Introduction to European Data Protection

A French data protection officer is explaining why, despite the GDPR being a directly applicable regulation, the level of data protection law still differs in some respects between Member States. A junior colleague assumes a regulation must mean fully identical rules everywhere. Which feature of the GDPR best explains why some genuine national variation persists?

• AThe GDPR contains opening clauses that permit Member States to specify or further restrict certain matters in their national lawcheck_circle Correct
• BThe GDPR must be transposed into a national statute by each Member State before it can take effect domestically
• CEach supervisory authority is free to rewrite the operative articles of the GDPR for application in its own territory
• DThe GDPR applies only to Member States that have chosen to opt in, and the rest may set entirely separate rules

Why A is correct: The GDPR includes opening clauses, for example on the age of consent for information society services and on processing in the employment context, which deliberately leave room for national specification.

Why B is wrong: This is tempting because it describes a directive, but a regulation needs no transposition to take effect, so transposition is not the source of the remaining variation.

Why C is wrong: Supervisory authorities interpret and enforce the GDPR but cannot rewrite its articles, so this overstates their powers and is not why variation exists.

Why D is wrong: There is no opt-in mechanism for the GDPR across Member States; it binds them all, so an opt-in cannot explain the residual national differences.

A policy analyst is explaining how the Treaty of Lisbon, in force from 2009, strengthened the legal footing of data protection in the European Union. Which change should she correctly attribute to that treaty?

• AIt created the General Data Protection Regulation as directly applicable EU law
• BIt established the Council of Europe and opened Convention 108 for signature
• CIt made the Charter of Fundamental Rights of the European Union legally binding, giving data protection treaty-level recognition as a fundamental rightcheck_circle Correct
• DIt introduced the OECD fair information principles into binding EU law

Why A is wrong: This is tempting because both concern EU data protection, but the GDPR was adopted in 2016 as a separate regulation and was not created by the Treaty of Lisbon.

Why B is wrong: The Council of Europe and Convention 108 predate the Treaty of Lisbon and are products of the Council of Europe, a separate organisation, so the treaty did not establish them.

Why C is correct: The Treaty of Lisbon conferred legally binding force on the Charter, whose Article 8 expressly recognises protection of personal data, thereby elevating data protection to a fundamental right at EU level.

Why D is wrong: The OECD principles influenced EU law through other instruments, but the Treaty of Lisbon did not transpose those guidelines, so attributing that step to it is incorrect.

A privacy manager is briefing colleagues on the origin of Convention 108, the first binding international instrument on automated processing of personal data. Which body adopted Convention 108 and continues to act as the principal pan-European human rights organisation behind it?

• AThe European Commission, which proposes and enforces European Union legislation
• BThe European Council, made up of the heads of state or government of European Union members
• CThe Court of Justice of the European Union, which rules on the interpretation of Union law
• DThe Council of Europe, a separate international organisation distinct from the European Unioncheck_circle Correct

Why A is wrong: The Commission is tempting because it drafts much EU data protection law, but it is an EU institution and did not adopt Convention 108, which is a Council of Europe instrument.

Why B is wrong: The similar name makes this tempting, but the European Council sets the European Union's political direction and is unrelated to the Council of Europe that produced Convention 108.

Why C is wrong: The CJEU is a judicial body that interprets European Union law and does not adopt international conventions such as Convention 108.

Why D is correct: Convention 108 (1981) was adopted by the Council of Europe, an international organisation of 46 member states that is separate from the European Union and predates it.