CIPP/E David Morris
What are the 6 European Institutions - ANS-1. Council of Europe
2. European Court of Human Rights
3. European Parliament
4. European Commission
5. European Council
6. European Court of Justice
What is the legislative Framework for EU Privacy? - ANS-1. The Council of Europe
Convention for the Protection of Individuals with Regard to the Automatic Processing of
Personal Data of 1981 (CoE Convention)
2. EU Data Protection Directive (95/46/EC)
3. EU Directive on Privacy and Electronic Communications (2002/58/EC), as amended
4. EU Directive on Electronic Commerce (2000/31/EC)
5. European data retention regimes
6. GDPR
What are the 6 Data Protection Principles - ANS-1. Fairness and lawfulness
2. Purpose limitation
3. Proportionality
4. Accuracy
5. Storage limitation
6. Integrity and confidentiality
What are the 6 Lawful Bases for Processing? - ANS-1. Consent
2. Contractual necessity
3. Legal obligation
4. Vital interests
5. Public task
6. Legitimate interests
What are 7 Data Subject Rights? - ANS-1. Access
2. Rectification
3. Erasure and Right to be Forgotten
4. Restriction and objection
5. Automated decision making, including profiling
6. Data portability
,7. Restrictions
What is the Treaty of Lisbon? - ANS-"On 13 December 2007, the Treaty of Lisbon
('Lisbon Treaty') was signed by the EU member states; it became effective 1 December
2009. Its main aim is to strengthen and improve the core structures of the European
Union to enable it to function more efficiently."
Article 1 - ANS-Subject matter and objectives
Article 2 - ANS-Material scope
Article 3 - ANS-Territorial scope
Article 4 - ANS-Definitions
Article 5 - ANS-Principles relating to processing of personal data
Article 6 - ANS-Lawfulness of processing
Article 7 - ANS-Conditions for consent
Article 8 - ANS-Conditions applicable to child's consent in relation to information society
services
Article 9 - ANS-Processing of special categories of personal data
Article 10 - ANS-Processing of personal data relating to criminal convictions and
offenses
Article 11 - ANS-Processing which does not require identification
GDPR, Chapter 2 - ANS-Principles
GDPR, Chapter 3 - ANS-Rights of the Data Subject
GDPR, Chapter 1 - ANS-General Provisions
Article 12 - ANS-Transparent information, communication and modalities for the
exercise of the rights of the data subject
,Article 13 - ANS-Information to be provided where personal data are collected from the
data subject
Article 14 - ANS-Information to be provided where personal data have not been
obtained from the data subject
Article 15 - ANS-Right of access by the data subject
Article 16 - ANS-Right to rectification
Article 17 - ANS-Right to erasure
Article 18 - ANS-Right to restriction of processing
Article 19 - ANS-Notification obligation regarding rectification or erasure of personal
data or restriction of processing
Article 20 - ANS-Right to data portability
Article 21 - ANS-Right to object
Article 22 - ANS-Automated individual decision-making, including profiling
Article 23 - ANS-Restrictions
Article 24 - ANS-Responsibility of the controller
Article 25 - ANS-Data protection by design and by default
Article 26 - ANS-Joint controllers
Article 27 - ANS-Representatives of controllers or processors not established in the
union
Article 28 - ANS-Processor
Article 29 - ANS-Processing under the authority of the controller or processor
Article 30 - ANS-Records of processing activities
, Article 31 - ANS-Cooperation with the supervisory authority
Article 32 - ANS-Security of processing
GDPR, Chapter 4 - ANS-Controller and Processor
Article 33 - ANS-Notification of a personal data breach to the supervisory authority
Article 34 - ANS-Communication of a personal data breach to the data subject
Article 35 - ANS-Data protection impact assessment
Article 36 - ANS-Prior consultation
Article 37 - ANS-Designation of the data protection officer
Article 38 - ANS-Position of the data protection officer
Article 39 - ANS-Tasks of the data protection officer
Article 40 - ANS-Codes of conduct
Article 41 - ANS-Monitoring of approved codes of conduct
Article 42 - ANS-Certification
Article 43 - ANS-Certification bodies
GDPR, Chapter 5 - ANS-Transfers of personal data to third countries or international
organizations
Article 44 - ANS-General principle for transfers
Article 45 - ANS-Transfers on the basis of an adequacy decision
Article 46 - ANS-Transfers subject to appropriate safeguards
Article 47 - ANS-Binding corporate rules
Article 48 - ANS-Transfers or disclosures not authorized by Union law
What are the 6 European Institutions - ANS-1. Council of Europe
2. European Court of Human Rights
3. European Parliament
4. European Commission
5. European Council
6. European Court of Justice
What is the legislative Framework for EU Privacy? - ANS-1. The Council of Europe
Convention for the Protection of Individuals with Regard to the Automatic Processing of
Personal Data of 1981 (CoE Convention)
2. EU Data Protection Directive (95/46/EC)
3. EU Directive on Privacy and Electronic Communications (2002/58/EC), as amended
4. EU Directive on Electronic Commerce (2000/31/EC)
5. European data retention regimes
6. GDPR
What are the 6 Data Protection Principles - ANS-1. Fairness and lawfulness
2. Purpose limitation
3. Proportionality
4. Accuracy
5. Storage limitation
6. Integrity and confidentiality
What are the 6 Lawful Bases for Processing? - ANS-1. Consent
2. Contractual necessity
3. Legal obligation
4. Vital interests
5. Public task
6. Legitimate interests
What are 7 Data Subject Rights? - ANS-1. Access
2. Rectification
3. Erasure and Right to be Forgotten
4. Restriction and objection
5. Automated decision making, including profiling
6. Data portability
,7. Restrictions
What is the Treaty of Lisbon? - ANS-"On 13 December 2007, the Treaty of Lisbon
('Lisbon Treaty') was signed by the EU member states; it became effective 1 December
2009. Its main aim is to strengthen and improve the core structures of the European
Union to enable it to function more efficiently."
Article 1 - ANS-Subject matter and objectives
Article 2 - ANS-Material scope
Article 3 - ANS-Territorial scope
Article 4 - ANS-Definitions
Article 5 - ANS-Principles relating to processing of personal data
Article 6 - ANS-Lawfulness of processing
Article 7 - ANS-Conditions for consent
Article 8 - ANS-Conditions applicable to child's consent in relation to information society
services
Article 9 - ANS-Processing of special categories of personal data
Article 10 - ANS-Processing of personal data relating to criminal convictions and
offenses
Article 11 - ANS-Processing which does not require identification
GDPR, Chapter 2 - ANS-Principles
GDPR, Chapter 3 - ANS-Rights of the Data Subject
GDPR, Chapter 1 - ANS-General Provisions
Article 12 - ANS-Transparent information, communication and modalities for the
exercise of the rights of the data subject
,Article 13 - ANS-Information to be provided where personal data are collected from the
data subject
Article 14 - ANS-Information to be provided where personal data have not been
obtained from the data subject
Article 15 - ANS-Right of access by the data subject
Article 16 - ANS-Right to rectification
Article 17 - ANS-Right to erasure
Article 18 - ANS-Right to restriction of processing
Article 19 - ANS-Notification obligation regarding rectification or erasure of personal
data or restriction of processing
Article 20 - ANS-Right to data portability
Article 21 - ANS-Right to object
Article 22 - ANS-Automated individual decision-making, including profiling
Article 23 - ANS-Restrictions
Article 24 - ANS-Responsibility of the controller
Article 25 - ANS-Data protection by design and by default
Article 26 - ANS-Joint controllers
Article 27 - ANS-Representatives of controllers or processors not established in the
union
Article 28 - ANS-Processor
Article 29 - ANS-Processing under the authority of the controller or processor
Article 30 - ANS-Records of processing activities
, Article 31 - ANS-Cooperation with the supervisory authority
Article 32 - ANS-Security of processing
GDPR, Chapter 4 - ANS-Controller and Processor
Article 33 - ANS-Notification of a personal data breach to the supervisory authority
Article 34 - ANS-Communication of a personal data breach to the data subject
Article 35 - ANS-Data protection impact assessment
Article 36 - ANS-Prior consultation
Article 37 - ANS-Designation of the data protection officer
Article 38 - ANS-Position of the data protection officer
Article 39 - ANS-Tasks of the data protection officer
Article 40 - ANS-Codes of conduct
Article 41 - ANS-Monitoring of approved codes of conduct
Article 42 - ANS-Certification
Article 43 - ANS-Certification bodies
GDPR, Chapter 5 - ANS-Transfers of personal data to third countries or international
organizations
Article 44 - ANS-General principle for transfers
Article 45 - ANS-Transfers on the basis of an adequacy decision
Article 46 - ANS-Transfers subject to appropriate safeguards
Article 47 - ANS-Binding corporate rules
Article 48 - ANS-Transfers or disclosures not authorized by Union law
