The GDPR

Regulation (EU) 2016/679. Adopted 27 April 2016, applicable from 25 May 2018. It replaced Directive 95/46/EC.

It is a Regulation, so directly applicable in every Member State with no transposition needed. But it contains roughly 70 opening clauses letting Member States legislate detail, which is why national data protection acts still exist and why practice diverges.

Stated purpose: harmonise data protection across the single market, strengthen individual control, and enable lawful data flows by creating trust. That last aim matters — the instrument is framed as a facilitator, not a prohibition, and saying so signals you have read it rather than absorbed its reputation.

Material scope, Article 2: processing of personal data wholly or partly by automated means, or manual processing of data forming part of a filing system.

Excluded: purely personal or household activity; matters outside the scope of Union law; criminal law enforcement, which is covered instead by the Law Enforcement Directive (EU) 2016/680; and EU institutions and bodies, covered instead by Regulation (EU) 2018/1725.

Territorial scope, Article 3: controllers and processors established in the EU, regardless of where the processing happens; and non-EU controllers who offer goods or services to, or monitor the behaviour of, people in the EU. That second limb is the extraterritorial reach, and the source of the Brussels effect.

• Personal data — any information relating to an identified or identifiable natural person. Very broad: IP addresses, device identifiers and metadata all qualify.
• Processing — essentially any operation. Collection, recording, storage, alteration, retrieval, consultation, use, disclosure, erasure.
• Pseudonymisation, Article 4(5) — replacing identifiers so that re-identification needs additional information. Pseudonymised data is still personal data. People get this wrong constantly, and it is the most common fatal flaw in a research data plan.
• Anonymous data — falls outside the GDPR entirely, under Recital 26. But the bar is that the person is no longer identifiable by any reasonably likely means, and genuine anonymisation is hard.
• Profiling, Article 4(4) — automated processing to evaluate personal aspects, in particular to analyse or predict performance, behaviour, location or reliability.

Note that purpose limitation and data minimisation are the same idea as Article 18's necessity test and Article 28's use limitation in Regulation 1/2003, arriving from a different direction. Two regimes, one constraint, and both of them argue with exploratory model training.

You need at least one. They are alternatives, not a hierarchy.

Article 8 covers children: the digital age of consent is 16, and Member States may lower it to 13.

Article 9 processing is prohibited unless an Article 9(2) exception applies: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, health data, and sex life or sexual orientation. Exceptions include explicit consent and substantial public interest with a basis in law.

Article 10 covers criminal convictions and offences: only under the control of official authority, or where authorised by law.

22(1) gives the data subject a right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them.

22(2) permits it where it is necessary for a contract, authorised by Union or Member State law with suitable safeguards, or based on explicit consent. 22(3) requires, for the contract and consent routes, at minimum the right to human intervention, to express a point of view, and to contest the decision. 22(4) restricts reliance on special category data.

Recital 71 goes further, saying safeguards should include specific information, human intervention, and the right to obtain an explanation of the decision reached.

• Article 24 — overall responsibility, with appropriate measures
• Article 25 — data protection by design and by default
• Article 28 — processor contracts, with mandatory content
• Article 30 — records of processing activities
• Article 32 — security of processing, including pseudonymisation and encryption
• Article 33 — breach notification to the supervisory authority within 72 hours
• Article 34 — notification to data subjects without undue delay where the risk is high
• Article 35 — data protection impact assessment, required where processing is likely to result in high risk. 35(3) expressly lists systematic and extensive automated evaluation including profiling with legal effects, large-scale special category processing, and large-scale systematic monitoring of public areas
• Article 36 — prior consultation where the assessment shows unmitigated high risk

Transfers outside the EEA need an adequacy decision under Article 45, appropriate safeguards under Articles 46 and 47 such as standard contractual clauses or binding corporate rules, or a derogation under Article 49.

One case to know by name: Schrems II, case C-311/18, 2020, invalidated the EU–US Privacy Shield. The EU–US Data Privacy Framework replaced it in July 2023. Low priority for you.

Remedies for individuals: Article 77 complaint to an authority, Article 78 judicial remedy against an authority, Article 79 judicial remedy against a controller or processor, Article 80 representation by non-profit bodies, and Article 82 compensation for material and non-material damage.

Corrective powers, Article 58(2): warnings, reprimands, orders to comply, ordering erasure, temporary or definitive limitation including a ban on processing, and suspending data flows.

Article 83(6) puts non-compliance with an authority's order in the upper tier too. Article 83(2) sets the factors: nature, gravity and duration; whether intentional or negligent; mitigation; degree of responsibility; previous infringements; cooperation; categories of data; and how the authority found out.

What it achieved: harmonisation with one-stop-shop supervision; enforceable individual rights; a shift from notifying regulators to demonstrating compliance; a risk-based and technology-neutral structure; and global influence through Article 3(2).

Standing criticisms: compliance burden on small organisations; consent fatigue and cookie banners; slow enforcement through the one-stop-shop; and uneven national implementation.

Of the project's three strands, the GDPR sits mainly on the first: the data problem. Schrepel's framing is that computational tools are only as good as the data that feeds them, that the appetite of those tools exceeds what the current framework was designed to deliver, and that the strain shows on both sides — agencies wanting representative datasets run into proportionality limits, business secrecy, data protection law, and the privilege against self-incrimination, while firms receiving sweeping requests cannot tell where necessity ends.

Data protection is named explicitly in that list. It is one of the four forces pulling against the collection that screening requires.

1. Regulation 2016/679, applicable May 2018, directly applicable, replaced the 1995 Directive.
2. It protects natural persons, not companies — but personal data is all over competition evidence.
3. The Commission is under Regulation 2018/1725 and the EDPS; national authorities are under the GDPR and their own supervisors.
4. Seven principles; purpose limitation and data minimisation are the ones that bite.
5. Six lawful bases. A public authority needs legal obligation or official authority, and cannot use legitimate interests.
6. Rights sit in Articles 12 to 22, and Article 23 lets law restrict them for regulatory and investigative functions.
7. Article 22 restricts solely automated decisions, and after SCHUFA a rubber-stamp human may not count.
8. Article 35 impact assessments are the ancestor of the AI Act's Article 27.
9. Fines are 2 percent or 10 million and 4 percent or 20 million, whichever is higher — but Article 83(7) means public authorities may be unfinable, so the real remedy against an agency is a processing ban or annulment.
10. The four-way tension: purpose limitation against exploration, minimisation against representativeness, accuracy against probability, storage limitation against reproducibility.