The Multi-faceted Role of the Individual in EU Data Protection Law

In an environment of mass digitalisation and datafication, myriad concerns arise about the effectiveness of information privacy and data protection laws. But a significant line of that criticism calls into the question the role of an individual. Is it correct to categorise EU data protection law as individualistic? Understanding the place of the individual within EU data protection law is an important precursor to debates about whether we should frame our legislative regime around the individual protection. In order to engage with this issue, one must first examine the role of the individual in data protection law. Through an examination of the Data Protection Directive, General Data Protection Regulation, Article 8 of the Charter of Fundamental Rights in the European Union and associated case law of the Court of Justice of the European Union, this chapter offers an account of the role of the individual in EU data protection law, with two aims. First, this chapter demonstrates the centrality of the individual to EU data protection law, arguing that while EU data protection is not entirely individualistic, the individual is central to the regime through its important position throughout key elements of the regime. Second, recognising that the individual plays a number of roles within EU data protection, it is useful to develop a framework for understanding those roles. This chapter offers a conceptual framework to understand the role of the individual in the regime. It argues that the individual serves multiple, if overlapping, functions in EU data protection law: as the object and subject of EU data protection law. The individual serves as the normative foundation underpinning the regime, the primary protected subject of data protection law and is central to the enforcement of data protection law, empowered to act in their self-defence through decisionmaking and individual rights.