Outside CTO C T O Outside CTO Get in touch

Eduardo Ustaran, European Data Protection: Law and Practice (Book Review)

By jgn on in Reading, Reviews, and Technology

My book was the 3rd edition, but it seems that this newer edition is not in Goodreads.

On the back of this book, we're told that this is the book for learning the materials you'll need to pass the CIPP/E exam, which is about European data privacy: its history and especially its workings under the GDPR. The blurb calls this book the "principal reference."

It is all there, so in that respect it is a success.

Yet this book could be so much more. Each chapter is written by a lawyer, and conveys the core and nuances of the various aspects of the laws in sentences and paragraphs. But I feel that the book wasn't designed from the perspective of getting this body of knowledge into the student's head. Here are some things that should be better:

  1. It follows the CIPP/E Body of Knowledge almost exactly; but not exactly. The chapter numbering should follow the BoK domains perfectly. But it doesn't (for example, in the BoK some sub-subdomains have subordinate parts a and b, but the book they become chapter subsections).

  2. Reference material should be in tables in appendices to facilitate look-ups. For instance, the section listing key events in the Evolution of Data Protection Law in Europe (p. 23) lends itself to a table with columns such as the date issued, date approved, etc. There should be links (ideally, short links) to all key documents. The table on p. 325 (13.8) is great, but again, I'd put it back in a section of reference tables.

  3. There should at least be a table of all of the GDPR Articles and Recitals. Indeed, I'd recommend putting them right into the printed book so that students can mark them up. Also, it turns out that the EDPB Guidelines are critical. Some of them should be included with brief abstracts, and at least, once again, a table. Additionally, there should be a table of key law cases (e.g., Google vs Spain) with a brief abstract.

  4. The free Certification Examination Blueprint provides a count of questions per domain and subdomain that might be on the exam. While I don't think it makes sense to provide the exact counts in the book, somewhere the book should provide a better sense of what's really critically important (those areas are Data Subjects' Rights and Security of Personal Data).

  5. Editing should be absolutely scrupulous. For example, p. 44 refers to a "broader church of forty-seven member states." Seriously, fix these typos everywhere.

  6. Things like the Treat on European Union should be referenced with exactly the same name, consistently, everywhere; don't just casually call it the Maastricht Treaty or the EU Treaty if the canonical name is to be the Treaty on European Union. Another example: p. 49 mentions the Council of Europe Convention. Please, call it Convention 108, or the Council of Europe Convention, but do it the same through the whole book. When a treaty is mentioned, always give the year (e.g., if we have decided that the canonical name will be the EU Treat, then say: EU Treaty [1992]).

  7. Then there are places where key words simply aren't used and/or aren't in the index: When the book discusses Schrems, unless I missed it, the word "adequacy" is not used.

  8. Other little gaps: When data minimization is discussed, we learn that controllers must figure out necessity and proportionality. But this section does not mention doing a DPIA. You see this all over the book: Each author is so within his or her niche that you don't see the interrelations.

  9. Much of GDPR exists in a political context. For example, the discussion of the Irish DPC would be enriched by explaining the context of Ireland's positioning of itself as a flexible host for American companies. I'd suggest adding footnotes not only to the case law, but to articles from the various papers of record (such as the UK Guardian).

I am aware of the fact that this would balloon the book to 600 or more pages, but why not? It describes itself as a reference. Well be a reference.

OK, I've whined enough. Is this how all law books are? I feel sorry for my friends and colleagues who went to law school and had to draw up innumerable outlines of the materials (as I did) because of the deficits in the reading.

Originally reviewed on Goodreads on 27 April 2025.

Comments