HumenhukCIPP/E Study Guide
Ch 3.3 - Directive 95/46

Data Protection Directive 95/46/EC

Reviewed by Victor Humenhuk. Published . Reviewed .

Adopted on 24 October 1995, Directive 95/46 was the EU's flagship data protection law, set up as an internal market harmonisation measure under the Treaty of Rome - a human rights law that also protected the single market. It had 72 recitals and 34 articles, extended protection to manual data in filing systems, created national DPAs and the Article 29 Working Party, and left member states a wide margin of manoeuvre in implementation.

By the end of the 1980s, only a few states had ratified Convention 108 and their laws were fragmented, harming both privacy and the Treaty of Rome's free-trade goals. So in 1990 the Commission proposed a Directive, formally adopted on 24 October 1995. Because the EU cannot make stand-alone human-rights laws, it was based on the internal market provisions - the free movement of goods, persons, services and capital, which needs the free movement of personal data.

  • 72 recitals and 34 articles, arranged in seven chapters
  • Set out general principles but left detailed transposition to member states (the margin of manoeuvre)
  • Recurring concepts: ‘necessity’ and ‘adequacy’ for international transfers
  • Major advance over Convention 108: applied to manual data in a filing system
  • Applied to data controllers ‘established' in a member state, or using processing equipment there (requiring a representative)
  • Identified special categories of data and set extra requirements
  • Mandated a national DPA in each state acting with ‘complete independence' and the Article 29 Working Party
Key Directive 95/46 facts
FeatureDetail
Adopted24 October 1995
Proposed1990 by the Commission
Structure72 recitals, 34 articles, 7 chapters
Legal baseInternal market / Treaty of Rome harmonisation
Scope advanceCovered manual data in filing systems
Applied toData controllers only
Bodies createdNational DPAs; Article 29 Working Party (Art 30 duties)
Common confusion

The Directive applied to data controllers only. Direct obligations on processors are a GDPR innovation. Also note the WP29's duties sit in Article 30.

Key terms - quick answers

What is “Directive 95/46”?
The 1995 Data Protection Directive; the EU's main data protection law until the GDPR replaced it.
What is “Internal market”?
The EU single market requiring free movement of goods, persons, services and capital - and thus of personal data.
What is “Margin of manoeuvre”?
Flexibility member states had to transpose Directive principles into national law, causing divergence.
What is “Manual data”?
Personal data held in a structured filing system by non-automatic means; the Directive subjected it to the same rules as automated data.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.