A Brief History of Data Privacy Legislation

30 March 2018

1953 - First legal protections for personal information codified in Article 8 European Convention of Human Rights (ECHR)

1981 – Council of Europe established standards (the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data) ensured the free flow of information throughout EU-Member States without infringing personal privacy

1984 – UK introduced the first Data Protection Act (DPA) which were a set of basic rules governing the storage and processing of personal data in the UK, and accommodated the standards set down in the EU's 1981 convention above

1995 – the Data Protection Directive (DPD) was enacted to deal with the increased divergence of EU-Member States' data protection laws which was impeding the flow of data, and with it, business.

1998 – UK developed its second DPA to enact the requirements of the DPD. The new DPA was founded on eight Principles. Across the EU, similar legislation was enacted but no two laws were sufficiently similar so as to ensure simultaneous compliance. The response to this was, rather than setting down new Directives, which have no direct effect, the EU decided in 2012 it would instead establish a Regulation, which ensures uniformity across all member states. What followed was:

2016 – the Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (otherwise known as GDPR) entered into force and a two-year 'grace' period given to those to whom it would affect

2018 – from 25 May 2018, GDPR will become fully enforceable. In the UK, the Data Protection Bill was introduced in September 2017 to enable limited opportunities to make provision for how it will apply.