action" (see above). With Article 83(3) GDPR, the legislator

(subjective requirement of the damage) mentioned by Article 82(3), to which we refer. The first sentence of Article 82(2) states that a controller involved in processing

referred to in Article 64. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2). Recital

rules, do not fall within the scope of this article. → You can find all related decisions in Category:Article 48 GDPR Kuner, in Kuner, Bygrave, Docksey,

restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been

derogation from Article 64(3) and Article 65(2), an urgent opinion or an urgent binding decision referred to in paragraphs 2 and 3 of this Article shall be adopted

to in Article 42(5) and approved by the supervisory authority which is competent pursuant to Article 55 or 56 or by the Board pursuant to Article 63; (c)

confidentiality obligations were already in place under Article 28(7) of the GDPR's predecessor, Directive 95/46/EC. Article 54(1) GDPR mandates Member States to provide

the exchange of knowledge between them. This way, Article 50 GDPR expands the exhortation under Article 57(1)(g) GDPR that calls for cooperation between

Press 2020). Spiecker et al., GDPR Article-by-Article Commentary (2023), p 1090. Spiecker et al., GDPR Article-by-Article Commentary (2023), p 1090. CJEU

for the data subject (Article 57(3) GDPR). Pötters, Werkmeister in Gola, DS-GVO, Article 77 GDPR, margin number 4 (C.H. Beck 2022, 3rd edition). CJEU - C-132/21

of the notion of religion in general. For instance, under Article 10(1)(b) of Directive 2011/95/EU, “[t]he concept of religion shall in particular include

the meaning of this Article. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 93(2). Recital 110:

in compliance with the GDPR. Article 28(3)(h) GDPR enables such a task in case processors are used. According to Article 28(3)(h) GDPR, the processor should

absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer

under the terms referred to in Article 46(2)(f) GDPR. One substantial difference between Article 42(1) GDPR and Article 42(2) GDPR is that in the former

this Article. 2.   The delegation of power referred to in Article 12(8) and Article 43(8) shall be conferred on the Commission for an indeterminate period

protection principles (Article 5), determination of the legal basis for processing (Article 6), implementation of security measures (Article 32), notification

GDPR (Article 31 GDPR). Direct liability of the representative is limited to the obligations set out in Article 30 and Article 58(1)(a) GDPR. Article 27(5)

certain standards of clarity (Article 61(3) GDPR). Requests are imperative and, subject to specific exceptions (Article 61(4) and (5) GDPR), must be fulfilled

subjects - which would be counterproductive. Article 11 GDPR is meant to address this matter. Under Article 11(1) GDPR, when a processing operation does

on the interests of the hosting State within the meaning of Article 346(1) TFEU. Article 62(3) GDPR foresees two main forms of joint operations: (i) conferring

and 14 GDPR), access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), notification

information in the course of an investigation, in accordance with Article 58(1) GDPR. Article 90 GDPR was drafted with a view to regulate potential conflicts

commentary to Article 60 GDPR, Article 61 GDPR, Article 62 GDPR, Article 63 GDPR, Article 64 GDPR, Article 65 GDPR, Article 66 GDPR and Article 56 GDPR. The

studies. Hence, Article 89(2) and (3) GDPR also allow for specific derogation to the GDPR for these purposes, as further detailed below. Article 89(1) GDPR