European Economic Area (Bloc) Data Protection & Privacy Regulation

The European Economic Area (EEA) data protection regime applies across all 27 EU Member States and the 3 EEA EFTA states (Iceland, Liechtenstein, and Norway, where the GDPR was incorporated into Annex XI to the EEA Agreement by EEA Joint Committee Decision No 154/2018 effective 20 July 2018). The core architecture comprises Regulation (EU) 2016/679 (GDPR), Directive (EU) 2016/680 (Law Enforcement Directive), Directive 2002/58/EC (ePrivacy Directive, following the European Commission's formal withdrawal of the long-stalled ePrivacy Regulation proposal in February 2025), and Regulation (EU) 2018/1725 (EUDPR for EU institutions). Supervision is decentralised across national Data Protection Authorities (DPAs) in each of the 30 EEA states (including decentralized Land-level DPAs in Germany) coordinated through the One-Stop-Shop (Art. 56) and Consistency Mechanism (Arts. 60–65) by the European Data Protection Board (EDPB), in which the three EEA EFTA DPAs (Datatilsynet Norway, Persónuvernd Iceland, DSS Liechtenstein) and the EFTA Surveillance Authority participate as full operational members without voting rights or eligibility to hold the Chair (Decision No 154/2018). Two major legislative developments reshape the framework in 2025–2026: first, Regulation (EU) 2025/2518 on additional procedural rules for cross-border GDPR enforcement was enacted on 26 November 2025 (OJ L, 12.12.2025), entered into force on 1 January 2026, and applies from 2 April 2027; second, on 19 November 2025 the European Commission tabled the Digital Omnibus Regulation proposal (COM(2025) 837 final; EDPB–EDPS Joint Opinion 2/2026 issued 10 February 2026), proposing targeted amendments to the GDPR, ePrivacy Directive, Data Act, and AI Act.

Chapter III (Arts. 12–23) GDPR guarantees transparent information (Arts. 13–14), right of access and a free first copy of personal data undergoing processing (Art. 15; CJEU Case C-487/21 Österreichische Datenschutzbehörde and Case C-307/22 FT v DW confirming the right to a free initial copy of medical records even when requested for non-data-protection litigation), rectification (Art. 16), erasure / right to be forgotten (Art. 17), restriction (Art. 18), data portability (Art. 20, reinforced from 12 September 2025 by real-time IoT/connected-product data switching rights under the EU Data Act Regulation (EU) 2023/2854), objection (Art. 21, unconditional for direct marketing), and rights against solely automated decision-making (Art. 22). In Case C-203/22 Dun & Bradstreet Austria (27 February 2025), the CJEU held that under Art. 15(1)(h) GDPR a controller conducting automated credit scoring must explain the actual procedure and principles applied to the data subject's profile so the individual can verify accuracy and consistency, and cannot rely on a blanket 'trade secrets' refusal (instead disclosing contested algorithms to the DPA or court for case-by-case balancing). Response deadlines under Art. 12(3) are one calendar month from receipt, extendable by two further months for complex or numerous requests upon notice within the first month. Under the Digital Omnibus Proposal COM(2025) 837 final (legislative proposal, not yet in force), the Commission has proposed clarifying Art. 12(5) so that abusive DSARs pursued solely for non-data-protection purposes (such as pre-trial discovery abuse) may be treated as manifestly unfounded or excessive, though the EDPB–EDPS Joint Opinion 2/2026 (10 February 2026) opposed restricting access rights on motive grounds.