Speakers: Jeremias Adams-Prass, Orla Lynskey & Philipp Hacker

The past decade has seen an explosive growth in EU legislation to regulate digital society, extending far beyond traditional market integration. The legal basis for this has often been Art 16 TFEU – personal data protection. Introduced into the Treaties by accident, it has turned out to be a serendipitous legal bases, with unique complexities. Its substance is unclear, its relationship with other legal bases tricky, and the consequences of invoking Art 16 (or not) range far beyond mere questions of legality.

In this talk, we explore the implications of this legislative constitutionalisation for the future of the digital single market, charting the rise of data protection as a freestanding legal basis independent of, yet closely intertwined with, both fundamental rights protection and the internal market. We define the limits of Art 16, both in terms of its material scope and its relationship with other legal bases. Beyond the traditional concerns of competence and procedure, we demonstrate that the choice of legal basis matters both upstream (in terms of Commission drafting and appropriate legislative procedure) and downstream (in terms of enforcement and regulatory architecture). As digitalisation touches on all spheres of union competence, the constitutional significance of Art 16 TFEU is hard to understate.