Briefing - Understanding EU data protection policy - 21-01-2025
The 'datafication' of everyday life and data scandals have made the protection of personal information an increasingly important social, legal and political matter for the EU. In recent years, awareness of data rights has grown considerably. The right to privacy and the right to protection of personal data are both enshrined in the Charter of Fundamental Rights of the EU and in the EU Treaties. The entry into force of the Lisbon Treaty in 2009 gave the Charter the same legal value as the Treaties and abolished the pillar structure, providing a stronger basis for a more effective and comprehensive EU data protection regime. In 2012, the European Commission launched an ambitious reform to modernise the EU data protection framework. In 2016, the European Parliament and the Council, as co-legislators, adopted the EU's most prominent data protection legislation yet – the General Data Protection Regulation (GDPR) – and the Law Enforcement Directive. The framework overhaul also included adopting an updated Regulation on Data Protection in the EU institutions and reforming the e-Privacy Directive. The European Parliament played a key role in these reforms, both as co-legislator and author of own initiative reports and resolutions, seeking to guarantee a high level of data protection for EU citizens. The European Court of Justice plays a crucial role in developing the EU data protection framework through case law. In the coming years, challenges in the area of data protection will include rectifying GDPR enforcement deficits, balancing the compliance and data needs of emerging technologies, granting data access for security purposes without excessively compromising privacy and data protection, and mitigating compliance burdens for small and medium-sized enterprises. This is a further updated edition of a briefing originally written in 2020 by Sofija Voronova and updated in 2023.
Source : © European Union, 2025 - EP