The (In)Effectiveness of EU Data Protection: A Rejoinder

The emergence of a highly privatised digital environment driven by data has triggered a regulatory response in the EU built on public law tools, such as fundamental rights. The EU fundamental right to data protection has had a central role in scrutinising the conduct of tech companies in the EU territory and beyond. The application of this fundamental right has followed an expansive trajectory, aimed at offering effective and complete protection, in the words of the European Court of Justice. Yet the fundamental right-driven enforcement of EU data protection rules has been heavily criticised, and not without reason. Among the several critiques, it has been observed that the breadth of data protection entails enforcement challenges, while the proceduralisation of this right de facto disguises the preservation of a business model in favour of digital actors. This chapter offers a rejoinder to these critiques by reflecting on and contextualising the critiques of data protection’s effectiveness against the background of the human rights’ crisis. As the chapter demonstrates, several criticisms against EU data protection rules mirror a broader critical movement against human rights. Hence, while many critical stances against data protection are worthy of consideration, scholars and regulators should not lose sight of the gains and protections afforded by data protection as a fundamental right. As a matter of fact, human rights remain one of the most effective tools to counteract imbalances of powers due to their iterative engagement governance, especially in the digital society.