Compared to the US, European data and privacy protection rules seem Draconian. The European rules apply to any enterprise doing business in the EU. The new rules are far more stringent than the last set. This book is a quick guide to the directives for companies, particularly US, that have to comply with them. Where US organizations and businesses who collect or receive EU personal data fail to comply with the rule, the bottom line can suffer from very significant official fines and penalties, as well as from users, customers or representative bodies to pursuing litigation. This guide is essential for all US enterprises who directly or indirectly deal with EU personal data.

GDPR: Personal Data Protection in the European Union Mariusz Krzysztofek Personal data protection has become one of the central issues in any understanding of the current world system. In this connection, the European Union (EU) has created the most sophisticated regime currently in force with the General Data Protection Regulation (GDPR) (EU) 2016/679. Following the GDPR’s recent reform – the most extensive since the first EU laws in this area were adopted and implemented into the legal orders of the Member States – this book offers a comprehensive discussion of all principles of personal data processing, obligations of data controllers, and rights of data subjects, providing a thorough, up-to-date account of the legal and practical aspects of personal data protection in the EU. Coverage includes the recent Court of Justice of the European Union (CJEU) judgment on data transfers and new or updated data protection authorities’ guidelines in the EU Member States. Among the broad spectrum of aspects of the subject covered are the following: – right to privacy judgments of the CJEU and the European Court of Human Rights; – scope of the GDPR and its key definitions, key principles of personal data processing; – legal bases for the processing of personal data; – direct and digital marketing, cookies, and online behavioural advertising; – processing of personal data of employees; – sensitive data and criminal records; – information obligation & privacy notices; – data subjects rights; – data controller, joint controllers, and processors; – data protection by design and by default, data security measures, risk-based approach, records of personal data processing activities, notification of a personal data breach to the supervisory authority and communication to the data subject, data protection impact assessment, codes of conduct and certification; – Data Protection Officer; – transfers of personal data to non-EU/EEA countries; and – privacy in the Internet and surveillance age. Because the global scale and evolution of information technologies have changed the data processing environment and brought new challenges, and because many non-EU jurisdictions have adopted equivalent regimes or largely analogous regulations, the book will be of great usefulness worldwide. Multinational corporations and their customers and contractors will benefit enormously from consulting and using this book, especially in conducting case law, guidelines and best practices formulated by European data protection authorities. For lawyers and academics researching or advising clients on this area, this book provides an indispensable source of practical guidance and information for many years to come.

The rapid development of information technology has exacerbated the need for robust personal data protection, the right to which is safeguarded by both European Union (EU) and Council of Europe (CoE) instruments. Safeguarding this important right entails new and significant challenges as technological advances expand the frontiers of areas such as surveillance, communication interception and data storage. This handbook is designed to familiarise legal practitioners not specialised in data protection with this emerging area of the law. It provides an overview of the EU’s and the CoE’s applicable legal frameworks. It also explains key case law, summarising major rulings of both the Court of Justice of the European Union and the European Court of Human Rights. In addition, it presents hypothetical scenarios that serve as practical illustrations of the diverse issues encountered in this ever-evolving field.

Prominent privacy law experts, regulators and academics examine contemporary legal approaches to privacy from a comparative perspective.

This book contains the General Data Protection Regulation 2016 with official justifications. Legal provisions are accompanied by their recitals. Ideal for any practitioner and anyone interested in European data privacy. "The General Data Protection Regulation is the first directly applicable legal basis valid in all EU member states for processing personal data. It was concluded in April 2016 following a three-year coordination procedure, and replaces the data protection directive from 1995. The updates in the regulation include rights related to data portability and the right to be forgotten. There are changes with regard to data transmission to third-party countries, national supervisory agencies ("one-stop-shops") and their collaboration. But above all, the drastically harsher sanctions in response to violations should be an impetus for all affected companies to review their compliance measures. The European Parliament and the Council have granted a transitional deadline of two years for this purpose."

The European Union has undergone major changes in the last decade, including Treaty reform, and a significant expansion of activity in foreign and security policy, and justice and home affairs. In the first edition of this influential textbook, a team of leading lawyers and political scientists reflected upon the important developments in their chosen area over the time since the EC was formed. This new edition continues this analysis ten years on. Taking into account the social and political background, and without losing sight of the changes that came before, in each chapter the contributors analyze the principle themes and assess the legal and political forces that have shaped its development. Each author addresses a specific topic, event, or theme, from the European Court of Justice to Treaty reform; the enlargement of the EU to administrative law; the effect of EU law on culture to climate change. Together the chapters tell the story of the rapid development of EU law - its past, present, and future.

The complexities of implementing the General Data Protection Regulation (GDPR) continue to grow as it progresses through new and ever-changing technologies, business models, codes of conduct, and decisions of the supervisory authorities, and the courts. This eminently practical guide to implementing the GDPR – written in an original, problem-solving style by a highly experienced data protection expert with equal knowledge of both law and technology – provides a step-by-step project management approach to building a GDPR-compliant data protection system, assessing, and documenting the risks and then implementing these changes through processes at the operational level. With detailed attention to case law (Member State, ECJ, and ECHR), especially where affecting high-risk areas that have attracted scrutiny, the guidance proceeds systematically through such topics and issues as the following: required documentation, policies, and procedures; risk assessment tools and analysis frameworks; children’s data; employee and health data; international transfers post-Schrems II; data subject rights including the right of access; data retention and erasure; tracking and surveillance; and effects of technologies such as artificial intelligence, biometrics, and machine learning. With its practical examples derived from the author’s experience in building GDPR-compliant software, as well as its analysis of case law and enforcement priorities, this incomparable guide enables company data protection officers and compliance staff to advise on key issues with full awareness of the legal and reputational risks and how to mitigate them. It is also sure to be of immeasurable value to concerned regulators and policymakers at all government levels. “…it's going to be the go to resource for practitioners.” Tom Gilligan, Data Protection Consultant, September 2021 "I purchased this book recently and I’m very glad I did. It’s the textbook I have been waiting for. As someone relatively new to data protection, I was finding it very difficult to find books on the practical side of data protection. This book is very clearly laid out with practical examples and case law given for each topic, which is immensely helpful. I would recommend it to any data protection practitioners." Jennifer Breslin, LLM CIPP/E, AIPP Member

This book provides expert advice on the practical implementation of the European Union’s General Data Protection Regulation (GDPR) and systematically analyses its various provisions. Examples, tables, a checklist etc. showcase the practical consequences of the new legislation. The handbook examines the GDPR’s scope of application, the organizational and material requirements for data protection, the rights of data subjects, the role of the Supervisory Authorities, enforcement and fines under the GDPR, and national particularities. In addition, it supplies a brief outlook on the legal consequences for seminal data processing areas, such as Cloud Computing, Big Data and the Internet of Things.Adopted in 2016, the General Data Protection Regulation will come into force in May 2018. It provides for numerous new and intensified data protection obligations, as well as a significant increase in fines (up to 20 million euros). As a result, not only companies located within the European Union will have to change their approach to data security; due to the GDPR’s broad, transnational scope of application, it will affect numerous companies worldwide.

Although Europe has a significant legal data protection framework, built up around EU Directive 95/46/EC and the Charter of Fundamental Rights, the question of whether data protection and its legal framework are ‘in good health’ is increasingly being posed. Advanced technologies raise fundamental issues regarding key concepts of data protection. Falling storage prices, increasing chips performance, the fact that technology is becoming increasingly embedded and ubiquitous, the convergence of technologies and other technological developments are broadening the scope and possibilities of applications rapidly. Society however, is also changing, affecting the privacy and data protection landscape. The ‘demand’ for free services, security, convenience, governance, etc, changes the mindsets of all the stakeholders involved. Privacy is being proclaimed dead or at least worthy of dying by the captains of industry; governments and policy makers are having to manoeuvre between competing and incompatible aims; and citizens and customers are considered to be indifferent. In the year in which the plans for the revision of the Data Protection Directive will be revealed, the current volume brings together a number of chapters highlighting issues, describing and discussing practices, and offering conceptual analysis of core concepts within the domain of privacy and data protection. The book’s first part focuses on surveillance, profiling and prediction; the second on regulation, enforcement, and security; and the third on some of the fundamental concepts in the area of privacy and data protection. Reading the various chapters it appears that the ‘patient’ needs to be cured of quite some weak spots, illnesses and malformations. European data protection is at a turning point and the new challenges are not only accentuating the existing flaws and the anticipated difficulties, but also, more positively, the merits and the need for strong and accurate data protection practices and rules in Europe, and elsewhere.