Reflections upon the Interaction between Domestic and European Personal Data Protection Legislation

This paper assesses whether the European legislative reform on the protection of personal data, in conjunction with national law, responds in a satisfactory manner to the challenges posed by technological evolution and widespread use of Internet. In recent years, the question of State regulation of the processing of personal data by private companies has become urgent as allegations of unauthorized access to personal data have been hotly debated in the European press. Thus, the paper shall first analyse, the appropriateness of European and States' legislation to properly regulate the effective protection of personal data, in particular of obligations applicable to companies storing and processing personal data on European soil. Does the proposed European legislation in the context of the EU's international agreements with the US provide sufficient legal safeguards to ensure the effective protection of personal data in the post-Snowden era? Specific subparts are devoted to the European reform of companies' criminal liability in cases of cyber-attack (a) and of specific obligations imposed on providers of cloud computing services (b).
In the second part, I comment on the interpretation of the European data-protection legislation, provided by the Court of Justice, regarding the obligations imposed upon 'intermediaries' that process personal data, such as the Internet service providers (a) and Internet search engines (b). The Court of Justice has interpreted the European legislation in a manner that allows courts and national authorities to impose on companies a set of safeguards to protect individuals against the infringement of copyright and privacy rights.