IP addresses are included in the notion of personal data, according to the case-law
of the CJEU.
29
The broad European notion of personal data has been replicated in several
non-EU countries.
30
As already mentioned, in the EU the right to personal data protection is recognized as a specific fundamental right, which is distinct from privacy, although
closely related to it, as is clear from the comparison of articles 7 and 8 of the Charter
of Fundamental Rights.
31
This is not the case of other legal systems, in which the right to personal data is
not seen as an independent right, but rather as a derivative of the right to privacy:
such is the case, inter alia, of South Africa
32 and the U.S.
33
Within the notion of personal data, a distinct category is established in the
European GDPR concerning particularly sensitive data, which are subject to special,
more protective rules. Such data are defined by article 9(1) of the Regulation as:
personal data revealing racial or ethnic origin, political opinions, religious or philosophical
beliefs, or trade union membership, and the processing of genetic data, biometric data for the
purpose of uniquely identifying a natural person, data concerning health or data concerning a
natural person’s sex life or sexual orientation.
The concern with sensitive data is equally present in other jurisdictions, the law of
which evidences the European influence.
34
European legislation regarding personal data protection is in principle equally
applicable to their processing by public and private entities. However, “public
authorities which may receive personal data in the framework of a particular inquiry
in accordance with Union or Member State law shall not be regarded as recipients;
the processing of those data by those public authorities shall be in compliance with
the applicable data protection rules according to the purposes of the processing”
(article 4(9) of the GDPR). Furthermore, special rules apply to the processing of
personal data by European Union institutions and in criminal matters.
35
The opposite view has prevailed in the U.S., where personal data protection rules
are primarily aimed at federal agencies. This difference in part reflects, according to
the American national reporter, a divergence in citizens’ sources of distrust: while, to
her mind, Europeans particularly distrust private corporations, Americans are apparently more concerned with their Government’s attempts to invade their privacy.
36
29 See judgment of 19 October 2016, case C-581/14, Patrick Breyer v Bundesrepublik Deutschland,
ECLI:EU:C:2016:779.
30 See, for instance, the Cape-Verdean National Report, Sect. 2.1; Swiss National Report, Sect. 1.1.
31 See, on this European Union Special Report, Sect. 1.2.
32 See the South African National Report, Sect. 2.2.
33 See the United States of America’s National Report, Sects. 1.1 and 1.2.
34 See, for instance, the Cape-Verdean National Report, Sect. 2.2.5, and the Swiss National Report,
Sect. 1.1.
35 See, on this, the European Union Special Report, Sect. 1.3.
36 See the United States of America’s National Report, Sect. 8.
8
D. Moura Vicente and S. de Vasconcelos Casimiro
of the CJEU.
29
The broad European notion of personal data has been replicated in several
non-EU countries.
30
As already mentioned, in the EU the right to personal data protection is recognized as a specific fundamental right, which is distinct from privacy, although
closely related to it, as is clear from the comparison of articles 7 and 8 of the Charter
of Fundamental Rights.
31
This is not the case of other legal systems, in which the right to personal data is
not seen as an independent right, but rather as a derivative of the right to privacy:
such is the case, inter alia, of South Africa
32 and the U.S.
33
Within the notion of personal data, a distinct category is established in the
European GDPR concerning particularly sensitive data, which are subject to special,
more protective rules. Such data are defined by article 9(1) of the Regulation as:
personal data revealing racial or ethnic origin, political opinions, religious or philosophical
beliefs, or trade union membership, and the processing of genetic data, biometric data for the
purpose of uniquely identifying a natural person, data concerning health or data concerning a
natural person’s sex life or sexual orientation.
The concern with sensitive data is equally present in other jurisdictions, the law of
which evidences the European influence.
34
European legislation regarding personal data protection is in principle equally
applicable to their processing by public and private entities. However, “public
authorities which may receive personal data in the framework of a particular inquiry
in accordance with Union or Member State law shall not be regarded as recipients;
the processing of those data by those public authorities shall be in compliance with
the applicable data protection rules according to the purposes of the processing”
(article 4(9) of the GDPR). Furthermore, special rules apply to the processing of
personal data by European Union institutions and in criminal matters.
35
The opposite view has prevailed in the U.S., where personal data protection rules
are primarily aimed at federal agencies. This difference in part reflects, according to
the American national reporter, a divergence in citizens’ sources of distrust: while, to
her mind, Europeans particularly distrust private corporations, Americans are apparently more concerned with their Government’s attempts to invade their privacy.
36
29 See judgment of 19 October 2016, case C-581/14, Patrick Breyer v Bundesrepublik Deutschland,
ECLI:EU:C:2016:779.
30 See, for instance, the Cape-Verdean National Report, Sect. 2.1; Swiss National Report, Sect. 1.1.
31 See, on this European Union Special Report, Sect. 1.2.
32 See the South African National Report, Sect. 2.2.
33 See the United States of America’s National Report, Sects. 1.1 and 1.2.
34 See, for instance, the Cape-Verdean National Report, Sect. 2.2.5, and the Swiss National Report,
Sect. 1.1.
35 See, on this, the European Union Special Report, Sect. 1.3.
36 See the United States of America’s National Report, Sect. 8.
8
D. Moura Vicente and S. de Vasconcelos Casimiro