A privacy trainee is comparing the two principal data protection instruments that emerged around 1980 and is asked to identify accurate statements about their respective legal character. Which two statements correctly describe the OECD Guidelines and Convention 108 as they stood when first adopted? (Select TWO.)
- AThe OECD Guidelines on the protection of privacy and transborder flows of personal data are a recommendation that is not legally binding on the states adopting them. Correct
- BConvention 108 of the Council of Europe is the first binding international treaty dealing specifically with the automatic processing of personal data. Correct
- CThe OECD Guidelines were adopted by the Council of Europe as a binding treaty that imposes obligations enforceable before the European Court of Human Rights.
- DConvention 108 is an instrument of European Union law that takes direct effect in the Member States in the same way as a directly applicable regulation.
- EBoth the OECD Guidelines and Convention 108 were created by the Treaty of Lisbon at the moment it entered into force in the European Union in 2009.
Why A is correct: The 1980 OECD Guidelines are a non-binding recommendation, setting influential principles without creating enforceable legal obligations on member states.
Why B is correct: Convention 108, opened in 1981, is the first legally binding international instrument addressing automated processing of personal data, so this belongs in the set.
Why C is wrong: This is tempting because it borrows Convention 108's features, but the OECD Guidelines come from the OECD and are non-binding, not a Council of Europe treaty.
Why D is wrong: Convention 108 is a Council of Europe treaty, not EU law, so it does not take direct effect like an EU regulation such as the GDPR.
Why E is wrong: This conflates the eras: both instruments date from around 1980, decades before the 2009 Treaty of Lisbon, which neither created them.