Regulatory framework

This subtopic contains an overview of the EU data protection and cybersecurity regulatory framework. It is aimed at lawyers who need a high level overview of the legal framework and key issues, and who are not specialised in data protection. For in-depth practical guidance on data protection, see the Information Law practice area (subject to subscription).

Data protection

Data protection law in the EEA (the EU plus Iceland, Norway, and Liechtenstein) is intended to ensure information about living individuals (within the definition of ‘personal data’) is used fairly and responsibly.

To help ensure that, data protection laws impose a large number of obligations on those ‘processing’ personal data (and on controllers of such processing) and grant rights to those whose personal data is processed (the ‘data subjects’). In summary, ‘processing’ includes doing almost anything with personal data, including storing, sharing, deleting or using it.

This part of the subtopic primarily addresses EEA data protection law, the General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR), that apply to ‘general’ processing of personal data. The regime is referred to as ‘general’ since there are special regimes applicable

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

TAKE A FREE TRIAL

Latest EU Law News

EPC seeks service provider for VoP scheme test environment

The European Payments Council (EPC) has launched a request for proposal (RFP) for the selection of a technology service provider in charge of providing, operating and supporting a test environment for the validation and self-certification of the verification of payee (VOP) API (both server-side and client-side) by the scheme participants. Responses are sought by 17 January 2025.

Commission finalises comprehensive EU-Switzerland agreement

The European Commission has announced the completion of negotiations with Switzerland on a broad package of agreements aimed at deepening and expanding bilateral relations. The package includes updates to five existing internal market agreements, new agreements on food safety, health, and electricity, and provisions for Switzerland's participation in EU programmes. Key changes involve the application of EU law on free movement of persons, the introduction of state aid provisions, and the establishment of a Common Food Safety Area. The agreement also sets Switzerland's annual financial contribution to EU cohesion at €375m until 2036 and introduces an arbitral tribunal for dispute resolution, with involvement from the European Court of Justice on matters of EU law.

ECB fines BNP Paribas Fortis SA/NV for intentionally breaching credit risk reporting rules

The European Central Bank (ECB) has imposed an administrative penalty of €10.4m on BNP Paribas Fortis SA/NV for reporting miscalculated risk-weighted assets for credit risk. The bank may challenge the ECB’s decision before the Court of Justice of the European Union.

EIOPA revokes Guidelines and amends Opinion to align with upcoming DORA

The European Insurance and Occupational Pensions Authority (EIOPA) has announced that, in anticipation of the Digital Operational Resilience Act (DORA) coming into application, it will be withdrawing two previously published Guidelines and amending part of an Opinion. The two Guidelines and Opinion are all related, at least in part, to the use of information communication technology (ICT) by undertakings, and by withdrawing them, EIOPA aims to avoid duplications and overlaps with DORA. The changes will take effect from 17 January 2025.