Data protection policies in EU justice and home affairs

Data protection is an EU law field that has undergone substantial change over the past few years. In April 2016 a five-year law-making process finally came to an end, with the adoption of the General Data Protection Regulation and the Police and Criminal Justice Data Protection Directive. The Directive, upon which this analysis is focused, is an ambitious text, aimed at assuming the data protection standard-setting role within the EU Justice and Home Affairs field at Member State level. At EU level Regulation 45/2001/EC is generally applicable on personal data processing by most of the EU agencies and bodies in the field. Its provisions are “particularised” and “complemented” by ad hoc substantive data protection law per each such actor. All of them, however, are to be aligned with the provisions of the Directive. Although supervision tasks are uniformly entrusted to the EDPS, the different mandates for each of the actors continue to apply. This, unnecessarily, complex legal architecture is found detrimental to the data protection purposes and ultimately against the requirements of Article 16 TFEU