"No one shall be subjected to arbitrary interference with his privacy,
family, home or correspondence, nor to attacks upon his honour and reputation.
Everyone has the right to the protection of the law against such interference or attacks."
(Article 12, The Universal Declaration of Human Rights, 1948)

From "being let alone" to data protection regulation

With computerization, governments and large corporations began to collect and process citizen data. Starting in the United States of America in the 1960ies, a legal and philosophic discurse about freedom, data collection and government power led to the idea of the regulation of the processing of personal data. In 1974, the first U.S. Privacy Act formalized regulation of government data processing.

The privacy debate was taken up in Europe at the same time. In 1970 in Hessen (Federal state of Germany) and in 1977 for all fo Germany, data protection legislation was introduced. It was mainly intended to protect the individual from state power. According to Deutsche Welle, "France was one of the first countries in Europe to enact a privacy law. The French parliament in 1978 decreed that any person company or government agency receiving or processing personal information without authorization could be punishable by up to six months in prison and a maximum fine of 20,000 francs (3,000 euros, $4,115)".

A milestone was the Council of Europe's Convention 108 "Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data" in 1981. It lay the grounds for converging regulation of data protection in what was to become the European Union.

National refinements and EU directives further defined the concept of data protection in Europe. Finally, in 2012, a standardized European regulation for data protection was agreed upon: the General Data Protection Regulation (GDPR), to be applied latest from May 25, 2018.

Current regulation defines the rights of citizens (information, accession and transparency) as well as the duties of data collectors and data processors. It, in addition, defines the roles of national supervisory authorities and of data protection officers.

In data protection regulation, often “sensitive personal data” is especially protected: Health data, sexual orientation, membership in unions, religion, among others.Processing of such data requires either special permissions, or is regulated by specific laws.

International regulation

Internationally, regulation is very varied. Beyond EU borders, different privacy legislation or data protection regimes apply. Some countries may have very little to no regulation. The EU legislation is therefore very concerned with cross-border transfer of personal data, which is only allowed to organizations and countries that are considered equivalent to GDPR standards.

DLA Piper map of data collection legislation [link].

Links to data about international privacy regulation:

DLA Piper map of data collection legislation [link]
Forrester privacy heat map [link]
Electronic Frontier Foundation (EFF) - list of international privacy standards [link] - click "see more"!

References

United Nations, The Universal Declaration of Human Rights, 1948. [link]
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR), L 119/1, 2016 [link]

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.