Data Protection Directive 95/46/EC: Scope, Rights, and Transfers

The Data Protection Directive 95/46/EC was the European Union’s first bloc-wide personal data protection law, adopted on 24 October 1995 and in force until the General Data Protection Regulation replaced it on 25 May 2018.¹ It required every member state to pass national legislation meeting its minimum standards, setting a common baseline of privacy rights while letting personal data move freely inside the internal market. Before it, member states had wildly different rules, which caused friction for cross-border business and left residents with uneven protections depending on where they lived.

Who and What the Directive Covered

Article 3 set the material scope. The Directive applied to any processing of personal data carried out by automated means, and also to non-automated data that formed part of a structured filing system.² “Personal data” meant any information that could identify a living person, whether directly through a name or ID number or indirectly through a combination of characteristics. Digital databases, structured paper files, and public-sector records all fell within it.

The territorial reach was broader than it first appeared. If a controller was established in a member state, that state’s implementing law applied. Controllers based entirely outside the EU still had to comply if they used equipment located in a member state to process data, unless that equipment was used purely for transit.³ Organizations with European subsidiaries or branches were squarely in scope.

Two carve-outs narrowed things. Purely personal or household activities fell outside the Directive entirely, so a personal address book or family photo album triggered no obligations. Article 9 also required member states to create exemptions for data processing carried out solely for journalism or artistic and literary expression, where those exemptions were necessary to balance privacy against freedom of expression.³

The Six Grounds for Lawful Processing

Having a reasonable business purpose was not enough. Article 7 listed six specific grounds, and processing was lawful only if at least one applied.⁴

Unambiguous consent from the individual.
Contractual necessity, where processing was needed to perform a contract with the individual or take steps before entering one at their request.
Legal obligation binding the controller.
Vital interests, where processing was necessary to protect someone’s life or physical safety.
Public interest or the exercise of official authority granted to the controller.
Legitimate interests of the controller, but only where those interests were not overridden by the individual’s fundamental rights and freedoms.

Legitimate interests was the most flexible and the most contested. Controllers had to weigh their own interests against the privacy impact on the individual, and that balancing test generated significant case law across member states. When no ground applied, processing was simply unlawful, however carefully the data was handled.

Data Quality Principles

Article 6 imposed quality requirements that applied on top of the lawful-processing grounds. Even with a valid legal basis, controllers still had to follow these rules on how data was collected, kept, and disposed of.³ Data had to be processed fairly and lawfully. It had to be collected for specific, clearly stated purposes, and using it later for something unrelated was prohibited. It had to be adequate and relevant but not excessive for the stated purpose. It had to be accurate and kept up to date, with reasonable steps taken to fix or erase inaccurate records. It could only be kept in identifiable form for as long as the original purpose required.

Purpose limitation caught organizations off guard most often. A company that collected email addresses to fulfill orders could not later feed those addresses into a marketing campaign without a separate legal basis. Storage limitation forced organizations to build deletion schedules rather than hoard data indefinitely on the theory it might prove useful someday.

Sensitive Data Rules

Article 8 singled out certain categories as so sensitive that processing them was prohibited by default: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and data concerning health or sex life.³ The general prohibition reflected a judgment that misuse of this kind of information carries uniquely serious consequences.

The ban was not absolute. Processing could proceed with explicit consent (though some member states could prevent even explicit consent from overriding the prohibition), where necessary to carry out employment-law obligations under national law with adequate safeguards, to protect the vital interests of a person unable to consent, in the internal member records of a political, philosophical, religious, or trade-union nonprofit, where the individual had already made the data public themselves, or where processing was necessary for legal claims.

Healthcare data had its own carve-out under Article 8(3). Medical professionals bound by professional secrecy could process health data for preventive medicine, diagnosis, treatment, or managing health services without triggering the general prohibition.³ Member states could also create additional exemptions for reasons of substantial public interest, provided suitable safeguards were in place.

Security Duties

Article 17 required controllers to implement technical and organizational measures protecting personal data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access.³ The required level was not fixed. Controllers had to calibrate their measures to the sensitivity of the data and the risks of the processing, taking into account available technology and implementation costs.

Outsourcing did not shift responsibility. When a controller used a third-party processor, it had to select one that offered sufficient security guarantees and then bind that processor through a written contract. The contract had to specify that the processor would act only on the controller’s instructions and would comply with the same security standards required of the controller itself.⁴ Data transmitted over a network demanded particular attention because interception risks increased during transit.

Rights the Directive Gave Individuals

The Directive gave people a suite of enforceable rights meant to keep them informed and let them intervene when something went wrong.

Access, Rectification, and Erasure

Article 12 guaranteed the right to obtain confirmation from a controller about whether personal data was being processed, together with details about the purpose of the processing and the categories of recipients.³ Individuals could request a copy of the data in intelligible form without excessive delay or cost. If the data was wrong or incomplete, they could demand rectification. Where data was no longer needed or had been processed unlawfully, they could require erasure.

Right to Object

Article 14 let individuals object to processing on compelling grounds related to their personal situation, at least where processing was based on the public-interest or legitimate-interests grounds.³ For direct marketing, the right was unconditional. People could opt out of promotional materials at any time, without justification.

Protection Against Automated Decisions

Article 15 gave every person the right not to be subject to a decision that produced legal effects or significantly affected them when that decision was based solely on automated processing intended to evaluate personal characteristics such as job performance, creditworthiness, or reliability.⁴ A bank could not reject a loan application on the strength of an algorithm alone. A human had to be part of the decision, or the individual had to have a meaningful way to challenge the outcome. For a law passed in 1995, this was remarkably forward-looking.

International Data Transfers

Articles 25 and 26 fundamentally shaped how personal data could leave EU borders. The default rule: personal data could only be transferred to a country outside the EU if that country ensured an adequate level of protection.⁴ Adequacy was assessed by looking at the nature of the data, the purpose of the transfer, the receiving country’s legal framework, and the professional and security rules in force there.

The European Commission could formally declare that a country met the standard, creating an adequacy decision that opened the door for data flows.⁵ Without an adequacy decision, transfers could still proceed under specific derogations in Article 26: the individual’s unambiguous consent, contractual necessity, public-interest grounds, legal claims, or protection of vital interests. Controllers could also use approved contractual clauses that bound the recipient to Directive-equivalent protections.

The Safe Harbor and Its Collapse

The United States posed the biggest practical problem. American privacy law operates sectorally rather than through a comprehensive framework, so a blanket adequacy finding was not feasible. In 2000, the US Department of Commerce and the European Commission negotiated a workaround called the Safe Harbor Privacy Principles. US organizations could voluntarily self-certify their adherence to a set of privacy principles, and the Commission treated certified organizations as providing adequate protection for purposes of Article 25.⁶ The Federal Trade Commission enforced it by pursuing violations of self-certified commitments as deceptive practices.

The arrangement lasted fifteen years. In October 2015, the Court of Justice of the European Union struck it down in the Schrems case (C-362/14), ruling that the Safe Harbor did not adequately protect EU residents’ data against US government surveillance.⁷ The Court held that “adequate protection” under the Directive meant protection essentially equivalent to what was guaranteed within the EU, and that mass surveillance without effective safeguards or judicial redress fell short. The ruling also confirmed that national supervisory authorities kept the power to investigate the lawfulness of transfers even where an adequacy decision existed. The Safe Harbor’s successor, Privacy Shield, was itself invalidated in 2020 on similar grounds.

National Supervisory Authorities

Article 28 required every member state to designate at least one independent public authority to monitor compliance with its national data protection law.⁴ Independence was substantive, not formal.

These authorities held three categories of power. Investigative powers included the right to access data and gather information needed for supervision. Intervention powers allowed them to issue opinions on planned processing, order the blocking or destruction of data, impose temporary or permanent processing bans, and issue warnings. They could also initiate or refer legal proceedings when national data protection law was breached.⁴

Anyone who believed their rights had been violated could lodge a complaint with the supervisory authority, which had to investigate and inform the complainant of the outcome. Supervisory authorities across member states were expected to cooperate, though in practice cooperation was often slow and inconsistent.

What Replaced the Directive

The GDPR took effect on 25 May 2018, repealing Directive 95/46/EC and replacing it with a regulation that applied directly across all member states without national transposition.¹ The shift from directive to regulation was the single most important structural change: it removed the patchwork of 28 different national laws and replaced them with one unified set of rules.

The GDPR preserved the Directive’s core architecture and strengthened it. Fines rose from whatever penalties member states had chosen to implement to a maximum of €20 million or 4% of global annual turnover, whichever is higher.¹ New requirements included mandatory data breach notifications to supervisory authorities, the appointment of data protection officers for certain organizations, and expanded rules on profiling and automated decision-making.⁸ The Article 29 Working Party, which had coordinated supervisory authorities under the Directive, was replaced by the European Data Protection Board with a formal consistency mechanism for cross-border disputes.

The Directive established the vocabulary of modern data protection law: purpose limitation, data minimization, adequacy decisions, independent supervisory authorities. Most of the GDPR’s provisions trace directly back to principles the Directive laid down in 1995. The fundamental logic never changed. What changed was how seriously the EU intended to enforce it.

1
European Data Protection Supervisor. History of the General Data Protection Regulation
2
WIPO Lex. Directive 95/46/EC of the European Parliament and of the Council
3
EUR-Lex. Directive 95/46/EC of the European Parliament and of the Council
4
European Data Protection Supervisor. Directive 95/46/EC Consolidated Text
5
European Commission. Adequacy Decisions
6
Federal Register. Issuance of Safe Harbor Principles and Transmission to European Commission
7
European Parliamentary Research Service. The CJEU Schrems Ruling and the Safe Harbour Decision
8
European Parliament. A Comparison Between US and EU Data Protection Legislation for Law Enforcement Purposes