“You have to know the past to understand the present”.

Dr. Carl Sagan, 1980

278. PREFACE – The concepts of controller and processor were not created out of thin air. Prior to Directive 95/46 and the GDPR, many other data protection instruments incorporated concepts with similar meaning and scope. The objective of this Part of the book is to enhance the understanding of the meaning and role of the controller and concepts by tracing the origin and development of these concepts over time.

279. RELEVANT PERIODS – When one looks at EU data protection law from a historical perspective, four main periods can be distinguished, namely:

280. SELECTION CRITERIA – In principle, every data protection instrument adopted during each of the aforementioned periods is worthy of analysis. A selection must be made, however, if only for practical reasons. Two criteria have guided the selection made here, namely (1) the desire to be comprehensive (i.e. to avoid large gaps in terms of chronology); and (2) ease of access and language considerations.

281. APPLICATION – For the first period, three data protection laws were chosen, namely the data protection laws of Hesse, Sweden and France. The Hessian and Swedish acts were chosen simply because they represent the very first national data protection laws. The French data protection act was selected to bridge the gap between the first data protection laws the first international instruments of data protection and on the basis of language considerations. For the second period, Convention 108 and the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (“OECD Guidelines”) and Council of Europe Convention for the protection of individuals with regard to automatic processing of personal data (“Convention 108”) were selected. An analysis of Convention 108 was deemed indispensable, as it provided the normative framework of the national implementations in the period that followed. The analysis of the OECD guidelines was deemed beneficial as the Guidelines were developed in parallel with Convention 108, and therefore offer additional insights into the meaning of the concepts employed by Convention 108. For the third period, two data protection laws were selected, namely the 1984 UK Data Protection Act and the 1992 Belgian data protection act.