Introduction to European Data Protection
Two rights, two courts, several layers
Start with the architecture. The Council of Europe's Convention 108 (1981, modernised as 108+) is the first binding international data protection treaty; the OECD Guidelines (1980) are soft law. The EU's own regime began with Directive 95/46/EC, which harmonised national laws through transposition, and was replaced on 25 May 2018 by the GDPR (Regulation 2016/679), which is directly applicable in all Member States yet leaves room for dozens of opening clauses where national law fills gaps. The Charter of Fundamental Rights became binding with the Lisbon Treaty in 2009 and contains two distinct rights: Article 7 (private and family life, home, correspondence) and Article 8 (protection of personal data). The ePrivacy Directive 2002/58/EC is the lex specialis for electronic communications, and Directive 2016/680 (LED) governs police and criminal justice processing. Interpretation comes from two courts: the CJEU in Luxembourg and the ECtHR in Strasbourg.
Traps
Questions love to blur the layers. “Article 8 protects private life” is wrong inside the EU Charter - that is Article 7; Article 8 of the Charter is data protection, while Article 8 ECHR is private life. Do not treat the GDPR as fully uniform: many provisions expressly defer to Member State law. Do not confuse the European Council, the Council of Europe and the Council of the EU. The EDPB is a body of regulators that issues opinions and guidelines; it does not fine anyone - national supervisory authorities do. Finally, privacy and data protection are overlapping but separate concepts: data protection is procedural and applies to personal data regardless of whether private life is at stake.
Rule of thumb
If an actor sits in Strasbourg (Convention 108, ECtHR, Treaty Committee), think Council of Europe; if it sits in Brussels or Luxembourg (regulation, EDPB, CJEU), think EU.