1. THE ORIGINS OF DATA PROTECTION LAW – Automated processing of personal information has always been a topic of controversy. As soon as computers became visible to the general public, reflections on how computers might impact the privacy of individuals began to enter the political arena. The first data protection laws emerged during the 1970s, with the aim of protecting individuals against risks resulting from the automated processing of personal data.2 Regulatory initiatives at the international level soon followed. The first international organisation to formally adopt a normative stance in relation to the processing of personal data was the Council of Europe in 1973. In 1980, the OECD adopted its Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. In 1981, the Council of Europe promulgated the Convention for the protection of individuals with regard to automatic processing of personal data (Convention 108).

2. INITIATIVES AT EU LEVEL – Even after Convention 108 came into effect, notable differences in national data protection laws remained. As the European Union developed, these differences were perceived as potential obstacles towards the development of the Internal Market. In 1990, the European Commission put forth a draft for a Council Directive on the Protection of Individuals with regard to the processing of personal data and on the free movement of such data. This proposal eventually led to the adoption of Directive 95/46/EC on the protection of individuals with regards to the processing of personal data and on the free movement of such data. In 2016, the Regulation of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) was adopted. This Regulation replaced Directive 95/46 and entered into application on 25 May 2018.

3. THE IMPORTANCE OF ROLES AND RESPONSIBILITIES – As with any legal instrument, it is essential to establish not only the substantive provisions of regulation, but also to identify which actors shall be responsible for ensuring compliance. Data protection law is no different in this regard. Already in 1975, Hondius observed: