Protection and Free Movement of Personal Data in EU Law

A long time has passed since, at the end of the 19th century, Warren and Brandeis theorized the right to privacy, understood as the right to be let alone. After having emerged in clear-cut form within American bourgeois society, this right would soon make its way into other legal systems, before being transposed – albeit in a different form – in all European States. Today it is no longer only, or to the same extent, the challenges posed by privacy, understood as the right to be let alone, that attract the attention of interpreters. Automation, and therefore above all the use of computers and the Internet, has led to a shift in attention to another element: to be precise, the processing of personal data. The subject of data protection can be studied from several angles: attention can be focused on specific problems of regulation; alternatively, the entire realm of data protection can be surveyed from above. From this second perspective, one can investigate how changes in society have given rise to the need for data protection and how a particular legal approach has derived from this, or one can focus on the current state of the system, as resulting from progressive stratifications, with all its ambiguities, its grey areas, its illogicality, and its uncertainties, both in its substantial and methodological issues. In this essay, the latter point of view will be chosen, with the discussion kept on a general level. To this end, we shall highlight the fundamental principles, rights and interests that are relevant in the realm of data protection, and the balance these find in the European regulation, in particular analysing the main problems that arise when regulating personal data, how they are addressed by the GDPR, and the challenges that remain still open. In doing so, we will see that data protection is full of cultural and structural regulatory difficulties. The European Union’s approach, aimed at the protection of the individual and at the same time at the free movement of the same data whose safeguard serves the protection of the individual, strikes a complex balance, which takes place on several different levels, in order to combine flexibility and certainty, specificity and generality, topicality and openness to the future.