Data Protection and Fundamental Rights: Foundations of the GDPR

An Autonomous Fundamental Right

Personal data protection is not merely a technical rule. Article 8 of the Charter of Fundamental Rights of the European Union and Article 16 TFEU establish it as an autonomous right. The GDPR organises its practical exercise while safeguarding the free movement of data within the Union.

This right remains closely connected with respect for private life under Article 7 of the Charter, but is not identical to it: it governs every operation involving personal data, even where no separate intrusion into intimacy has been demonstrated.

From Privacy to Data Protection

European protection developed in layers: Article 8 ECHR has protected private and family life since 1950; Council of Europe Convention 108 became the first binding international treaty specifically devoted to automated data processing in 1981; the EU Charter then distinguished privacy and data protection in Articles 7 and 8.

Amending Protocol CETS No. 223 modernises Convention 108. Its general entry-into-force status must nevertheless be checked against the Council of Europe's official treaty table before making a definitive statement.

• 1950: protection of private life under Article 8 ECHR;
• 1981: Convention 108 on automated processing of personal data;
• 2000–2009: proclamation and then binding legal value of the Charter;
• 2016–2018: adoption and full application of the GDPR.

Privacy and Data: Complementary Protections

Article 7 protects private and family life, the home and communications. Article 8 requires fair processing for specified purposes on a legitimate basis, recognises rights of access and rectification, and requires supervision by an independent authority.

The GDPR develops these requirements through the Article 5 principles, Article 6 legal bases, Articles 12–22 rights, the independence and powers of supervisory authorities under Articles 51–59, and remedies under Articles 77–79.

A Right to Be Balanced, Not an Absolute Right

Recital 4 GDPR states that data protection must be balanced against other fundamental rights in accordance with proportionality. This does not permit the GDPR to be set aside automatically in the name of freedom of expression, nor a right to be applied mechanically without examining its context.

Schrems II illustrates the requirement of essentially equivalent protection for international transfers. Legal Newsdesk Sweden clarifies that paid publication of criminal judgments is not journalistic as a matter of principle. Jautiva confirms that rights and restrictions must be assessed within the precise framework established by EU law.

Operational Effect: Lawfulness, Necessity and Proportionality

Each purpose must be linked to an Article 6 legal basis, data must be limited to what is necessary, retention must be justified, and rights must be made effective. Special-category data, criminal data, journalism, research and archives are governed by specific conditions or balancing rules.

Accountability turns the constitutional foundation into operational evidence: records, risk assessments, notices, contracts, security measures and, where high risk so requires, a data protection impact assessment.

• Identify purpose and legal basis before collection;
• Document necessity, minimisation and retention;
• Organise rights and effective remedies;
• Reassess proportionality when context or technology changes.

How to Read the Sources

The explanations relating to the Charter are an official interpretative reference, not autonomous legislation. The ECHR and Convention 108 belong to the Council of Europe framework; they illuminate the legal lineage without being confused with EU secondary law.

A legal synthesis must therefore distinguish binding law, official explanations, case law and an instrument whose entry into force still requires verification.

Consequences for Compliance

Compliance is not the accumulation of forms: design choices must demonstrably respect individuals. The more intrusive, large-scale, opaque or irreversible the processing, the stronger its justification, safeguards and oversight must be.

Reading the GDPR through fundamental rights makes it possible to resolve novel cases without reducing data protection to a fixed checklist.

Verified Official Sources

See Also in the Legal Framework