THE EUROPEAN UNION DATA PROTECTION LEGAL FRAMEWORK – PART 2

1.0              The EU Directive consists of a number of obligations, with which European data controllers must comply when processing personal data.[1]

2.0               Member State shall provide that personal data must be[2], firstly, processed fairly and lawfully.

3.0              Secondly, collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.

4.0              Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards.

5.0              Thirdly, adequate, relevant and not excessive in relation to the purposes for which they are collected/or further processed.

6.0              Fourthly, accurate and where necessary, kept up to date; every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they are further processed, are erased or rectified.

7.0              Fifthly, kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use.

8.0              Article 5 additionally provides that Member States shall within the limits of the provisions of the EU Directive determine more precisely the conditions under which the processing of personal data is lawful.

9.0              Under the EU Directive, the personal data must not be processed without the consent of the data subject unless that processing is necessary for performance of a contract with the data subject or a specific exception applies.[3]

10.0           Personal data stored on a company Web site or internal IT network must also be kept up to date or discarded if no longer needed.

11.0          If someone buys something through E-Commerce from a company once and the company keeps that customer’s personal details for twenty years that retention could be considered unreasonable under data protection law.

12.0          Any personal data that a company retains must be pertinent to the business.[4] E-Customer records no longer relevant to a business must be destroyed responsibly under the EU Directive.

13.0          The EC Directive provides that the E-Customer has the right of access to and the rectification or erasure of his personal data.

14.0           In other words, an E-Customer has the right to inspect personal data and to check that the company is using it for a good reason.

 15.0    If the E-Customer not satisfied that this is the case, he can complain to data protection authorities, which would carry out a formal investigation

---

[1]               Peter Carey,Data Protection: A Practical Guide to UK and EU Law, 2nd ed., (Oxford University Press Oxford 2004),p.6.

[2]              Article 6(1)(a)(b)(c)(d)(e) of the EU Directive 95/46/EC.

[3]               Ryan Moshell, "…And Then There Was One: The Outlook For A Self-Regulatory United States Amidst A Global Trend Toward Comprehensive Data Protection" (2005) 37 Texas Tech Law Review 357,online,accessed on July 6th 2005,available at http://web.lexis-nexis.com/universe/document.

[4]               Lawrence Mark Cohen, "If It's Personal, It's Protected" (2003) 47 4 Security Management 93,online,accessed on June 28th 2006,available at http://proquest.umi.com/.