The EU General Data Protection Regulation (GDPR)

It is a truism that the law lags behind technology. The British Statute of Anne enacted in 1710, considered to be the world’s first legislation to grant copyright under public law, appeared over 250 years after Gutenberg introduced the movable type printing press. By that reckoning, data protection law has reacted with nimble vigour to the digitalisation of society and the economy. The EU’s General Data Protection Regulation (‘GDPR’) must be viewed in the context of the worldwide trend to adopt similar laws, a trend inspired by the EU itself. On the adoption of the GDPR’s predecessor, Directive 95/​46/​EC, around 30 countries had similar rules, and the bulk of these were within Western Europe; now there are almost 130, across all continents. The EU remains, however, wholly unique in one sense—​it is the only jurisdiction whose own constitution, in the form of Article 8 of the Charter of Fundamental Rights and Article 16 of the Treaty on the Functioning of the European Union, obliges the adoption of comprehensive rules for the protection of personal data. The GDPR is indeed comprehensive: its material and territorial scope matches the depth and breadth of digital technologies’ encroachment (welcome or not) into our lives; updated or brand new rights and obligations with regards to profiling, automated decision-​making, portability, erasure and other areas take aim at standard practices which potentially harm the individual; and the powers of independent supervisory authorities are expanded at the same time as the requirements for them to cooperate and apply the law consistently are set down in remarkable detail. This towering new Commentary unfolds, in thoughtful and erudite detail, the context, significance and interplay of each of the GDPR’s 173 recitals and 99 articles. It will become indispensable to anyone expected to engage actively with the Regulation and its counterparts beyond the EU. By implication the Commentary also illustrates the massive scale of the challenge facing all of us in the data protection and human rights community. The GDPR is an extraordinary legislative achievement, and yet it is only one piece of a much bigger puzzle. Enforcement will be contested and loopholes explored. On the one hand, it has already had an enormous impact on the perception of privacy by individuals, companies and governments, and its influence—​combined with the Charter—​can be seen in the increasingly positive and expert jurisprudence of the CJEU and national courts. On the other hand, its limits will inevitably be challenged as machine learning, ubiquitous and covert surveillance, genetic engineering and other techniques expand against a backdrop of ever starker global inequalities. These technologies will have a profound impact—​one that is already being felt—​on the dignity not only of individuals but also of groups and whole societies. That is why I expect the next generation will see the GDPR as a staging post, important but incomplete, in humanity’s endless grappling with what is possible, what is lawful and what is right—​in other words, with the legal and ethical challenges that we are confronted with in our digitised world...