Protecting or Processing?

The European Union is well-known for its high levels of data protection and concern about the effects of data sharing on individuals’ privacy. The 1995 Data Protection Directive (95/46/EC) established clear norms that have guided the development of data protection laws at the national level. However, these principles have often been tested by advances in the field of law enforcement, where personal data has increasingly been processed for the purpose of fighting crime. This tension has become more problematic with the advent of the Treaty of Lisbon, which has ‘constitutionalised’ data protection as a fundamental right in Article 16 of the Treaty on the Functioning of the European Union (TFEU) and Article 8 of the Charter of Fundamental Rights. This chapter explores to what extent the tension between data protection and data processing has been solved in the process of recasting the former provisions for the protection of personal data. The ‘package approach’ to the reform process has managed to improve the coherence of data protection in the private and the public sectors, but the tensions between privacy and security remain—especially in the law enforcement domain.