JUR660 Protection of Personal Data in Europe (Spring 2027)

This course will not be offered in the spring semester of 2026

The value of privacy and respect for private life is old and universal. However, over the last couple of decades, and due to the ever-increasing importance of information economy in modern societies, the regulation of personal data processing has taken the center stage in the public discourse on protection of privacy and private life. Rapid technological developments have visualized how personal data can be used to the best of mankind, but also the potential for misuse. In this course, the students will learn more about the legal framework regulating the processing of personal data.

The European Union is at the forefront when it comes to regulating the processing of personal data. The EU Charter of Fundamental Rights from 2000 contains, in addition to the general right to respect for private life in Article 7, an autonomous right to protection of personal data in Article 8. The General Data Protection Regulation (GDPR) which entered into force in May 2018 contains a comprehensive and detailed set of general principles and detailed rules for processing of personal data and represents an operationalization of the general principles in the EU Charter. The aims of the Regulation are two-fold: (1) to protect the privacy rights of natural persons within the European Union, and (2) to facilitate the free movement of data within the EU. The Regulation has a global outreach, as any organization outside the EU that provides services into the EU that involves processing of personal data must comply.

The protection of personal data within the Council of Europe system for human rights protection is based on another approach. The European Convention of Human Rights (ECHR), which entered into force in September 1953, does not contain an autonomous right to protection of personal data. Nevertheless, since the Leander v. Sweden judgment from 1987, in which the European Court of Human Rights (ECtHR) for the first time considered the storage by a public authority of an individual’s personal data, the Court’s case-law under ECHR Article 8, which protects the right to respect for private and family life, has seen a significant development. The Court has over the years elaborated on the limits for public authorities’ own processing of personal data and has also developed positive duties on the Contracting states to prevent processing of such information by non-state actors and private individuals.

Knowledge

By the end of the course the students shall

• Be familiar with the main features of the European legal and institutional architecture regulating the processing of personal data
• Have good knowledge of the principles for the processing of personal data
• Have thorough knowledge of consent as legal basis for the processing of personal data, as well as the right to access and rectification of personal data, and the right to be forgotten
• Have good knowledge of the various aspects of enforcement of GDPR
• Be familiar with the legal framework for international data transfers

Skills

By the end of the course the students shall

• Be able to reflect on the interplay between relevant human rights, general principles for the processing of personal data, and the specific rights and obligations laid down by GDPR and the ECHR
• Be able to explain and analyze judgments in personal data cases from international and national courts
• Be able to apply provisions and judge made criteria and guidelines on real and hypothetical sets of facts in personal data cases
• Be well prepared to take on more advanced studies in this area of law

General Competence

The students shall achieve competence to

• Analyze relevant legal sources in the field of personal data
• Identify and evaluate new developments in law and in practice
• Discuss and reflect on key personal data issues, both orally and in writing
• Participate in contemporary debates on personal data protection

• Mandatory coursework: Assignment(s)
• Courseworks given: 1
• Courseworks required: 1

• Form of assessment: Digital school assessment
• Proportion: 100%
• Duration: 4 hours
• Grouping: Individual
• Grading scale: Letter (A - F)
• Supported material: Lovdata (examination mode)