Certified Information Privacy Professional/Europe (CIPP-E) 

Introduction to European Data Protection

• Origins and Historical Context of Data Protection Law
  • Rationale for data protection
  • Human rights laws
  • Early laws and regulations
• OECD Guidelines and the Council of Europe
  • Convention 108
  • The need for a harmonized European approach
  • The Treaty of Lisbon
  • Convention 108+
  • Brexit

European Union Institutions

• European Court of Human Rights
• European Parliament
• European Commission
• European Council
• Court of Justice of the European Union

Legislative Framework

• The Council of Europe Convention for the Protection of Individuals with Regard to the Automatic Processing of Personal Data of 1981 (The CoE Convention)
• The EU Data Protection Directive (95/46/EC)
• The EU Directive on Privacy and Electronic Communications (2002/58/EC) (ePrivacy Directive) – as amended
• The EU Directive on Electronic Commerce (2000/31/EC)
• European data retention regimes
• The General Data Protection Regulation (GDPR) (EU) 2016/679 and related legislation
• Relationship with other laws (Payment Services Directive 2, Data Governance Act, Regulation (EU) 2018/1725, etc.)
• NIS Directive (2016) / NIS 2 Directive (2022)
• EU Artificial Intelligence Act (2021)

European Data Protection Law and Regulation

• Data Protection Concepts
  • Personal data
  • Sensitive personal data
  • Special categories of personal data
  • Pseudonymous and anonymous data
  • Processing
  • Controller
  • Processor
  • Guidelines 07/2020 on the concepts of controller and processor in the GDPR
  • Data subject
• Territorial and Material Scope of the General Data Protection Regulation
  • Establishment in the EU
  • Non-establishment in the EU
  • Guidelines 3/2018 on the territorial scope of the GDPR
• Data Processing Principles
  • Fairness and lawfulness
  • Purpose limitation
  • Proportionality
  • Accuracy
  • Storage limitation (retention)
  • Integrity and confidentiality
• Lawful Processing Criteria
  • Consent
  • Contractual necessity
  • Legal obligation, vital interests, and public interest
  • Legitimate interests
  • Special categories of processing
• Information Provision Obligations
  • Transparency principle
  • Privacy notices
  • Layered notices
• Data Subjects’ Rights
  • Access
  • Guidelines 01/2022 on data subject rights - Right of access
  • Rectification
  • Erasure and the right to be forgotten (RTBF)
  • Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR
  • Restriction and objection
  • Consent, including right of withdrawal
  • Automated decision making, including profiling
  • Data portability
  • Restrictions
  • Guideline 10/2020 on restrictions under Article 23 GDPR
• Security of Personal Data
  • Appropriate technical and organizational measures
  • Protection mechanisms (encryption, access controls, etc.)
  • Breach notification
  • Risk reporting requirements
  • Guidelines 01/2021 on Examples regarding Personal Data Breach Notification
  • Guidelines 9/2022 on personal data breach notification under GDPR
  • Vendor Management
  • Data sharing
• Accountability Requirements
  • Responsibility of controllers and processors
  • Joint controllers
  • Data protection by design and by default
  • Documentation and cooperation with regulators
  • Data protection impact assessment (DPIA)
  • Established criteria for conducting
  • Mandatory data protection officers
  • Auditing of privacy programs
• International Data Transfers
  • Rationale for prohibition
  • Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR
  • Adequate jurisdictions
  • Safe Harbor, Privacy Shield, and the Transatlantic Data Privacy Framework
  • Schrems decisions, implications of
  • Standard Contractual Clauses
  • Binding Corporate Rules (BCRs)
  • Codes of Conduct and Certifications
  • Guidelines 04/2021 on codes of conduct as tools for transfers
  • Derogations
  • Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679
  • Transfer impact assessments (TIAs)
  • Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data
• Supervision and enforcement
  • Supervisory authorities and their powers
  • Guidelines 8/2022 on identifying a controller or processor’s lead supervisory authority
  • The European Data Protection Board
  • Role of the European Data Protection Supervisor (EDPS)
• Consequences for GDPR violations
  • Process and procedures
  • Infringements and fines
  • Class actions
  • Data subject compensation

Compliance with European Data Protection Law and Regulation

• Employment Relationship
  • Legal basis for processing of employee data
  • Storage of personnel records
  • Workplace monitoring and data loss prevention
  • EU Works councils
  • Whistleblowing systems
  • 'Bring your own device' (BYOD) programs
• Surveillance Activities
  • Surveillance by public authorities
  • Interception of communications
  • Closed-circuit television (CCTV)
  • Guidelines 3/2019 on processing of personal data through video devices
  • Geolocation
  • Biometrics / facial recognition
• Direct Marketing
  • Telemarketing
  • Direct marketing
  • Online behavioural targeting
  • Guidelines 8/2020 on the targeting of social media users
• Internet Technology and Communications
  • Cloud computing
  • Web cookies
  • Search engine marketing (SEM)
  • Social media platforms
  • Dark patterns
  • Artificial Intelligence (AI)
  • Machine learning
  • Ethical issues