The EU's General Data Protection Regulation (GDPR) has been discussed in a variety of contexts since its introduction and is still of great importance. It helps shape the digital realities of EU citizens and businesses alike and is often cited as a differentiator between the EU legal space and the rest of the world. The EU's GDPR represents a historic milestone in the data protection debate that is relevant beyond the European Union. It entered into force in its original form in May 2016 and has been directly applicable since May 2018. Despite the extensive literature already dealing with the GDPR, the inner workings of the legislative process, the interpersonal, informal aspects of the policy process, have not been specifically addressed academically. This dissertation aims to fill this gap.

The main objective of this thesis is to understand the various factors that came together to create the General Data Protection Regulation, including the problems that may have triggered its creation, the identification of the key EU internal and external actors behind the policy-making process, and their interest behind their involvement. This study aims to complement the research on the policy process and to reconstruct the historical development of data protection in the European Union. Likewise, it aims to test the application of an integrated multiple streams and advocacy coalition framework in the data protection policy dimension of the European Union. In this perspective, this study aims to analyse the policy-making process behind the GDPR and provide clarity on the decision-makers, experts and stakeholders involved, highlighting their particular interests.

In doing so, this dissertation aims to further contribute to the understanding of the overall policy-making process in the European Union as well as to the evaluation of the Data Protection Regulation.

In order to analyse the causal mechanisms as assumed by the Multiple Streams Framework and the theoretical actor elements of the Advocacy Coalition Framework, we conduct a series of expert interviews with actors involved in the policy and legal decision-making process, as well as an in-depth document analysis of the GDPR policy process.

We examine the national positions comparatively with those of the EU institutions (e.g. European Parliament, EU Commission) in order to identify the actors involved, the variables of interest, the arguments introduced into the discussion and any obstacles or conflicts that may have arisen during the GDPR process between 2009 and 2018.