03/02/2020
CURIA - Documents
these cases, the processing should be governed by the law of the Member State in which the
means used are located, and there should be guarantees to ensure that the rights and obligations
provided for in this Directive are respected in practice;
...
(25) … the principles of protection must be reflected, on the one hand, in the obligations imposed on
persons … responsible for processing, in particular regarding data quality, technical security,
notification to the supervisory authority, and the circumstances under which processing can be
carried out, and, on the other hand, in the right conferred on individuals, the data on whom are the
subject of processing, to be informed that processing is taking place, to consult the data, to
request corrections and even to object to processing in certain circumstances’.
4 Article 2 of Directive 95/46 states that ‘[f]or the purposes of this Directive:
(a) “personal data” shall mean any information relating to an identified or identifiable natural person
(“data subject”); an identifiable person is one who can be identified, directly or indirectly, in
particular by reference to an identification number or to one or more factors specific to his
physical, physiological, mental, economic, cultural or social identity;
(b) “processing of personal data” (“processing”) shall mean any operation or set of operations
which is performed upon personal data, whether or not by automatic means, such as collection,
recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by
transmission, dissemination or otherwise making available, alignment or combination, blocking,
erasure or destruction;
...
(d) “controller” shall mean the natural or legal person, public authority, agency or any other body
which alone or jointly with others determines the purposes and means of the processing of
personal data; where the purposes and means of processing are determined by national or
Community laws or regulations, the controller or the specific criteria for his nomination may be
designated by national or Community law;
...’
5 Article 3 of Directive 95/46, entitled ‘Scope’, states in paragraph 1:
‘This Directive shall apply to the processing of personal data wholly or partly by automatic means, and
to the processing otherwise than by automatic means of personal data which form part of a filing system
or are intended to form part of a filing system.’
6 Article 4 of Directive 95/46, entitled ‘National law applicable’, provides:
‘1. Each Member State shall apply the national provisions it adopts pursuant to this Directive to the
processing of personal data where:
(a) the processing is carried out in the context of the activities of an establishment of the controller
on the territory of the Member State; when the same controller is established on the territory of
several Member States, he must take the necessary measures to ensure that each of these
establishments complies with the obligations laid down by the national law applicable;
(b) the controller is not established on the Member State’s territory, but in a place where its national
law applies by virtue of international public law;
(c) the controller is not established on Community territory and, for purposes of processing personal
data makes use of equipment, automated or otherwise, situated on the territory of the said
Member State, unless such equipment is used only for purposes of transit through the territory of
the Community.
curia.europa.eu/juris/document/document_print.jsf?doclang=EN&text=&pageIndex=0&part=1&mode=DOC&docid=152065&occ=first&dir=&cid=667631
3/19