• the principle of lawfulness and fairness: collecting and processing data should not
be unfair or unlawful and data should not be used for ends contrary to the Charter
of the United Nations,
• the principle of accuracy: obligations to check accuracy and relevance,
• the principle of purpose-specification, and
• the principle of non-discrimination.
The principles of interested-person access and that of data security as well as that
of transborder flow of data should be mentioned, too.
31
The CoE Privacy Framework embodies several general principles of data
processing, but not processing of personal data by electronic means in particular,
according to article 5:
1. Data processing shall be proportionate in relation to the legitimate purpose pursued and
reflect at all stages of the processing a fair balance between all interests concerned, whether
public or private, and the rights and freedoms at stake. (. . .) 3. Personal data undergoing
processing shall be processed lawfully. 4. Personal data undergoing processing shall be:
a. processed fairly and in a transparent manner; b. collected for explicit, specified and
legitimate purposes and not processed in a way incompatible with those purposes; (. . .)
c. adequate, relevant and not excessive in relation to the purposes for which they are
processed; d. accurate and, where necessary, kept up to date; e. preserved in a form which
permits identification of data subjects for no longer than is necessary for the purposes for
which those data are processed.
With regard to OECD, there is no legislation covering especially personal data
processing by electronic means. The Recommendation of the Council on Principles
for Internet Policy Making covers the free flow of data and mentions data protection
for internet services only referring to the OECD Privacy Framework. Still, the
explanatory memorandum of the OECD Privacy Framework contains general principles of national data protections laws:
• setting limits to the collection of personal data in accordance with the objective of
the data controller and similar criteria; the principle of purpose-specification,
• restricting the usage of data to conform with openly specified purposes,
• creating facilities for individuals to learn of the existence and contents of data and
have data corrected, and
• identification of parties who are responsible for compliance with relevant privacy
protection rules and decisions.
32
Data protection in the General Agreement on Trade in Services (GATS) is
rudimentary. However, Article III GATS states that “Nothing in this Agreement
shall require any Member to provide confidential information, the disclosure of
which would impede law enforcement, or otherwise be contrary to the public
interest, or which would prejudice legitimate commercial interests of particular
enterprises, public or private”. This permits parties to keep information confidential
31 Yilma (2018), p. 6.
32 Corley (2016), p. 760, note 274.
530
T. Hoeren
be unfair or unlawful and data should not be used for ends contrary to the Charter
of the United Nations,
• the principle of accuracy: obligations to check accuracy and relevance,
• the principle of purpose-specification, and
• the principle of non-discrimination.
The principles of interested-person access and that of data security as well as that
of transborder flow of data should be mentioned, too.
31
The CoE Privacy Framework embodies several general principles of data
processing, but not processing of personal data by electronic means in particular,
according to article 5:
1. Data processing shall be proportionate in relation to the legitimate purpose pursued and
reflect at all stages of the processing a fair balance between all interests concerned, whether
public or private, and the rights and freedoms at stake. (. . .) 3. Personal data undergoing
processing shall be processed lawfully. 4. Personal data undergoing processing shall be:
a. processed fairly and in a transparent manner; b. collected for explicit, specified and
legitimate purposes and not processed in a way incompatible with those purposes; (. . .)
c. adequate, relevant and not excessive in relation to the purposes for which they are
processed; d. accurate and, where necessary, kept up to date; e. preserved in a form which
permits identification of data subjects for no longer than is necessary for the purposes for
which those data are processed.
With regard to OECD, there is no legislation covering especially personal data
processing by electronic means. The Recommendation of the Council on Principles
for Internet Policy Making covers the free flow of data and mentions data protection
for internet services only referring to the OECD Privacy Framework. Still, the
explanatory memorandum of the OECD Privacy Framework contains general principles of national data protections laws:
• setting limits to the collection of personal data in accordance with the objective of
the data controller and similar criteria; the principle of purpose-specification,
• restricting the usage of data to conform with openly specified purposes,
• creating facilities for individuals to learn of the existence and contents of data and
have data corrected, and
• identification of parties who are responsible for compliance with relevant privacy
protection rules and decisions.
32
Data protection in the General Agreement on Trade in Services (GATS) is
rudimentary. However, Article III GATS states that “Nothing in this Agreement
shall require any Member to provide confidential information, the disclosure of
which would impede law enforcement, or otherwise be contrary to the public
interest, or which would prejudice legitimate commercial interests of particular
enterprises, public or private”. This permits parties to keep information confidential
31 Yilma (2018), p. 6.
32 Corley (2016), p. 760, note 274.
530
T. Hoeren