2.2 Human-Rights Framework

The Two-Pillar Rights Structure

Quick Answer: European privacy rests on two overlapping instruments. The European Convention on Human Rights (ECHR) Article 8 protects private life (Council of Europe). The EU Charter of Fundamental Rights goes further, splitting Article 7 (private life) from a standalone Article 8 (protection of personal data). The exam repeatedly tests this split and which court enforces which instrument.

This framework matters because the GDPR's own recitals expressly ground data protection in Charter Article 8 and Article 16 of the Treaty on the Functioning of the European Union (TFEU). When an exam scenario asks for the constitutional source of a GDPR right, the answer is almost always Charter Article 8 (for the EU) or ECHR Article 8 (for the wider Council of Europe). A useful memory hook: the ECHR has one Article 8 doing two jobs (private life and, by interpretation, data); the EU Charter splits the jobs into Articles 7 and 8.

A third hook helps with the numbering confusion the exam plants deliberately: Charter Article 8 = data protection, but ECHR Article 8 = private life (and TFEU Article 16 is the Treaty legal basis for adopting data-protection legislation). Three different "Article 8/16" references, three different instruments — read the stem carefully for which instrument is named before picking a number.

ECHR Article 8

The European Convention on Human Rights (ECHR) was adopted by the Council of Europe in 1950 and entered into force in 1953. Its Article 8 guarantees the right to respect for private and family life, home, and correspondence. Features the exam tests:

• It is a qualified right, not absolute. Article 8(2) permits interference only where it is (1) in accordance with the law, (2) pursues a legitimate aim (national security, public safety, prevention of crime, protection of others' rights), and (3) is necessary in a democratic society — the proportionality test.
• Although Article 8 never uses the words "data protection," the European Court of Human Rights (ECtHR) in Strasbourg has interpreted it to cover the collection, storage, and disclosure of personal data (e.g., S. and Marper v United Kingdom, on indefinite retention of DNA and fingerprints of unconvicted persons, found a violation).
• It binds 47 signatory states historically; following Russia's expulsion in 2022 the Council of Europe has 46 members — a wider group than the EU's 27.

Trap: ECHR is not EU law. A company cannot "file a GDPR complaint under ECHR Article 8" — the ECHR binds states, and individuals petition the Strasbourg court after exhausting domestic remedies.

EU Charter Articles 7 and 8

The Charter of Fundamental Rights of the European Union was proclaimed in 2000 but became legally binding in 2009 when the Treaty of Lisbon entered into force, giving it the same legal value as the Treaties. Crucially, it separates two distinct rights:

• Article 7 — Respect for private and family life (mirrors ECHR Article 8).
• Article 8 — Protection of personal data, an explicit, standalone right.

Charter Article 8 is unusually detailed for a constitutional text. It requires that personal data be:

1. Processed fairly, for specified purposes, and on a legitimate basis laid down by law or with the person's consent.
2. Subject to a right of access to data collected and a right to rectification.
3. Supervised by an independent authority.

This is the constitutional DNA of the GDPR: lawful basis (Art. 6), transparency and fairness (Art. 5), data subject rights (Arts. 15-22), and independent supervisory authorities (Art. 51). Worked example: if a stem asks which Charter article grounds the GDPR's requirement of an independent regulator, the answer is the supervision clause of Article 8(3) — not Article 7, which only covers private life.

Council of Europe vs European Union

This distinction is a classic CIPP/E trap. Keep the two bodies cleanly separate:

Decision rule for the exam: a question that mentions the Strasbourg court or the ECHR is pointing at the Council of Europe; a question mentioning the CJEU, Luxembourg, the Charter, or the GDPR is pointing at the EU. Note that all 27 EU members are also Council of Europe members, but the reverse is not true — countries such as the UK (post-Brexit), Switzerland, Norway, and Turkey are in the Council of Europe but not the EU. Do not assume an ECtHR ruling automatically binds EU institutions; the CJEU is the supreme interpreter of EU law, though it treats ECHR rights as general principles.

Why this two-pillar structure matters in practice: the GDPR's necessity and proportionality tests (used throughout, from lawful basis to data minimisation) descend directly from the qualified-right analysis under ECHR Article 8(2). And the GDPR's insistence on an independent supervisory authority (Articles 51-59) is the operationalization of Charter Article 8(3). So when you analyse a GDPR scenario, you are really applying Charter Article 8 detail enforced through CJEU case law, with ECHR jurisprudence supplying the proportionality vocabulary.