Skip to main content

LUP Student Papers

LUND UNIVERSITY LIBRARIES

The core of GDPR - An analysis of the scope and meaning of the definition ‘processing’ in Article 4(2) GDPR

Ahlesten, Julianne LU (2019) JURM02 20192
Department of Law
Faculty of Law
Abstract
Personal data processing, as will be examined in this thesis, occurs in the public and the private sectors, in organisations of every size. It occurs in every branch of an organisation and by all different actors, be it law-enforcement or a hairdresser saloon. More specifically this thesis aims to study the definition of ‘processing’ and attempts to highlight the features and characterisation of it, since the definition in art. 4(2) GDPR is not exhaustive and leaves margin for interpretation.

There is a lot that can be written about this quite extensive legislation act, but in short, the GDPR has two predominant aims: (i) to strengthen the individual’s rights to protection of personal data and (ii) to contribute to the accomplishment of... (More)
Personal data processing, as will be examined in this thesis, occurs in the public and the private sectors, in organisations of every size. It occurs in every branch of an organisation and by all different actors, be it law-enforcement or a hairdresser saloon. More specifically this thesis aims to study the definition of ‘processing’ and attempts to highlight the features and characterisation of it, since the definition in art. 4(2) GDPR is not exhaustive and leaves margin for interpretation.

There is a lot that can be written about this quite extensive legislation act, but in short, the GDPR has two predominant aims: (i) to strengthen the individual’s rights to protection of personal data and (ii) to contribute to the accomplishment of an area of freedom, security and justice and of an economic union, to economic and social progress, to the strengthening and the convergence of the economies within the internal market (preamble 1-2 GDPR). This is a balance of two important objectives of the Union – Individual’s rights and the Internal Market.

Partly, the inspiration to the formulation of the research questions is the Charter of Fundamental Rights of the European Union art. 52(3) were the scope of the rights is established. And the formulation of it is “meaning and scope” and it can be read as the interpretation method for the rights in the Charter that have corresponding rights in the Convention for the Protection of the Human Rights and Fundamental Freedoms (ECHR). The other part was the interest in technology and privacy so the topic of the new data protection legislation, GDPR was selected.

As Cullen International phrases it in the book A Business Guide to Changes in European Data Protection Legislation: “The criteria for determining whether a processing has occurred are not directly derived from the definition. However, in practice this is the first problem encountered when applying the Directive.”. (Less)
Abstract (Swedish)
Behandling av personuppgifter, vilket undersöks i denna uppsats, sker i den offentliga och privata sektorn, och i organisationer av alla storlekar. Personuppgiftsbehandlingar förekommer i varje gren av en organisation och hos alla olika aktörer, inom så spridda områden som rättsväsendet eller en frisörsalong. Mer specifikt syftar denna uppsats till att studera definitionen av "behandling" och försöker belysa funktioner och karakterisering av den, eftersom definitionen i artikel 4 (2) GDPR som inte är uttömmande och lämnar därför utrymme för tolkning.

Det finns mycket som kan nämnas om denna omfattande lagstiftningen, men
kort sagt har GDPR två dominerande syften: (i) att stärka individens
rättigheter till skydd av personuppgifter och... (More)
Behandling av personuppgifter, vilket undersöks i denna uppsats, sker i den offentliga och privata sektorn, och i organisationer av alla storlekar. Personuppgiftsbehandlingar förekommer i varje gren av en organisation och hos alla olika aktörer, inom så spridda områden som rättsväsendet eller en frisörsalong. Mer specifikt syftar denna uppsats till att studera definitionen av "behandling" och försöker belysa funktioner och karakterisering av den, eftersom definitionen i artikel 4 (2) GDPR som inte är uttömmande och lämnar därför utrymme för tolkning.

Det finns mycket som kan nämnas om denna omfattande lagstiftningen, men
kort sagt har GDPR två dominerande syften: (i) att stärka individens
rättigheter till skydd av personuppgifter och (ii) att bidra till att uppnå ett område med frihet, säkerhet och rättvisa och av en ekonomisk union, till ekonomiska och sociala framsteg, till förstärkning och konvergens av ekonomierna på den inre marknaden (ingressen 1-2 GDPR). Detta är en balans mellan två viktiga mål för unionen - individens rättigheter och den inre marknaden.

Delvis finns inspirationen till formuleringen av forskningsfrågorna i den
Europeiska unionens stadga om grundläggande rättigheter artikel 52(3) som
fastställer omfattningen av rättigheterna, formulerat som ”tolkning och
tillämpningsområde” och det kan läsas som att tolkningsmetoden för
rättigheterna i stadgan som har motsvarande rättigheter i Europeiska
konventionen om skydd för de mänskliga rättigheterna och de
grundläggande friheterna (EKMR). Den andra delen var intresset för teknik
och integritet vilket fick mig att välja GDPR som ämne.

Som Cullen International uttrycker det i boken A Business Guide to
Changes in European Data Protection Legislation: “The criteria for
determining whether a processing has occurred are not directly derived
from the definition. However, in practise this is the first problem
encountered when applying the Directive.”.2 (Less)
Please use this url to cite or link to this publication:
author
Ahlesten, Julianne LU
supervisor
organization
course
JURM02 20192
year
type
H3 - Professional qualifications (4 Years - )
subject
keywords
IT-rätt
language
English
id
9000594
date added to LUP
2020-02-03 12:22:47
date last changed
2020-02-03 12:22:47
@misc{9000594,
  abstract     = {{Personal data processing, as will be examined in this thesis, occurs in the public and the private sectors, in organisations of every size. It occurs in every branch of an organisation and by all different actors, be it law-enforcement or a hairdresser saloon. More specifically this thesis aims to study the definition of ‘processing’ and attempts to highlight the features and characterisation of it, since the definition in art. 4(2) GDPR is not exhaustive and leaves margin for interpretation.

There is a lot that can be written about this quite extensive legislation act, but in short, the GDPR has two predominant aims: (i) to strengthen the individual’s rights to protection of personal data and (ii) to contribute to the accomplishment of an area of freedom, security and justice and of an economic union, to economic and social progress, to the strengthening and the convergence of the economies within the internal market (preamble 1-2 GDPR). This is a balance of two important objectives of the Union – Individual’s rights and the Internal Market.

Partly, the inspiration to the formulation of the research questions is the Charter of Fundamental Rights of the European Union art. 52(3) were the scope of the rights is established. And the formulation of it is “meaning and scope” and it can be read as the interpretation method for the rights in the Charter that have corresponding rights in the Convention for the Protection of the Human Rights and Fundamental Freedoms (ECHR). The other part was the interest in technology and privacy so the topic of the new data protection legislation, GDPR was selected.

As Cullen International phrases it in the book A Business Guide to Changes in European Data Protection Legislation: “The criteria for determining whether a processing has occurred are not directly derived from the definition. However, in practice this is the first problem encountered when applying the Directive.”.}},
  author       = {{Ahlesten, Julianne}},
  language     = {{eng}},
  note         = {{Student Paper}},
  title        = {{The core of GDPR - An analysis of the scope and meaning of the definition ‘processing’ in Article 4(2) GDPR}},
  year         = {{2019}},
}