National Data Protection Laws Pre-GDPR: A Comprehensive Guide for CIPP/E Exam Preparation
Introduction
Before the General Data Protection Regulation (GDPR) came into effect on May 25, 2018, the European data protection landscape was shaped by a patchwork of national laws, each implementing the foundational EU Data Protection Directive 95/46/EC in different ways. Understanding the pre-GDPR legal framework is essential for CIPP/E candidates because it provides critical context for why the GDPR was adopted, how harmonization was achieved, and what challenges existed under the prior regime.
Why Is This Topic Important?
Understanding national data protection laws pre-GDPR is important for several reasons:
1. Historical Context: The GDPR did not emerge in a vacuum. It was a direct response to the fragmentation and inconsistencies that arose from the way EU Member States transposed the 1995 Data Protection Directive into their national laws. Understanding this history helps you appreciate the objectives and design of the GDPR.
2. Understanding Harmonization: One of the GDPR's primary goals was to create a single, uniform data protection framework across the EU. Knowing what existed before helps you understand why a regulation (directly applicable) was chosen over another directive (requiring national transposition).
3. Residual National Laws: Even under the GDPR, Member States retain some discretion in certain areas (called opening clauses or derogations). Many of these national provisions build upon or are influenced by pre-existing national data protection laws.
4. Exam Relevance: The CIPP/E exam tests your understanding of the evolution of European data protection law, including the legislative instruments that preceded the GDPR.
What Were National Data Protection Laws Pre-GDPR?
Before the GDPR, European data protection was primarily governed by:
1. The Data Protection Directive 95/46/EC
Adopted on October 24, 1995, this Directive established the foundational principles for data protection across the EU. As a directive, it was not directly applicable in Member States. Instead, each Member State was required to transpose its provisions into national law. This process of transposition led to significant variations between countries.
2. National Implementing Laws
Each EU Member State enacted its own legislation to implement the Directive. Key examples include:
- Germany: The Bundesdatenschutzgesetz (BDSG), originally enacted in 1977 and later amended to implement the Directive. Germany had one of the oldest data protection frameworks in the world, dating back to the Hessian Data Protection Act of 1970.
- France: The Loi Informatique et Libertés (Law No. 78-17 of January 6, 1978), amended in 2004 to transpose the Directive. France's data protection authority, the CNIL, was one of the most active in Europe.
- United Kingdom: The Data Protection Act 1998, which replaced the earlier Data Protection Act 1984 and implemented the Directive's requirements.
- Spain: The Ley Orgánica de Protección de Datos (LOPD) of 1999.
- Italy: The Codice in materia di protezione dei dati personali (Legislative Decree No. 196/2003).
- Sweden: Sweden was notable for having enacted one of the earliest data protection laws in the world, the Datalagen of 1973, later replaced by the Personuppgiftslag (Personal Data Act) of 1998.
3. Other Relevant Instruments
- Council of Europe Convention 108 (1981): This was the first legally binding international instrument in data protection. It influenced the development of both the 1995 Directive and national laws. It remains in force and has been modernized (Convention 108+).
- The OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980): While not legally binding, these guidelines established foundational data protection principles that influenced European legislation.
- The ePrivacy Directive 2002/58/EC: This complemented the Data Protection Directive with specific rules for the electronic communications sector, addressing cookies, direct marketing, and confidentiality of communications.
How Did the Pre-GDPR System Work?
The Directive as a Framework
The Data Protection Directive 95/46/EC set out key principles and requirements, including:
- Lawfulness, fairness, and purpose limitation
- Data quality and accuracy
- Rights of data subjects (access, rectification, erasure, objection)
- Rules on international data transfers
- Requirements for independent supervisory authorities
- Notification obligations to data protection authorities
However, because it was a directive, Member States had discretion in how they implemented these requirements. This led to:
Key Problems with the Pre-GDPR Framework
1. Fragmentation: Different Member States adopted different rules on the same issues. For example, some countries required prior authorization for certain processing activities, while others only required notification. Definitions of personal data, consent, and other key concepts varied.
2. Inconsistent Enforcement: National data protection authorities (DPAs) had different powers, resources, and approaches to enforcement. Some were proactive; others were under-resourced and passive.
3. Regulatory Arbitrage: Companies could establish their main operations in a Member State with less stringent data protection enforcement (a practice sometimes called forum shopping). Ireland and Luxembourg, as headquarters for major tech companies, were sometimes criticized for this.
4. Burdensome Compliance: Multinational companies operating across multiple EU Member States had to comply with up to 28 different national data protection laws, each with slightly different requirements. This created significant compliance costs and legal uncertainty.
5. Inadequate for the Digital Age: The 1995 Directive was drafted before the rise of social media, cloud computing, big data analytics, and the Internet of Things. It was increasingly seen as outdated and insufficient to address modern data processing challenges.
6. Varied Sanctions: Penalties for non-compliance varied dramatically across Member States, with some countries imposing only nominal fines.
The Role of National Supervisory Authorities
Under the Directive, each Member State was required to establish one or more independent supervisory authorities. These authorities had investigative, corrective, and advisory powers, but the scope and strength of these powers varied significantly. The Article 29 Working Party (now replaced by the European Data Protection Board, or EDPB) served as an advisory body, issuing opinions and recommendations, but its guidance was not legally binding.
The Push for Reform
By the late 2000s, it was widely recognized that the patchwork approach was unsustainable. Key milestones in the reform process included:
- 2009: The Treaty of Lisbon gave the EU a stronger legal basis for data protection (Article 16 TFEU) and made the Charter of Fundamental Rights legally binding (Article 8 enshrining the right to data protection).
- 2010: The European Commission launched a public consultation on the future of data protection in the EU.
- 2012: The European Commission proposed the draft GDPR.
- 2014: The European Parliament adopted its position on the proposed GDPR.
- 2015: Trilogue negotiations between the Parliament, Council, and Commission reached agreement.
- April 2016: The GDPR was formally adopted.
- May 25, 2018: The GDPR became applicable.
The Transition from Directive to Regulation
The choice of a regulation rather than a directive was deliberate. Unlike a directive, a regulation is directly applicable in all Member States without the need for national transposition. This was intended to eliminate the fragmentation that characterized the pre-GDPR era. However, the GDPR still includes numerous opening clauses that allow Member States to maintain or introduce specific national rules on certain topics, such as:
- The age of consent for children in relation to information society services (Article 8)
- Processing of employee data (Article 88)
- Processing for journalistic purposes and freedom of expression (Article 85)
- National identification numbers (Article 87)
- Processing of special categories of data in certain contexts (Article 9)
This means that even under the GDPR, national data protection laws continue to play an important role.
Key Concepts to Remember for the Exam
- The Data Protection Directive 95/46/EC was the primary EU-level instrument before the GDPR.
- As a directive, it required national transposition, leading to fragmentation.
- Convention 108 of the Council of Europe (1981) was the first binding international data protection treaty.
- The OECD Guidelines (1980) were influential but non-binding.
- Germany (Hesse, 1970) and Sweden (1973) had some of the earliest data protection laws in the world.
- The pre-GDPR framework suffered from inconsistent enforcement, regulatory arbitrage, and outdated rules.
- The GDPR was chosen as a regulation to ensure direct applicability and greater harmonization.
- Despite the GDPR's harmonizing effect, opening clauses allow for continued national variation in specific areas.
Exam Tips: Answering Questions on National Data Protection Laws Pre-GDPR
1. Know the key instruments: Be able to distinguish between the Data Protection Directive 95/46/EC, Convention 108, the OECD Guidelines, and the ePrivacy Directive. Understand their respective legal natures (binding vs. non-binding, directive vs. regulation vs. convention).
2. Understand the difference between a directive and a regulation: This is fundamental. A directive requires transposition; a regulation does not. This distinction explains why fragmentation occurred pre-GDPR and why the regulation format was chosen for the GDPR.
3. Remember the key dates: 1970 (Hesse), 1973 (Sweden), 1980 (OECD Guidelines), 1981 (Convention 108), 1995 (Directive 95/46/EC), 2016 (GDPR adopted), 2018 (GDPR applicable). Exam questions may test your chronological understanding.
4. Focus on the reasons for reform: Questions may ask why the GDPR was introduced. The key reasons are fragmentation, inconsistent enforcement, regulatory arbitrage, compliance burdens for businesses, and the need to address technological developments.
5. Know specific national examples: Being familiar with key national laws (Germany's BDSG, France's Loi Informatique et Libertés, UK's Data Protection Act 1998) can help you answer questions about how the Directive was implemented differently across Member States.
6. Understand opening clauses: Even post-GDPR, national laws remain relevant. Questions may ask about areas where Member States retain discretion under the GDPR.
7. Use the process of elimination: For multiple-choice questions, eliminate clearly incorrect answers first. For example, if a question asks which instrument was the first binding international data protection treaty, you can eliminate the OECD Guidelines (non-binding) and the GDPR (not the first).
8. Read questions carefully: Pay attention to qualifiers like first, binding, international, national, directly applicable, and required transposition. These details often determine the correct answer.
9. Connect concepts to GDPR provisions: The exam often tests your ability to link historical developments to current GDPR provisions. For example, the Article 29 Working Party (pre-GDPR advisory body) became the European Data Protection Board (EDPB) under the GDPR.
10. Practice scenario-based questions: Some exam questions may present a scenario involving a pre-GDPR situation and ask you to identify the applicable legal framework or explain why a particular outcome occurred under the old system. Practice identifying the relevant legal instruments and principles in context.
Summary
National data protection laws pre-GDPR were the product of each EU Member State's transposition of the Data Protection Directive 95/46/EC. While the Directive established common principles, the resulting national laws varied significantly in scope, definitions, enforcement, and sanctions. This fragmentation created challenges for individuals, businesses, and regulators alike. The GDPR was adopted as a directly applicable regulation to address these shortcomings and create a more unified, modern, and robust data protection framework across the EU. For the CIPP/E exam, a solid understanding of this historical context, the key legal instruments, and the reasons for reform is essential for answering questions accurately and confidently.
