Before we contemplate the differences in jurisdiction related to data
privacy, let's get into the origin of modern‑day data privacy.
We have to go back to 1970 Germany in order to find a
relatable history to modern‑day data privacy.
This was embellished by the Organization for Economic Cooperation and
Development's principles for data privacy that were started in 1980,
the EU DPD 9546 and then the GDPR. In 1970, the German Data Protection
Act in the state of Hesse enacted the first data protection act in the
world known as the DSG.
This act was followed by similar acts around the world and
was entered into German law in 1977.
Pay special attention to the Organization for Economic Cooperation and
Development and its eight principles because you will find almost a
grandparent of all modern‑day privacies that kind of point back to the OECD.
The 1980 Organization for Economic Cooperation and Development guidelines on
the protection of privacy and transporter flows of personal data have broadly
classified privacy principles.
The OECD member countries considered it necessary to develop
guidelines that would help to harmonize national privacy legislation
while upholding such human rights would at the same time prevent
interruptions in international flows of data.
The first principle is what is known as the Collection Limitation Principle.
There should be limits to the collection of personal data.
Any such data should be obtained by lawful and fair means where
appropriate with the knowledge and consent of the data subject.
The Data Quality Principle means that there should be data that is
relevant to the purpose for which they are used and to the extent
necessary for their purposes should be accurate,
complete, and up to date.
So inaccurate information,
derogatory information about a data subject could actually harm that
data subject. Purpose Specification Principle is the subsequent use
is limited to the fulfillment of those purposes so you don't have
this incompatible relationship between the data collected and the
original purpose.
The Use Limitation Principle means that the data shouldn't be disclosed,
made available, or otherwise used other than those specified purposes
that were given by means of the magic word, consent.
The Security Safeguards Principle is that the personal data should
be protected by reasonable security safeguards.
Here, it is the avoiding of a DAD, the D, destruction, the A, the alteration,
and the last D, the disclosure of the data needs to be avoided by the
controller, the one who is in control of this data.
Another word that you could use for the Openness Principle is transparency,
so a general policy of transparency about developments,
practices, and policies with respect to the data.
The Individual Participation Principle is an individual should have
the right to obtain from the data controller any of the information
that is about them in a reasonable time.
And then the Accountability Principle is probably one of
the more powerful ones for our topic.
It means that the data controller should be accountable
for complying with these measures.
Now this word, accountability, brings to mind the idea of liability.
So it's more than just responsibility.
It's a very powerful principle that plays out in
modern‑day data privacy frameworks.
The next seminal data privacy protection capability came from the 1995, or
what is known as the 95/46/EC; 46 is the article number, EC is the European
Commission. Here, the stating of the DPD meant that an individual's rights
for a collection of data and the use of their personal data is limited to
the minimum necessary.
So individuals should be clearly informed in a transparent way on how,
why, and by whom and for how long their data is collected.
Does that remind you of anything? If you get to know the OECD principles,
you'll understand all of the modern‑day data privacy standards.
Now, this was also the introduction of the idea the right to be forgotten.
So when data is no longer needed,
the right to erasure should be given to the data subject.
There's this idea of a single market dimension, which means that you
reduce the administrative burden on companies,
ensure a true level playing field between companies that
are all inside of the European Union.
There is this strengthening of police and criminal justice
integration so that, again, under the Lisbon Treaty,
the EU had the possibility to lay down comprehensive and coherent rules on
data protection, and they would be required to make criminal referrals when
there was a violation of the use of information.
Also,
the high levels of protection for data transferred outside
of the EU was improved by streamlining procedures for
international data transfers.
This came to its highest protection capability to date under the GDPR.
It was May 4, 2016 that the official text of the regulation's directive were
published, and then it began to be applied on May 25, 2018. You have the
harmonization of data privacy laws across all of Europe.
The idea was to empower all of the EU citizens' data
privacy capabilities, and there were additional protections
that came by means of penalties.
This increased territorial scope, or what they call extraterritorial
applicability, for needing to get consent if data was to be transferred from one
place to another location. And then there are a set of countries that are spoken
of as having adequate protections, like Andorra,
Singapore, Switzerland, Japan, Israel, Australia,
Argentina, Uruguay, and Canada, but those that don't have adequate
protections are going to have to have this higher level of consent in
order to process data outside of the European Union.
Next, let's talk about some instances of country‑specific legislation.