To protect or (not) to protect:definitional complexities concerning personal (and non-personal) data within the EU

The article critically elaborates on the still ongoing evolution of the definition of personal data protection within the European Union system, considering both the CJEU rulings and the current regulatory framework. To this end, first, it considers the constitutionalization of the personal data protection elaborated by the CJEU and the boundaries between personal data protection and other fundamental rights. Second, it reconstructs the definition of personal data within the current regulatory system, so to understand its scope. This critical elaboration requires considering “non-personal data” as well, since they are defined a contrario, that is, with a formula based on the definition of personal data. As discussed in the concluding section of the article, the analysis of both the case law and the regulatory framework allows the authors to identify a broadening of the scope of the category and of the protection of personal data in the EU.