Harmonising privacy: the protection of personal data and digital rights in the European Union. Legal, political and technical barriers to a unified digital privacy framework across EU Member States

Abstract

This paper analyses the fragmented protection of individuals’ personal data in the European Union, arguing that the General Data Protection Regulation (GDPR), while comprehensive in scope, falls short of ensuring uniform enforcement across Member States. Moreover, a theoretical framework around the evolving notion of personal data proves how combinations of anonymised information can re-identify individuals, challenging the GDPR’s current definitional limits. This study thereby situates the GDPR within the broader, interdependent EU data governance framework, revealing overlaps and inconsistencies that undermine harmonisation. Using comparative case studies of Ireland, Spain, Italy, and Latvia, this paper demonstrates that enforcement diverges significantly across Member States due to differing institutional capacities, political wills, and administrative traditions. Applying theories of policy implementation and multi-level governance, it argues that EU-level law is weakened by practical differentiation. This analysis coincides with the European Commission’s 2025 Digital Omnibus proposals, which aim to overhaul GDPR procedures and underscore the structural challenges examined in this paper.