CIPP-E - Introduction to European Data Protection (13% of the exam) - Section 1.1

Know the historical rationale for data protection and understand relevant human rights laws and early data protection instruments such as the OECD Guidelines, the Treaty of Lisbon, and Convention 108.

Recognise the human rights foundations of European data protection law, including the OECD Guidelines, Convention 108, and the Treaty of Lisbon. Distinguish the role each instrument played in shaping the legal right to privacy before the GDPR era.

Convention 108OECD GuidelinesTreaty of LisbonConvention 108+

Practice question for this objective

Free sampleIntroduction to European Data Protectioneasy

A privacy trainee is comparing the two principal data protection instruments that emerged around 1980 and is asked to identify accurate statements about their respective legal character. Which two statements correctly describe the OECD Guidelines and Convention 108 as they stood when first adopted? (Select TWO.)

AThe OECD Guidelines on the protection of privacy and transborder flows of personal data are a recommendation that is not legally binding on the states adopting them. Correct
BConvention 108 of the Council of Europe is the first binding international treaty dealing specifically with the automatic processing of personal data. Correct
CThe OECD Guidelines were adopted by the Council of Europe as a binding treaty that imposes obligations enforceable before the European Court of Human Rights.
DConvention 108 is an instrument of European Union law that takes direct effect in the Member States in the same way as a directly applicable regulation.
EBoth the OECD Guidelines and Convention 108 were created by the Treaty of Lisbon at the moment it entered into force in the European Union in 2009.

Distinguish the non-binding OECD Guidelines from the binding Council of Europe Convention 108 among the early instruments shaping European data protection. The 1980 OECD Guidelines are a soft-law recommendation with no binding force, whereas the 1981 Convention 108 is the first binding international treaty on automated personal data processing, adopted by the Council of Europe rather than the EU. The strongest distractor wrongly attributes Convention 108's binding treaty status to the OECD Guidelines.

Why A is correct: The 1980 OECD Guidelines are a non-binding recommendation, setting influential principles without creating enforceable legal obligations on member states.

Why B is correct: Convention 108, opened in 1981, is the first legally binding international instrument addressing automated processing of personal data, so this belongs in the set.

Why C is wrong: This is tempting because it borrows Convention 108's features, but the OECD Guidelines come from the OECD and are non-binding, not a Council of Europe treaty.

Why D is wrong: Convention 108 is a Council of Europe treaty, not EU law, so it does not take direct effect like an EU regulation such as the GDPR.

Why E is wrong: This conflates the eras: both instruments date from around 1980, decades before the 2009 Treaty of Lisbon, which neither created them.

See more CIPP-E practice questions, answers explained.

Exam traps in Introduction to European Data Protection

Answers that look right on this material and are not. Each one is a distractor from a different question in the CIPP-E bank for this domain.

Article 6, the right to a fair trial
Why it is wrong: Article 6 guarantees fair-trial rights and is sometimes confused with privacy protections, but it concerns procedural justice rather than respect for private life.
They are a binding international treaty that signatory states must transpose into national law within a fixed deadline.
Why it is wrong: This describes the character of a binding convention rather than the Guidelines; the OECD Guidelines were issued as a recommendation and impose no legally enforceable transposition duty.
To replace the Council of Europe with the European Union as the body responsible for the convention
Why it is wrong: This is tempting because both organisations work on data protection, but Convention 108 and its modernisation remain Council of Europe instruments and do not transfer responsibility to the EU.

Examworthy is not affiliated with or endorsed by IAPP. Original, blueprint-aligned practice material only.