An overview of relevant GDPR data protection laws, AI laws and directives, with links to the legal texts.
AI Act (Artificial Intelligence Act)
Official title: REGULATION (EU) 2024/1689
Description: The AI Act defines, among other things, providers and deployers as well as AI systems. Providers in particular have to meet special obligations, but deployers of AI systems are also required to act. The regulation also addresses high-risk AI.
Proof of AI literacy under Article 4 AI Act.
ePrivacy Directive
Not a law, but a directive that was supposed to become a regulation and has not.
Official title: Directive 2009/136/EC, formerly Directive 2002/58/EC
Description: The ePrivacy Directive sets binding minimum requirements for data protection in telecommunications. Since 2009 it has restricted the use of “information stored in the terminal equipment of a subscriber”. Directive 2009/136/EC is also known as the Cookie Directive, which is inadequate in itself, because cookies are only one form of data processing among many, and cookies are managed by services (tools) and cannot exist without them. The word cookie appears only once in the directive, in a recital.
Articles on the ePrivacy Directive:
- The ePrivacy Directive
- The new TTDSG: The consent requirement for websites and apps
- Section 25 TTDSG: Protection of privacy in terminal equipment
- What is audience measurement?
General Data Protection Regulation (GDPR)
Official title: REGULATION (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
Description: The European Union’s General Data Protection Regulation. The GDPR entered into force as early as 2016, but through legal constructs I find incomprehensible it only actually applied from 25 May 2018. This interim period was defined as a transition period. Art. 99 GDPR states:
(1) This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
Art. 99 GDPR
(2) It shall apply from 25 May 2018.
Annotated articles of the GDPR (selection):
- Article 6 GDPR (Legal bases for processing)
- Article 12 GDPR (Transparent information)
- Article 13 GDPR (Information obligations)
- Article 15 GDPR (Right of access)
Telecommunications Telemedia Data Protection Act (TTDSG)
Update: Since May 2024 it has been called TDDDG (Telecommunications Digital Services Data Protection Act)
Official title: Telekommunikations-Telemedien-Datenschutzgesetz
Description: Implementation of EU Directive 2018/1972.
Articles on the TTDSG:
- 66 reasons why PIMS will fail (central consent management)
- The consent requirement for websites and apps
- Draft TTDSG: What exactly is audience measurement on websites?
- Cookie banners are to be abolished: why that is right, but browser defaults, plugins or central consent management are not the solution
Telemedia Act (TMG)
Update: Since May 2024 it has been called DDG (Digital Services Act, German: Digitale-Dienste-Gesetz)
Official title: Telemediengesetz
Description: Implementation of Directives 2000/31/EC, 2003/58/EC and Directive 98/34/EC
EU Directive on the protection of natural persons with regard to the processing of personal data
Official title: Directive 95/46/EC
Description: The EU directive on the protection of individuals with regard to the processing of personal data and on the free movement of such data was adopted in 1995 and repealed by Art. 94 GDPR as of 25 May 2018, being replaced by the GDPR.
Key takeaways from this article
The AI Act regulates the development and use of artificial intelligence.
The ePrivacy Directive restricts the use of data in telecommunications.
The GDPR is the most important data protection regulation in the EU and applies to all companies that process the data of EU citizens.
The AI Act controls artificial intelligence.
Audience measurement on websites is a topic connected with data protection and the EU General Data Protection Regulation (GDPR).
Cookie banners are controversial and there are no simple solutions such as browser settings or central consent management.
The Telemedia Act (DDG) regulates data protection on the internet and is based on EU directives.
Audience measurement on websites must comply with data protection law.
The Telemedia Act regulates data protection on the internet.
My name is Klaus Meffert. I have a doctorate in computer science and have been working professionally and practically with information technology for over 30 years. I also work as an expert in IT & data protection. I achieve my results by looking at technology and law. This seems absolutely essential to me when it comes to digital data protection. My company, IT Logic GmbH, also offers consulting and development of optimized and secure AI solutions.
