A compliance intern asks whether the GDPR replaced the Charter right to protection of personal data. Which clarification is correct?
Select an answer to reveal the explanation.
Short Explanation
Think constitution upstairs, detailed rulebook downstairs. The Charter’s right to data protection stays in the fundamental-rights attic; the GDPR is the thick operating manual that makes protection concrete for controllers and processors. The manual did not demolish the attic.
Full Explanation
The GDPR is detailed secondary law that implements and operationalises fundamental-rights protection; the Charter right to data protection remains in the EU constitutional layer and is not erased by the Regulation. Compliance interns should hold both levels: Charter Article 8 as constitutional recognition, GDPR as the detailed rulebook for processing. Article 8 of the Charter was not repealed on the day the GDPR entered into application. After the GDPR, ISO privacy controls do not hold constitutional rank in the Union. The Charter does not apply solely to CIPP/US exams. Exam caveat: Charter versus GDPR hierarchy questions reward coexistence—secondary law does not repeal the Charter right. Operational check: in litigation or DPIA “necessity” analysis for intrusive civic surveillance, cite both the Charter framing and the concrete GDPR principles/conditions rather than treating the Regulation as the sole rights source. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan.