A Private Law Approach to Privacy; Mandatory Law Obliged?

This article contests the general assumption that Directive 95/46/EC concerning the processing of personal data and the free movement of such data requires implementation into mandatory rules of law. In this respect, several arguments are presented in order to stimulate discussion. This discussion is important because the mandatory or regulatory character of the rules laid down in Directive 95/46/EC influence the nature of rights over data in relation to the principle of freedom of contract. Moreover, it touches upon some core issues regarding European law such as the protection of our fundamental rights and freedoms; the scope of these rights, and freedoms and the correlation between them; as well as the scope of the European Union's authority to harmonise rules concerning data protection. Furthermore, the assumption that Directive 95/46/EC requires implementation into mandatory rules of law is the main point of resistance against a private law approach to the right to data protection. If this assumption is successfully disproved, it will clear the way for a wide-ranging discussion as to whether a private law approach to the right to data protection will lead to a more effective system of privacy protection in practice.