CIPP/E flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Convention 108

First binding international data protection treaty, opened by the Council of Europe in 1981; modernised in 2018 as Convention 108+ with updated principles and enforcement.

GDPR application date

Regulation (EU) 2016/679 entered into force on 24 May 2016 and applied from 25 May 2018, repealing Directive 95/46/EC.

Charter Articles 7 and 8

Article 7 protects private and family life; Article 8 protects personal data. They are distinct rights, with Article 8 imposing fair processing and supervisory authority requirements.

Regulation versus directive

A regulation is directly applicable in every Member State without transposition; a directive binds Member States as to the result and must be transposed into national law.

Controller definition

Under GDPR Article 4(7), the natural or legal person, public authority, agency or other body which alone or jointly determines the purposes and means of processing personal data.

EDPB role

European Data Protection Board, comprising heads of national supervisory authorities; it ensures consistent GDPR application, issues guidelines and adopts binding decisions in disputes.

Directive 2016/680

Directive (EU) 2016/680 governs processing by police and criminal justice authorities, applying data protection principles to law enforcement processing within the EU.

Article 5 principles

Lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Seven core principles binding every controller.

Lawful bases Article 6

Consent, contract performance, legal obligation, vital interests, public task and legitimate interests. At least one must apply to each processing activity; public authorities cannot rely on legitimate interests for their tasks.

Special category data

Article 9 data: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, sex life or sexual orientation.

Consent conditions

Must be freely given, specific, informed and unambiguous, by statement or clear affirmative action; withdrawable at any time; separate from other matters and never based on pre-ticked boxes.

Right to erasure

Article 17 right to have personal data deleted without undue delay where data are no longer necessary, consent is withdrawn, or processing is unlawful, subject to exceptions such as legal claims.

Breach notification deadline

The controller must notify the supervisory authority within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to individuals.

DPIA triggers

Required before processing likely to result in high risk, including systematic profiling with significant effects, large-scale special category processing, and systematic large-scale monitoring of publicly accessible areas.

Article 83 fine tiers

Two tiers: up to EUR 10 million or 2% of global annual turnover for record-keeping, security and DPO duties; up to EUR 20 million or 4% for principles, lawful bases, rights and transfers.

Data portability

Article 20 right to receive personal data in a structured, commonly used, machine-readable format and to transmit them to another controller, where processing is based on consent or contract and is automated.

Accountability principle

Article 5(2) and Article 24 require the controller to demonstrate compliance, not merely comply, through documented policies, records, DPIAs, training and audits.

Records of processing

Article 30 requires written records of processing activities covering purposes, categories of data and recipients, transfers and retention periods; small organisations benefit from limited exemptions.

DPO designation criteria

Mandatory for public authorities, for core activities involving large-scale regular and systematic monitoring, and for core activities involving large-scale special category or criminal data.

Processor contract terms

Article 28(3) requires binding terms on subject matter, duration, purpose, data types, instructions, confidentiality, security, sub-processors, assistance, deletion and audit.

Lead supervisory authority

Under Article 56, the supervisory authority of the main establishment handles cross-border processing; the one-stop-shop is coordinated through the consistency mechanism.

Privacy by design

Article 25 requires controllers to implement appropriate technical and organisational measures and data minimisation by default, built into processing from the outset.

Joint controllers

Article 26 requires joint controllers to arrange their respective responsibilities transparently, but each remains liable to data subjects for the whole processing.

Certification mechanisms

Article 42 allows voluntary certification, seals and marks approved by supervisory authorities or the Board, used to demonstrate compliance and to support transfers under Article 46.

Compensation right

Article 82 gives data subjects the right to compensation for material or non-material damage caused by an infringement; controllers and processors may be held jointly liable.

Adequacy decision

Article 45 Commission decision that a third country ensures an essentially equivalent level of protection, allowing transfers without additional safeguards; reviewed at least every four years.

Standard contractual clauses

Article 46 pre-approved model clauses between exporter and importer; still valid after Schrems II but requiring a case-by-case transfer impact assessment and supplementary measures.

Schrems II ruling

CJEU decision of July 2020 invalidating the EU-US Privacy Shield and confirming SCCs remain valid only if the importing country's law does not undermine protection.

Transfer impact assessment

Documented evaluation of third-country law and practice, including public authority access, used to decide whether supplementary technical, organisational or contractual measures are needed.

Article 49 derogations

Limited exceptions for occasional transfers: explicit informed consent, contract necessity, public interest, legal claims, vital interests and register data; they must not become the default route.

Binding corporate rules

Article 47 intra-group transfer mechanism approved by the lead supervisory authority, requiring binding and enforceable data protection rules throughout the corporate group.

Data Privacy Framework

2023 European Commission adequacy decision for the United States under which certified companies must comply with its principles and provide redress mechanisms.