The GDPR:  ambition, execution, reform and future developments – where is EU data protection law heading?

Summary

The General Data Protection Regulation (“GDPR”) was deemed necessary in order to deal with the speed and scale of technological change. The form of the instrument – a regulation rather than a directive, was meant to create greater harmonisation and strengthen the single market.  It was heralded as making Europe the “trust centre of the world”. [1] 

Yet the GDPR has been criticised as being too broad to be effective and too complex to comply with.  Commentators state that this creates legal uncertainty and disproportionate burdens for Europe’s businesses.  In the era of AI, the concepts of controllers (responsible for ensuring fair and lawful outcomes for individuals in the context of the processing of their data), and processors (who bear no such responsibility) appear outdated and create gaps through which data subject rights can fall.  In a turbulent world international data transfers are fraught with difficulty and data adequacy is increasingly a legal fiction for some jurisdictions. 

The EU’s data protection reforms appear to be insufficient to meet the European Commission’s goals of helping businesses and stimulating competition.  Yet the rights in the GDPR, based on the Charter of Fundamental Rights and the European Convention on Human Rights, are more important than ever.  The right not to be subject to solely automated decision-making (Article 22 of the GDPR) is likely to be crucial in the coming age of AI. 

The answer to the problem of the administrative burdens the GDPR creates may be to simplify the GDPR’s architecture significantly. Streamlining the text could result in greater clarity by exposing the core human rights engine of this crucial piece of legislation.  This in turn may make it both better understood and more effective.  It could also help us to move away from a pointless tick box culture to meaningful, human consideration of the context and how to balance individuals’ rights with public or commercial interests. 

Part 1 – Ambition

Background to the GDPR

The draft GDPR was published in January 2012.[2]  The European Commission’s explanatory memorandum set out that “rapid technological developments” had brought “new challenges for the protection of personal data”. The Commission asserted that data sharing was now happening on a much greater scale than previously and that new technologies enabled “both private companies and public authorities to make use of personal data on an unprecedented scale in order to pursue their activities”.

These factors required a new instrument to regulate the processing of personal data in order to make protections stronger and build a more coherent framework “backed by strong enforcement”.  This would strengthen the single market, “put individuals in control of their own data” and create greater “legal and practical certainty for economic operators and public authorities”.[3]

A harmonised set of rules

The GDPR replaced a directive on data protection. [4] In EU law regulations apply directly in the legal frameworks of EU Member States, creating enforceable rights and binding obligations without the need for domestic law to transpose them.  Directives, by contrast, require Member States to legislate for a particular outcome but leave the Member States to set out the relevant rights and obligations in domestic law.[5]

In its proposal for the GDPR the European Commission asserted that the differing transposition of the Directive on data protection in different Member States had resulted in fragmentation and inconsistency.  A Regulation was deemed to be the solution because the relevant provisions would apply directly in the law of each Member State, leading to harmonisation in relation to the processing of personal data. Data protection regulators would coordinate more closely through a system of the appointment of lead authorities and consistency mechanisms.[6]  This in turn would strengthen the EU’s single market.[7] 

Exporting European values

The GDPR has significant extra-territorial scope.[8]   Global businesses with an EU establishment are likely to find that the GDPR applies (at least to some extent) to the processing activities of the whole group. [9] Further, organisations targeting EU data subjects by offering them goods or services are required to comply with the rules and to appoint a representative in the EU.[10]

Research by the International Association of Privacy Professionals shows that 144 countries have now enacted data protection laws, many of which use similar concepts and principles to the GDPR.[11]  The EU’s ability to influence the regulation of markets globally is significant, with GDPR being a prime example.[12]

Part II – Execution - has the GDPR worked? 

How to measure success

Helen Dixon, the former Data Protection Commissioner for Ireland, has pointed out that “valid and reliable” evidence of the impacts of the GDPR remain “elusive”.   However, she also comments that the attempts to achieve regulatory cooperation and consistency are far from “nimble” and that the mechanism’s architecture is akin to “a kitchen with very many cooks”. [13] 

Despite the lack of evidence on the impacts of GDPR, the European Commission’s explanatory memorandum for the digital omnibus (discussed below) points to a need to “simplify”, “clarify” and “improve the EU acquis”.[14]  This suggests that there are indeed problems with GDPR.

Structural problems in the GDPR’s architecture

Winfried Veil points out in his article “The GDPR: The Emperor’s New Clothes – On the structural shortcomings of both the old and the new data protection law”[15] that the GDPR imposes significant burdens.  The GDPR contains 82 balancing tests, including 30 necessity tests, and makes 77 references to the data subject's rights and freedoms. Anecdotal evidence suggests that many organisations find these tests difficult to apply.  The references to balancing tests and necessity tests reflect the GDPR’s foundations as a detailed “working out” of Article 8 of the ECHR – the right to a private and family life. [16] But these sorts of rights were first drafted to apply vertically:  as between the citizen and the state.  Translated into a “horizontal” context under the GDPR – as between the private sector entity and the data subject - these concepts appear poorly understood.[17]

Other commentators have taken a similarly critical approach to the legislation.  In 2014, whilst the legislation was still being negotiated, Professor Bert-Jaap Koops wrote that the GDPR was already “dead”.  Years later he has asserted that there has been nothing to revive it. Koops pointed to three central problems in the GDPR’s framework: 

1. The delusion that data protection law can give individuals control over their data.  Koops argues that this is false and that the legislation does not achieve this;
2. The misconception that the GDPR simplifies the law.  On the contrary – it makes it more complex.     
3. The assumption that data protection law should be comprehensive — which stretches it to the point of breaking, making it "meaningless law in the books."

Continuing fragmentation 

The European Commission’s stated ambition that GDPR would end fragmented and divergent approaches to data protection law was always problematic.  That is because the GDPR is arguably not truly a Regulation.  Instead it blends elements of a Regulation with elements of a Directive.  Throughout the GDPR Member States are able to legislate to provide exceptions to the rules set out in the legislation.  This is necessary because data protection is a qualified fundamental right.  As explained in Article 4 of the GDPR “The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality.”

Whilst the need for derogations set out in national law is clear, this means that the GDPR has never resulted in exactly the same legal framework applying across the EU.  For example, in areas such as the lawful basis of processing,[18] the processing of special category personal data,[19] exemptions from data subject rights requests[20] and the permissibility of automated decision-making,[21] national law can lead to differing outcomes in one jurisdiction compared with another.  This has meant that in many respects, the promised harmonisation has not materialised. Further, there is a lack of clarity as to which jurisdiction’s national law should apply in the context of cross-border processing.[22]

The concepts of controller and processor

The concepts of controller and processor in the GDPR are important because they determine how responsibility for the processing of personal data is distributed between organisations.  However, the concepts are increasingly difficult to apply in an age of fast-moving technological change. 

 The concepts of controller and processor have existed in data protection law for a considerable period of time.[23]  In short, the controller has the main responsibility of ensuring that the processing of personal data does not adversely affect the data subject’s rights and freedoms.  The processor acts on the controller’s instructions, has no interest in the data, and has no responsibility for considering how the processing impacts on individuals. [24] 

This distinction between controller and processor may have worked in a previous age where the personal data held by controllers had no value for the processor.  In the age of AI vast amounts of personal data are needed to develop new technologies and to train algorithms.  Data has been termed the “new oil”[25]  or the “energy” powering new technologies[26].  The idea that entities have no interest in the data they hold is therefore unrealistic. Further, the courts have interpreted the concept of controller broadly in order to ensure that the regime contains no gaps through which the rights of individuals could fall.  Where a new technology significantly influences individuals’ fundamental rights, the courts and regulators are likely to determine that the organisation that has developed the technology is a controller rather than a processor of personal data.

However, currently many developers of new technologies take the position that they are simply processors of personal data at the stage at which their tools and systems are deployed.[27]  This means that it is left to the business or other organisation using  their products and services to discharge the main obligations under the GDPR in ensuring that the technologies result in fair and lawful outcomes. [28] This requires organisations that may have little technical understanding of the systems they have bought attempting to conduct risk assessments, and complying with principles of fairness and transparency, as well as discharging their obligations as regards subject access requests.   Although processors are supposed to help with these issues,[29] in practice such assistance can be difficult to obtain.

International data transfers

The GDPR’s processes for transferring data out of the EU are extremely burdensome, unrealistic and in practice often amount to a box-ticking exercise which does little to protect the rights of the individuals whose data is being transferred. 

The transfer of data out of the EU under the GDPR is only permissible where the standard of protection of personal data in the third country is essentially equivalent to that in the EU. [30]  The two main ways of transferring personal data out of the EU are:

1. in reliance on data adequacy decisions made by the European Commission; or
2. on the basis of standard contractual clauses issued by the European Commission, together with a risk assessment of the jurisdiction in question, and any relevant supplementary measures to protect the data such as encryption.

Adequacy decisions are the ideal basis on which to transfer data because an adequacy decision enables the free flow of data from the EU to the third country without any further measures being required. This is a considerable saving in terms of resources for the data exporter.

However, adequacy decisions are increasingly problematic.  Jurisdictions with partial or full EU adequacy decisions have been criticised for breaches of the rule of law and of international law.  The free flow of EU data to these jurisdictions continues on the basis that their standards as regards the rule of law and respect for fundamental rights is essentially equivalent to that in the EU, notwithstanding evidence to the contrary.[31]

For jurisdictions which do not benefit from data adequacy decisions, data exporters have to expend significant resources putting in place standard clauses and conducting “mini adequacy assessments” of the country to which the data is being exported.  Analysis must be conducted into the third country’s adherence to the rule of law, data protection laws etc.  Most organisations are ill-equipped to carry out such assessments and the exercise is largely a box-ticking process.

Part III - Reform 

In the report, "The Future of European Competitiveness," [32]Mario Draghi, the former President of the European Central Bank and Prime Minister of Italy warned that Europe was facing "slowing growth".  He highlighted the fact that "only four of the world's top 50 tech companies are European."

Draghi singled out "regulatory burdens" as "self-defeating," noting that "more than half of SMEs in Europe flag regulatory obstacles and the administrative burden as their greatest challenge." 

As a response to Draghi’s report the European Commission has proposed a package of measures known as the “Digital Omnibus”.[33]   The aim of the reforms is to "optimise the application of the digital rulebook" through "technical amendments… selected to bring immediate relief to businesses, public administrations, and citizens alike, to stimulate competitiveness."

Changes to the GDPR proposed under the Digital Omnibus

The reforms to the GDPR proposed under the Digital Omnibus include changes to the definition of personal data; changes to the legal basis for processing and to the derogations for processing special category personal data for the development of AI systems or models; changes to the right of subject access; and clarifications of the provisions on automated decision-making.[34] 

None of the problems with data protection law raised above are addressed in the European Commission’s proposal.  Some of the changes proposed may well not become law because the European Parliament and Member States may not approve them.[35]  Even if they are approved they are unlikely to provide the necessary simplification or to stimulate competitiveness.

Change to the definition of personal data

The Omnibus proposal seeks to add a new paragraph to the definition of personal data.  The new provision would state that information will not be deemed to be personal data in the hands of an organisation that cannot identify a person from that information (taking into account the means reasonably likely to be used by that entity).  The relevant information does not become personal data in the hands of that entity merely because a potential subsequent recipient could identify an individual using that information.[36]  This proposal has been criticised by the European Data Protection Board (“EDPB”)[37] and the European Data Protection Supervisor (“EDPS”)[38] in their joint opinion on the Digital Omnibus.[39]   They point out that this approach to the definition of personal data conflicts with CJEU jurisprudence which confirms that “in such cases, those data are personal data for both the recipient and, indirectly, for the entity making the data available to the latter”.  They state that the new definition constitutes a significant “narrowing” of the definition of personal data and could create loopholes which organisations could use to try to get round the protections.   

These criticisms mean that the proposed changes are unlikely to be accepted by the European Parliament and the Member States and therefore may not ultimately become law. 

Changes to the right of subject access  

The proposal is that a controller should be able to charge for or refuse subject access requests[40] where the request is “made for purposes unrelated to the protection of the requester’s data” on the basis that such a request is (by its very nature) unfounded or excessive.[41]  This proposal has been criticised by the EDPB and the EDPS.  Case law of the Court of Justice of the European Union (“CJEU”) has confirmed that it is permissible for data subjects to exercise their right of subject access for reasons “other than that of becoming aware of the processing of data and verifying [its] lawfulness”.  The CJEU has also confirmed that no particular reason for exercising the right of subject access need be given. [42] This suggests that this proposed change is also unlikely to become law. 

Changes to facilitate the development of AI models and systems

There is a proposal to add a new Article to the GDPR confirming that the legitimate interests legal basis may be available as a legal basis for the development or operation of an AI system.[43]  This provision has been criticised as unnecessary given that this is currently the case (even in the absence of this supplementary wording).  The EDPB and the EDPS therefore take the view that the proposed measure will serve to “decrease rather than increase legal certainty”.

A further change aimed at facilitating the development and operation of AI models and systems is a derogation which would allow incidental and residual special category personal data to be processed within the system or model.[44]  The EDPB and EDPS are supportive of this proposal, commenting that it is “not always possible” for controllers to avoid residual and incidental special category personal data when collecting data for the training, testing and validation of certain AI systems or models. 

Automated decision-making

The Digital Omnibus contains a proposal to clarify the provisions on solely automated decision-making (“ADM”). [45] The suggested change is to add further text to confirm that processing can still be “necessary for entering into a contract with the data subject” even where the decision could have been taken by a human.  This addition seems superfluous if “necessary” is read in the normal way under the GDPR.    The inclusion of the term “necessary” simply means that the processing is legitimate and proportionate.[46]  The reading of the term “necessary” as meaning “indispensable” is a misunderstanding of its use throughout the GDPR.  Clarity on this point could be obtained in other ways (such as guidance from the EDPB) rather than making textual amendments to the legislation. 

Part IV – Future developments

Given the lack of ambition of the GDPR reforms in the Omnibus, it seems inevitable that none of the relevant changes will do much to stimulate growth or competitiveness.  However, the foundations of the GDPR, based as they are in fundamental rights, are essential in the age of AI.  Further, the human rights balancing test is sufficiently flexible to work, whatever new technology appears over the next few years.  The challenge is to move organisations away from a tick-box approach to proper engagement with the impacts of new technologies on individuals. Data protection law with its concepts of fairness, transparency and accountability offers effective protections if it could be stripped back and the flaws corrected. 

The protections against ADM are powerful and important and this centrality is likely to increase as ADM becomes more common. Commentators point out that Article 22 of the GDPR which deals with ADM is potentially more protective of the individual than related provisions of the EU AI Act.[47]  Further, as the world becomes more unstable the EU’s values and the European project are more important than ever. 

This article was first published by the International Data Law Forum for their annual conference which took place in Vienna in July 2026.

Subscribe to receive more articles like this here.