The GDPR protects the right to protection of personal data. This protection is already required by primary law [Tile I.15]. In the GDPR, the following provisions in particular affirm this protection:

Art. 1 I GDPR: "This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.

 

Art. 1 II GDPR: "This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data."

It is unclear, however, whether and to what extent the right to data protection has independent significance:

According to the doctrine of the combined fundamental right [see Nikolaus Marsch, Das europäische Datenschutzgrundrecht] the fundamental right of Art. 8 CFR has a weaker formative dimension and a stronger defensive dimension. The formative dimension states that the legislature is obliged to enact rules that protect data and to formulate them in a way that is adequate to fundamental rights. The defensive dimension states that Article 8 CFR only becomes a defensive right if the fundamental right to data protection is combined with the fundamental right to private life [Tile I.14] or possibly also with any other fundamental right. As a combined fundamental right, it protects against data processing with a particular risk potential.

According to another view, the fundamental right to data protection has developed into an independent fundamental right that is broader than the right to private life. It always comes into play when personal data are processed - i.e. even if there is no interference with private life. It is described as a "modern and active right" that establishes a system of "checks and balances" (FRA, Handbook on European Data Protection Law (2018), p. 19). According to this view, Art. 8 CFR encompasses the core values associated with the right: fair processing, purpose limitation, Verbot mit Erlaubnisvorbehalt (i.e. precautionary principle), independent supervision, respect for the rights of the data subject.