Understanding EU data protection policy

The datafication of everyday life and data scandals have made the protection of personal information an increasingly important social, legal and political matter for the EU. In recent years, awareness of data rights and enforcement expectations have both grown considerably. The right to privacy and the right to protection of personal data are both enshrined in the Charter of Fundamental Rights of the EU and in the EU Treaties. The entry into force of the Lisbon Treaty in 2009 gave the Charter the same legal value as the Treaties and abolished the pillar structure, providing a stronger basis for a more effective and comprehensive EU data protection regime. In 2012, the European Commission launched an ambitious reform to modernise the EU data protection framework. In 2016, the co-legislators adopted the EU's most prominent data protection legislation – the General Data Protection Regulation (GDPR) – and the Law Enforcement Directive. The framework overhaul also included adopting an updated Regulation on Data Protection in the EU institutions and reforming the e-Privacy Directive – still under negotiation between the co legislators. The European Parliament has played a key role in these reforms, both as co-legislator and author of own-initiative reports and resolutions seeking to guarantee a high level of data protection for EU citizens. The European Court of Justice plays a crucial role in developing the EU data protection framework through case law. In the coming years, challenges in the area of data protection will include balancing the compliance and data needs of emerging technologies, equipping data protection authorities with sufficient resources to fulfil their tasks, combating child sexual abuse material online without compromising privacy, taming digital surveillance and further clarifying requirements of valid consent. This is a further updated edition of a briefing of January 2022, which updated an earlier briefing by Sofija Voronova, of May 2020.