The hybrid nature of horizontality in EU Data Protection Law: the Charter, the Regulation and the Court of Justice of the EU

A natureza híbrida da horizontalidade no direito da proteção de dados da União Europeia: a Carta de Direitos Fundamentais, o RGPD e o Tribunal de Justiça

Abstract:

This article analyses the horizontal effect of the fundamental right to data protection enshrined in Article 8 of the EU Charter of Fundamental Rights. Moving beyond abstract doctrinal debates, it adopts a functional and institutional perspective grounded in the architecture of EU data protection law. It proposes a tripartite analytical framework - direct, indirect, and state-mediated effect - and argues that Article 8 synthesises these models within a structurally hybrid system of enforceability. This hybrid model is operationalised through the General Data Protection Regulation, which embeds fundamental rights in private relationships via legislative design, decentralised implementation, and regulatory oversight. The Court of Justice complements this model through purposive interpretation, affirming rights enforceability even in the absence of a general doctrine of horizontal effect. The article concludes that the horizontal application of Article 8 is not an exception to verticality but a structural necessity in a digital order increasingly shaped by private regulatory power.

Keywords:
fundamental rights; horizontal effect; data protection; EU Law; digital governance

Resumo:

Este artigo analisa o efeito horizontal do direito fundamental à proteção de dados consagrado no artigo 8.º da Carta dos Direitos Fundamentais da União Europeia. Para além dos debates doutrinais, o texto adota uma perspetiva funcional e institucional, ancorada na arquitetura do direito da proteção de dados da União Europeia. Propõe um quadro analítico tripartido - efeitos direto, indireto e mediado pelo Estado - e sustenta que o artigo 8.º sintetiza estes modelos num sistema de horizontalidade estruturalmente híbrido. Este modelo híbrido é operacionalizado através do Regulamento Geral sobre a Proteção de Dados, que inscreve os direitos fundamentais nas relações privadas por via do desenho legislativo, da implementação descentralizada e da supervisão regulatória. O Tribunal de Justiça complementa este modelo por meio de uma interpretação teleológica, afirmando a horizontalidade dos direitos fundamentais mesmo na ausência de uma doutrina geral sobre o efeito horizontal. O artigo conclui que a aplicação horizontal do artigo 8.º não constitui uma exceção ao paradigma vertical, mas uma necessidade estrutural numa ordem digital cada vez mais moldada pelo poder regulatório de atores privados.

Palavras-chave:
direitos fundamentais; efeito horizontal; proteção de dados pessoais; Direito da União Europeia; governação digital

1. Introduction

The question of whether and how fundamental rights extend into private legal relationships has long occupied both European and national legal orders. While this debate has traditionally unfolded in abstract or doctrinal terms, it has often neglected the institutional and regulatory dynamics that shape rights enforcement in practice. The right to data protection, enshrined in Article 8 of the Charter of Fundamental Rights of the European Union (Charter), offers a particularly compelling case for addressing this gap. This right operates at the intersection of constitutional values and the realities of digitally mediated environments, where private actors increasingly exercise quasi-regulatory functions.

This article argues that the horizontal effect of Article 8 of the Charter is best understood not through a single doctrinal lens, but through a structurally hybrid framework that reflect the functional complexity of EU data protection law. Drawing on comparative constitutional and human rights law, it advances a tripartite framework of horizontality - comprising direct, indirect, and state-mediated effects - and demonstrates how Article 8 synthesises these models into a coherent structure of enforceability.

The analysis shows that this hybrid model is not merely theoretical. It is operationalised through the General Data Protection Regulation (Regulation)¹, which embeds fundamental rights obligations in private relationships via regulatory design, decentralised implementation, and institutional oversight. In parallel, the jurisprudence of the Court of Justice of the European Union (Court) reinforces this model through purposive interpretation, even without establishing a general doctrine of horizontal effect.

The structure of the article reflects this analytical trajectory. First, it revisits the concept of horizontality through comparative constitutional and human rights law, identifying three archetypal models: direct, indirect, and state-mediated effect. Second, it applies this tripartite framework to the right to data protection, examining the structural components of Article 8, its protective configuration, and how secondary legislation - particularly the GDPR - gives it effect. Third, it analyses the evolving case law of the Court, highlighting how functional horizontality emerges in practice. Fourth, it articulates a normative argument for recognising the horizontal effect of Article 8 as a constitutional necessity in digital contexts shaped by private power. Finally, the conclusion draws together these insights to argue that the horizontal effect of data protection is not merely a doctrinal extension of public law, but a structural imperative in a legal order increasingly mediated by private power.

In doing so, the article situates the horizontal application of Article 8 within a broader constitutional framework, one that affirms the EU’s evolving commitment to dignity and autonomy in the digital age.

2. Horizontality under the EU Charter of Fundamental Rights

This section establishes the analytical foundation for the paper's central argument. It first revisits the concept of horizontality in constitutional and comparative human rights law, identifying three ideal-typical models - direct, indirect, and state-mediated effect. It also explains how these models offer a conceptual lens for analysing the enforcement of fundamental rights in EU law, especially under the Charter. This tripartite framing prepares the ground for the subsequent analysis of Article 8, which is assessed through the interconnected lenses of legislative implementation, regulatory governance, and judicial interpretation.

2.1 Understanding horizontality through comparative constitutional and human rights law

The concept of horizontality has long been debated in constitutional and international human rights law. Across legal systems, courts and scholars have developed a variety of models to explain the legal effects of fundamental rights² - that is, the scope of their enforceability and the identity of their potential duty-bearers, particularly how and if such rights extend beyond vertical state-individual dynamics.

In German Constitutional law, the doctrine of Drittwirkung recognises that fundamental rights can affect private legal relationships either directly or through judicial interpretation.³ Similarly, the South African Constitutional Court has affirmed that constitutional rights apply to private actors, anchoring this extension in the transformative purpose of the post-apartheid legal order.⁴ International human rights instruments, particularly the European Court of Human Rights (ECtHR), has held states responsible for failing to protect individuals from rights violations by private entities, thus creating an indirect but operational form of horizontality.⁵

Legal scholarship has synthesised these developments into three ideal-typical models of horizontal effect: direct, indirect, and state-mediated.⁶ While these archetypes overlap in practice, they offer a conceptual map for understanding how fundamental rights may infiltrate private law - whether through the imposition of direct duties on private parties, through the value-oriented interpretation of private law norms, or through institutional duties of protection, oversight and enforcement imposed on public powers.

2.1.1 The three archetypes of horizontality

Before examining how horizontality functions within EU law and under Article 8 of the Charter, this section clarifies what horizontality entails as a constitutional phenomenon. It does so by analysing the three archetypes - direct, indirect, and state-mediated effect - previously mentioned that have emerged in comparative and human rights law.

These models provide the conceptual foundation for exploring how the right to data protection may be enforced through a structurally hybrid configuration of horizontality, rooted in the constitutional architecture of EU law.

It is important to recognise that legal systems vary significantly in their treatment of horizontal effect and may not accommodate all three archetypes.⁷ Notably, the degree of horizontal effect recognised under national constitutions differs across EU Member States, and in some constitutional orders the doctrine remains in development.⁸

2.1.1.1 Direct effect

The doctrine of direct effect occupies the opposite pole of strictly vertical paradigms, which hold that fundamental rights bind only the state and public bodies (or private actors performing public functions).⁹ Direct effect refers instead to the imposition of direct obligations on private parties, understood as the ability to invoke a fundamental right directly before a court in a dispute between private individuals.¹⁰

This model is most famously captured in the German doctrine of unmitterlbare Drittwirkung.¹¹ It is the most far-reaching - and controversial - form of horizontality, as it suggests that fundamental rights bind a private actors independently of legislative intermediation. In such a configuration, obligations flow directly from the normative nature and nature of the right itself.¹² This view appears to be embraced by the Portuguese and Slovenian Constitution.¹³

2.1.1.2 Indirect effect

The concept of indirect horizontality finds one of its most influential formulations in the 1958 Lüth decision of the German Constitutional Court (GCC).¹⁴ There, the Court held that although fundamental rights bind the state directly, they also establish an ‘objective order of values’ that permeates the entire legal system - including private law.

This understanding reflects the ‘double character’¹⁵ of fundamental rights: they are both subjective rights, enforceable against public authorities, and objective norms, shaping the interpretation of legal relationships between private parties. Under this model, courts have a duty to interpret private law in light of constitutional values, to resolve ambiguities in legislation in accordance with those values, and to ensure that the private legal order conforms to the constitutional framework.¹⁶

The ‘radiating effect’ doctrine¹⁷ has influenced the development of indirect horizontality in several jurisdictions, including the United Kingdom, South Africa and Canada.¹⁸

2.1.1.3 State-mediated effect or duty to protect

The third model - often referred to as state-mediated or duty to protect - shifts the focus from duties between private parties to the State’s constitutional obligation to protect individuals from rights violations perpetrated by non-state actors.¹⁹ This understanding is closely tied to the objective dimension of fundamental rights in German constitutional theory, where rights are seen not only as defensive constraints on state power but as triggers for positive duties by public authorities.²⁰

In this model, the State is not a passive observer or a neutral arbiter, but a co-constitutive actor in shaping private legal relationships. It must adopt legislative, administrative, and judicial measures to prevent or redress harm, particularly in contexts of structural asymmetries of power.²¹ Rather than imposing duties directly on private parties, state-mediated horizontality operates through institutional guarantees: lawmakers, oversight bodies, courts and other public bodies are charged with ensuring that private conduct aligns with constitutional values and that rights are enforceable across all domains of social life.²²

2.2. Horizontality in EU law: a fragmented landscape and a constitutional reorientation

The question of whether EU fundamental rights can be invoked in private legal disputes has long been debated in the case law of the Court. While the doctrine of direct effect, first articulated in Van Gend en Loos and extended in Defrenne II²³, has permitted individuals to invoke Treaty-based provisions against private parties, this line of case law has been primarily driven by objectives of market integration rather than fundamental rights protection.²⁴ Horizontality in this context has often been understood in functionalist terms - as a means to ensure the effet utile of EU norms - rather than as part of a broader constitutional logic grounded in the Charter.

This instrumental understanding has resulted in doctrinal inconsistencies.²⁵ On the one hand, some Treaty provisions with clear economic implications - such as those on equal pay or free movement - have been held to have direct horizontal effect. On the other hand, directives, even when designed to give effect to fundamental rights, have been denied such effect based on Article 288 TFUE, which limits their binding force to Member States. The decisions in Marshall or Faccini Dori²⁶ exemplify this formalist and source-based approach, whereby the legal nature of the instrument - rather than the constitutional function of the right - determines whether individuals may rely on it in horizontal disputes.²⁷

This approach has two major consequences. First, it creates doctrinal fragmentation: similar rights may receive different levels of protection depending on the legislative instrument through which they are expressed.²⁸ Second, it produces normative asymmetries between individuals who are otherwise similarly situated, merely because their claims fall under divergent regulatory regimes.²⁹ In the post-Chater era, these asymmetries appear increasingly unjustifiable.³⁰ The Charter, with the same legal value as the Treaties, expresses the Union’s constitutional identity and aims to ensure consistent protection of fundamental rights. Yet its capacity to structure private relationships remains uncertain and uneven.

This state of affairs reflects a deeper structural tension in EU law. While individual rights are central to the Union’s constitutional order, there is no coherent doctrine of horizontal effect at EU level.³¹ Instead, the enforceability of fundamental rights in private relationships depends on the interaction between the Charter, secondary legislation, and the constitutional traditions of the Member States. The result is a patchwork of rulings and regulatory responses, lacking a principled framework to determine when and how horizontality should operate.

In light of the tensions, and supported by recent decisions³², a growing body of scholarship argues that horizontality should be assessed not merely through the lens of legal clarity or the unconditionality of norms, but through the institutional and structural role that fundamental rights play in the EU legal order.³³ This reorientation suggests that horizontality is not a doctrinal anomaly or an exception to be cautiously admitted on a case-by-case basis, but a constitutional feature of the EU’s fundamental rights framework, especially where systemic imbalances of power, information, or autonomy are at stake.

This view aligns with deliberative theories of democracy, such as those of Habermas and Alexy, which conceptualise fundamental rights as conditions of discursive legitimacy in all legal relations - public and private alike.³⁴ In this perspective, horizontality is not an external imposition upon private law, but a normative imperative to ensure that legal relationships respect the equal moral and political status of individuals. It is justified not by the legal source of the obligation, but by the constitutional function it plays in safeguarding democratic self-government and individual autonomy.

Reframing horizontality in constitutional terms has implications for the adjudication of fundamental rights in the EU legal order.³⁵ First, it invites a shift away from the binary logic of vertical versus horizontal effect.³⁶ Second, this model demands that the Court articulate a constitutional narrative in its case law.³⁷ Rather than merely asking whether a provision of the Charter is ‘sufficiently clear, precise and unconditional’, the Court should assess whether the right in question plays a structural role in the constitutional architecture of the Union.³⁸ Third, it raises the question of which archetype of horizontality - direct, indirect, or state-mediated - is most suitable for capturing the nature and function of a specific fundamental right.

The next section applies this reoriented framework to Article 8 of the Charter, examining how the right to data protection exemplifies a structurally hybrid model of horizontality. It argues that the horizontal effect of Article 8 is not merely a doctrinal possibility, but a constitutional necessity in a legal order increasingly shaped by private regulatory power.

3. The fundamental right to data protection and its horizontal effect

The previous section outlined a tripartite conceptual framework of horizontal effect in fundamental rights law - direct, indirect, and state-mediated - and explained how these archetypes provide a starting point for understanding the horizontal dimension of fundamental rights. This section moves beyond the abstract formulation of these models to explore how Article 8 of the Charter operationalises them in practice.

The analysis proceeds in four parts. First, it examines the constitutional configuration of Article 8 of the Charter, highlighting how its individual entitlements, substantive norms, and institutional safeguards collectively create a framework for the horizontal application of the right to data protection.³⁹ Second, it demonstrates how this framework is operationalised through secondary legislation - particularly the Regulation⁴⁰ - which imposes direct and proactive obligations on private actors.⁴¹ Third, it analyses the evolving case-law of the Court, illustrating how judicial interpretation has affirmed the enforceability of Article 8 of the Charter even in the absence of a general doctrine of horizontal effect. Finally, it briefly explores a normative argument for recognising this structurally hybrid form of horizontality as a constitutional necessity in the digital age, where private actors increasingly exercise regulatory and infrastructural power over personal data.

In doing so, the section contends that the horizontal effect of the right to data protection is not merely a doctrinal possibility, but a structural feature of the EU legal order - one that reflects the constitutional commitment to safeguarding fundamental rights in complex, digitally mediated environments.

3.1 The constitutional architecture of Article 8 and its horizontal dimension

Article 8 enshrines a self-standing right to the protection of personal data, distinct from and complementary to the right to private life under Article 7 of the Charter. There is no consensus about the precise scope of this fundamental right, particularly regarding its overlap with Article 7.⁴² Nevertheless, a textual analysis of its constitutional architecture reveals three interrelated components⁴³: (i) individual entitlements, such as rights of access, rectification and erasure of personal data)⁴⁴; (ii) substantive norms⁴⁵ that govern data processing, including principles of fairness, purpose limitation and lawfulness⁴⁶; and (iii) institutional safeguards, notably the requirement for independent oversight by data protection authorities.⁴⁷

This ‘tripartite structure’⁴⁸ provides a useful starting point for assessing the legal effects of Article 8 - namely, the nature of the obligation it imposes and the range of actors to whom they apply. Notably, the provision reflects a constitutional approach that transcends the traditional public/private divide and departs from the classical liberal paradigm of fundamental rights as merely negative liberties. Instead, it embeds a framework of protection that applies regardless of the identity or legal status of the actor engaged in personal data processing.

First, the individual entitlements under Article 8(2) of the Charter - such as access and rectification of personal data - are defined in general terms and apply to all personal data, collected by public or private actors. This constitutional option is normatively justified: in data-driven environments, private actors often wield powers that directly and significantly affect individuals’ fundamental rights.⁴⁹ Accordingly, the right to data protection under Article 8 presupposes a constitutional arrangement in which all actors are integrated into a broader normative framework grounded in legal standards. This design affirms data protection as a positive right - one that not only guarantees individual autonomy, but structures data-processing relationships and mitigates informational power asymmetries in digital environments.

Second, and similarly to the entitlements, substantive norms - such as fairness or purpose limitation - are addressed to any actor processing personal data. Thus, as will be discussed further below, data subjects can invoke these norms directly against private actors. The constitutional effect of these principles does not depend on the identity of the duty-bearer, but on the nature of the processing and its impact on the individual.

Third, the right to data protection is not realised solely through judicial remedies between individuals and the State. Rather, public powers - including legislators and supervisory authorities - are structurally responsible for shaping the normative environment in which data processing occurs.⁵⁰ Supervisory authorities are tasked with ensuring that all actors, irrespective of their legal status, interpret and apply the law in conformity with fundamental rights standards.⁵¹ Crucially, the legislator plays a constitutive role: within the constitutional design of Article 8 the, law-making is not merely instrumental, but norm-generative.⁵² At both EU and national levels, legislators have a constitutional mandate to define the conditions and limits of data processing, thereby constraining the discretion of public and private actors alike.⁵³ While it would be inaccurate to suggest that the legal effects of Article 8 are contingent upon legislative action, the Charter clearly leaves space for legislative development within the limits of Article 52(1) of the Charter.⁵⁴

As discussed in the next section, the regulatory response to this mandate has involved a strategic reliance on both public and private actors as decentralised agents of rights enforcement. This evolution is most visible in the Regulation⁵⁵, which gives legislative form to Article’s 8 protective logic by embedding horizontal responsibilities within a decentralised system of fundamental rights governance.⁵⁶

This institutional scaffolding confirms that Article 8’s protective structure is neither purely negative nor confined to vertical relationships. Instead, it reflects a hybrid configuration of horizontality, in which direct obligations imposed on private actors are embedded within a state-mediated framework of constitutional enforcement.

3.2 The normative development of data protection: explicit horizontality in the GDPR?

The Regulation illustrates how EU secondary legislation can give concrete form to a model of horizontal effect that is not merely functional but institutionally constructed. Rather than merely translating fundamental rights into secondary norms, the Regulation embeds constitutional principles within private relationships through public rule-making, regulatory oversight, and decentralised implementation.⁵⁷ While much of the doctrinal debate on horizontality has focused on judicial interpretation and the Charter’s scope, the GDPR operationalises Article 8’s ‘tripartite structure’ through provisions that apply across both public and private sectors.⁵⁸

Instead of merely restating constitutional norms, the Regulation establishes a comprehensive system of rights and obligations that reflect and reinforce the constitutional status of data protection. It does so by imposing direct, non-contingent obligations on data controllers and processors, which are legally required to uphold fundamental rights in their organizational practices.⁵⁹ Importantly, the Regulation’s definitions of data controllers⁶⁰ and data processors⁶¹ do not rely on a public/private distinction, but rather on the degree of control or influence exercised over data processing activities.⁶²

The obligations imposed by the Regulation are not incidental or merely procedural - they form the normative core of a risk-based regulatory model that places fundamental rights protection at the heart of data governance.⁶³ Key provisions such as Articles 5 and 24 (accountability), 25 (data protection by design and by default) and 32 (security of processing), impose proactive and anticipatory duties on data controllers.⁶⁴ These obligations apply independently of any vertical relationship with public authorities and are generalised across all processing operations, regardless of sector or context.⁶⁵

Among the most emblematic mechanisms of this architecture are Data Protection Impact Assessments (Impact Assessments), established under Article 35 of the Regulation.⁶⁶ Impact Assessments require data controllers to evaluate the necessity and proportionality of processing activities, and to identify and mitigate potential risks to individual rights and freedoms. These assessments demand forms of normative reasoning typically associated with judicial review, requiring private actors to act as decentralised sites of constitutional adjudication.⁶⁷ In this way, Impact Assessments exemplify what scholars have described as the ‘constitutionalisation of the regulatory state’⁶⁸ - the embedding of fundamental rights evaluation into the operational core of private governance structures.⁶⁹

In this context, data controllers emerge not only as norm-takers but as norm-appliers.⁷⁰ They are legally required to interpret and implement fundamental rights within specific organisational settings, often in the absence of direct state supervision.⁷¹ This delegation of constitutional responsibility reflects a broader evolution towards regulatory governance based on structured horizontality, in which private actors internalise and operationalise fundamental rights as part of their institutional design.⁷² This model illustrates how elements of direct and indirect horizontality are realised within a predominantly state- or EU-mediated framework. While the constitutional norms originate from the Charter, their implementation is decentralised and privatised - a hybrid model of enforceability.

In sum, the Regulation exemplifies a state-mediated and institutionally embedded model of horizontality. Rather than relying on judicial innovation to extend the Charter into the private sphere, the Regulation constructs a comprehensive enforcement regime in which constitutional values are transmitted through a web of legal obligations, organisational practices, and institutional oversight. The legislative development of the right to data protection, as articulated in Article 8 of the Charter, is therefore not merely opposable to the State, but is actively realised through the regulatory architecture of private conduct.

3.3 Case-law of the Court: implicit horizontality in practice

While the Regulation provides a legislative foundation for the horizontal application of Article 8 of the Charter, the Court has further reinforced this model through a complementary judicial trajectory.⁷³ Without articulating a general doctrine of horizontal effect of EU fundamental rights, the Court has progressively interpreted Article 8 in ways that affirm its applicability in disputes involving private actors. This case law consolidates the model of structural horizontality embedded in the Regulation, extending the Charter’s constitutional protections into horizontal or quasi-horizontal contexts.

In Google Spain⁷⁴, the Court held that Google was subject to obligations derived directly from Articles 7 and 8 Charter - most notably, the obligation to delist certain search results following a data subject’s request.⁷⁵ The Charter served not merely as an interpretive backdrop but as an autonomous constitutional basis for imposing duties on a private company. Significantly, the Court’s reasoning did not rely exclusively on EU secondary law, namely Directive 95/46⁷⁶, but invoked the binding force and normative autonomy of the Charter as a source of primary law. This marked a shift from compliance with legislative norms to a direct enforcement of constitutional standards in horizontal settings.⁷⁷

Subsequent rulings have deepened this trajectory. In GC and Others⁷⁸, the Court affirmed that data controllers must balance the right to data protection with freedom of expression - a task that necessarily entails adjudicating between competing fundamental rights within the private sphere. Likewise, in Schrems I⁷⁹ and Schrems II⁸⁰, the Court held that data controllers transferring personal data to third countries must ensure compliance with Article 8 of the Charter, and that the absence of adequate safeguards in the recipient jurisdiction may constitute a violation of the right to data protection. These decisions establish that private actors bear constitutional responsibilities under EU law, even in complex transnational settings.

Across these cases, the Court applies the Charter beyond its textually defined scope in Article 51(1) Charter⁸¹, which limits the Charter’s application to situations involving EU institution and Member States when implementing Union law. In fact, this was an argument put forward by some scholars against the horizontal application of the right to data protection.⁸² However, through a teleological and functional interpretation, the Court has justified this expansion by appealing to the need for effective protection of fundamental rights in digital and transnational environments where private entities wield structural power.⁸³

Legal scholarship has increasingly recognised this development as a departure from formalistic readings of the Charter’s scope.⁸⁴ By invoking Article 8 as a constitutional constraint on private actors, even in the absence of an express doctrine of horizontal direct effect, the Court signals its acknowledgement of the centrality of private regulatory power in the digital age, and the constitutional imperative of ensuring rights compliance in these contexts.

Taken together, these rulings outline a jurisprudential model of functional horizontality. Rather than pronouncing a general rule, the Court has adopted a pragmatic, purposive, and context-sensitive approach that affirms the enforceability of Article 8 of the Charter in disputes involving private actors. What emerges is not model of pure direct effect, but a hybrid framework, in which judicial interpretation interacts with legislative design and administrative enforcement. This confirms that the horizontal effect of the right to data protection is primarily state or EU-mediated, but is rendered effective through interlocking mechanisms of normative transmission - including judicial adjudication, supervisory authority oversight, and delegated regulatory compliance.

3.4 Structural horizontality in data protection: a constitutional response to digital power

The case for recognising the horizontal effect of Article 8 of the Charter is particularly compelling in the contemporary digital context, where fundamental rights are increasingly shaped, limited or undermined not primarily by public authorities, but by private actors exercising quasi-sovereign power.⁸⁵ Big tech platforms, employers, insurers, credit agencies and AI systems now possess systemic capacities to profile, categorise, influence, and exclude individuals.⁸⁶ These informational and organisational asymmetries are not incidental but structurally embedded in the architecture of digital governance.⁸⁷

The regulatory response required by these asymmetries cannot be captured by a single model of horizontality. Instead, it must combine direct enforceability, embedded normative orientation, and institutional mediation. As such, the traditional vertical paradigm of state-citizen relations is increasingly inadequate to address the complexity of rights risks in privatised environments and algorithmically mediated.

In this context, a public-law model of fundamental rights limited to state action becomes both normatively untenable and functionally obsolete. Limiting the applicability of Article 8 of the Charter to vertical relationships fails to account for the structural reality that individuals’ autonomy, dignity, and equality are often shaped - and sometimes jeopardised - by private actors who design, manage, and control essential informational infrastructures. This disjunction between constitutional ambition and operational deployment demands a deeper normative and institutional realignment.⁸⁸

Such a realignment entails recognising that the substantive norms and entitlements enshrined in Article 8 of the Charter are not policy aspirations or procedural formalities, but enforceable constitutional guarantees. These entitlements apply irrespective of the public or private status of the duty-bearer. A legal framework that conditions the protection of fundamental rights on the identity of the actor risks legitimising structural impunity and leaving vast domains of digital life beyond the reach of constitutional scrutiny.

Fragmentation in the level of protection undermines both the internal coherence and the normative integrity of the Charter. It allows similarly situated individuals to receive unequal levels of protection, depending solely on whether the interference originates from public or private sources - a distinction that is increasingly arbitrary and normatively indefensible, especially in light of the Charter’s commitments to universality, consistency, and equal treatment.

Thus, the horizontal effect of Article 8 of the Charter is not a doctrinal surplus or an interpretative anomaly. It is a structural necessity in a legal order committed to ensuring the effectiveness of constitutional rights in complex, privately governed environments. It guarantees that fundamental rights track the centres of power - including algorithmic infrastructures, commercial platforms, and digital intermediaries - wherever they emerge. The law must respond to these conditions by affirming that constitutional obligations attach not to institutional identity, but to structural power and rights vulnerability.

4. Conclusion

This article has argued that the right to data protection enshrined in Article 8 of the Charter provides a paradigmatic example of structural horizontality within the EU legal order. It demonstrates that the traditional binary logic of vertical versus horizontal effect is insufficient to capture the layered and institutionalised nature of rights enforcement in the digital age. Instead, a more nuanced framework is required - one that recognises the institutional mechanisms through which fundamental rights are rendered effective in private legal relationships.

By examining the three archetypal models of horizontality - direct, indirect, and state-mediated - and showing how Article 8 of the Charter integrates these models within a hybrid architecture, this analysis has highlighted the constitutional and functional complexity of data protection in the EU. In particular, it has underscored the central role of public powers - both national and supranational - in enabling, mediating, and overseeing the application of fundamental rights in private contexts. The horizontal effect of Article 8 is thus not an exception carved out from verticality, but a structural consequence of its constitutional design and the regulatory environment in which it operates.

The case of data protection exemplifies why a formalist or source-based approach to horizontality is no longer viable in the EU. In digital environments where private actors hold unprecedented power over personal data and individual autonomy, the effectiveness of fundamental rights hinges not on the identity of the actor, but on the capacity of the legal framework to respond to structural asymmetries of power and ensure rights enforcement across all domains. The protection of personal data, as both an individual right and a constitutional value, demands a legal architecture that allows rights to follow the loci of power, whether public or private.

This analysis suggests that a constitutional reading of horizontality -grounded in the structural and normative role of rights within the EU legal order - offers a coherent and normatively defensible approach. It bridges the gap between the Charter’s constitutional commitments and the empirical realities of privatised governance, ensuring that fundamental rights remain effective and justiciable, even as institutional authority become more diffuse and technology mediated

Ultimately, recognising the structural, state-mediated horizontality of Article 8 of the Charter is not an optional doctrinal innovation, but a constitutional imperative. It reflects a deeper commitment to ensuring that the fundamental rights protected by the Charter are not only theoretically affirmed, but practically realised in legal environments increasingly shaped by private power. Affirming the hybrid horizontality of data protection reinforces the Charter’s foundational values - equality, dignity, and autonomy - and reaffirms the EU’s constitutional capacity to safeguard them in the digital age.

References

• ALEXY, Robert. A Theory of Constitutional Rights. Oxford: Oxford University Press, 2002.
• BARAK, Aharon. Human dignity: the constitutional value and the constitutional right. Cambridge: Cambridge University Press, 2015.
• BIEKER, Felix. The right to data protection: individual and structural dimensions of data protection in EU law. Cham: Springer, 2022.
• CALLIES, Christian. Dimensions of fundamental rights - duty to respect versus duty to protect. In: PÜNDER, Hermann; WALDHOFF, Christian (ed.). Debates in German public law. Oxford: Hart Publishing, 2014. p. 27-43.
• COHEN, Julie E. Between truth and power: the legal constructions of informational capitalism. Oxford: Oxford University Press, 2019.
• COURT OF JUSTICE OF THE EUROPEAN UNION (CJEU). Case C-131/12, Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González. Judgment of 13 May 2014. EU:C:2014:317.
• CRAIG, Paul; DE BÚRCA, Gráinne. EU law: text, cases, and materials. 6. ed. Oxford: Oxford University Press, 2015.
• CURTIN, Deirdre. Challenging executive dominance in European democracy. Modern Law Review, London, v. 77, n. 1, p. 1-32, Jan./Mar. 2014.
• DE GREGORIO, Giovanni. The rise of digital constitutionalism in the European Union. European Law Journal, Oxford, v. 27, n. 1, p. 1-25, Jan./Feb. 2021.
• EUROPEAN DATA PROTECTION SUPERVISORY. Study on the essence of the fundamental rights to privacy and to protection of personal data. 2022.
• EUROPEAN UNION. Charter of Fundamental Rights of the European Union. Art. 8(1).
• EUROPEAN UNION. Regulation (EU) 2016/679 (GDPR). Official Journal of the European Union, Luxembourg, L 119/1, 4 May 2016.
• FRANTZIOU, Eleni. The horizontal effect of the EU Charter of Fundamental Rights: a constitutional analysis. Oxford: Oxford University Press, 2023.
• GARDBAUM, Stephen. The “horizontal effect” of constitutional rights. Michigan Law Review, Michigan, v. 102, p. 387-459, Jan./Feb. 2003.
• GELLERT, Raphaël. The risk-based approach to data protection. Oxford: Oxford University Press, 2020.
• HABERMAS, Jürgen. Between facts and norms. Cambridge: Polity Press, 1996.
• KOKOTT, Juliane; SOBOTTA, Christoph. The distinction between privacy and data protection in the jurisprudence of the CJEU and the ECHR. In: HIJMANS, H.; KRANENBORG, H. (ed.). Data protection 2014: how to restore trust? Contributions in honour of Peter Hustinx. Cambridge: Intersentia, 2014. p. 83-95.
• LYNSKEY, Orla. Courts, regulation, and data protection in the EU. European Constitutional Law Review, Cambridge, v. 17, n. 4, p. 527-530, Oct./Dec. 2021.
• MONIZ, Graça Canto. DPIAs and fundamental rights governance. Information & Communications Technology Law, Abingdon, advance online publication, 2025. Available at: https://doi.org/10.1080/13600834.2025.2495441. Accessed: 19 May 2025.
  » https://doi.org/https://doi.org/10.1080/13600834.2025.2495441
• RIBEIRO, Gonçalo de Almeida. The effects of fundamental rights in private disputes. In: COLLINS, Hugh (org.). European contract law and the Charter of Fundamental Rights. Cambridge: Intersentia, 2017.
• SILVA, Jorge Pereira da. Deveres do Estado de proteção de direitos fundamentais. Lisboa: Universidade Católica Editora, 2015.
• ZUBOFF, Shoshana. The age of surveillance capitalism: the fight for a human future at the new frontier of power. London: Profile Books, 2019.

• ¹
  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) [2016] OJ L119/1.
• ²
  RIBEIRO, Gonçalo de Almeida. Fundamental Rights. Programme, Content and Methods of an Innovative Course. Lisboa: UCP Press, 2025.
• ³
  KOMMERS, Donald P. and MILLER, Russell A. The Constitutional Jurisprudence of the Federal Republic of Germany . Durham: Duke University Press, 2012. ch 8.
• ⁴
  WOOLMAN, Stu. Application. In: WOOLMAN, Stu; BISHOP, Michael (ed.). Constitutional law of South Africa. 2. ed. Cape Town: Juta, 2006. ch. 31.
• ⁵
  EUROPEAN COURT OF HUMAN RIGHTS. Case X and Y v Netherlands. Reports of Judgments and Decisions, v. 8, p. 235, 1985.
• ⁶
  FRANTZIOU, Eleni. The horizontal effect of the EU Charter of Fundamental Rights: a constitutional analysis. Oxford: Oxford University Press, 2023. ch. 1; BARAK, Ahron. Human dignity: the constitutional value and the constitutional right. Cambridge: Cambridge University Press, 2015. p. 230-236.
• ⁷
  FRANTZIOU, Eleni. The horizontal effect of the EU Charter of Fundamental Rights: a constitutional analysis. Oxford: Oxford University Press, 2023. ch. 1.
• ⁸
  A thorough comparative assessment of the horizontal effect of fundamental rights in EU Member States is beyond the scope of this project, see for a detailed assessment BRUGGEMEIER, Gert et al. (ed.). Fundamental rights and private law in the European Union. v. 1. Cambridge: Cambridge University Press, 2010.
• ⁹
  RIBEIRO, Gonçalo de Almeida. Fundamental Rights. Programme, Content and Methods of an Innovative Course. Lisboa: UCP Press, 2025.p. 42.
• ¹⁰
  FRANTZIOU, Eleni. The horizontal effect of the EU Charter of Fundamental Rights: a constitutional analysis. Oxford: Oxford University Press, 2023. ch. 1.
• ¹¹
  ALEXY, Robert. A Theory of Constitutional Rights. Oxford: Oxford University Press, 2002. p. 357-3761; Kommers and Miller, The Constitutional Jurisprudence, ch 8.
• ¹²
  FRANTZIOU, Eleni. The horizontal effect of the EU Charter of Fundamental Rights: a constitutional analysis. Oxford: Oxford University Press, 2023. ch. 1
• ¹³
  Article 18(1) of the Portuguese Constitution and Article 15 of the Constitution of Slovenia.
• ¹⁴
  BVERFGE [Lüth] 7, 198, 1958.
• ¹⁵
  RIBEIRO, Gonçalo de Almeida. The effects of fundamental rights in private disputes. In: COLLINS, Hugh (org.). European contract law and the Charter of Fundamental Rights. Cambridge: Intersentia, 2017. p. 18.
• ¹⁶
  ‘[F]ar from being a value-free system the Constitution erects an objective system of values in its section on basic rights (…) This system of values, centring on the freedom of the human being to develop in society, must apply as a constitutional axiom throughout the whole legal system: it must direct and inform legislation, administration, and judicial decision. It naturally influences private law as well; no rule of private law may conflict with it, and all such rules must be construed in accordance with its spirit.”, BVerfGE [Luth] 7, 198 (1958) at 205.
• ¹⁷
  RIBEIRO, Gonçalo de Almeida. The effects of fundamental rights in private disputes. In: COLLINS, Hugh (org.). European contract law and the Charter of Fundamental Rights. Cambridge: Intersentia, 2017. p. 18.
• ¹⁸
  GARDBAUM, Stephen. The “horizontal effect” of constitutional rights. Michigan Law Review, Ann Arbor, v. 102, p. 387, 2003.
• ¹⁹
  SILVA, Jorge Pereira da. RGPD: ensaio sobre o novo habitat do direito fundamental à proteção de dados pessoais. In: MOUTINHO, José Lobo et al. (org.). Homenagem ao Professor Doutor Germano Marques da Silva. Lisboa: Universidade Católica, 2020. v. II, p. 1203-1232.
• ²⁰
  CALLIES, Christian. Dimensions of fundamental rights - duty to respect versus duty to protect. In: PÜNDER, Hermann; WALDHOFF, Christian (ed.). Debates in German public law. Oxford: Hart Publishing, 2014. p. 27-43.
• ²¹
  KOTZUR, Markus. Fundamental rights and horizontal effect in German constitutional law. In: MUIR, Elise; BARNARD, Catherine; BRADLEY, Kieran (ed.). Constitutionalism, the internal market and fundamental rights. Cheltenham: Edward Elgar, 2011. p. 118-130; KHAITAN, Tarunabh. Beyond the state: the right to constitutional remedies and state action. International Journal of Constitutional Law, Oxford, v. 17, p. 860-863, 2019.
• ²²
  FREDMAN, Sandra. Human rights transformed: positive rights and positive duties. Oxford: Oxford University Press, 2008. Ch. 3 e 5.
• ²³
  VAN GEND EN LOOS v. Nederlandse Administratie der Belastingen. Case 26/62. ECR 1, 1963; DEFRENNE v. Sabena. Case 43/75. ECR 455, 1976.
• ²⁴
  WEATHERILL, Stephen. Land and values in the European Union. Oxford: Oxford University Press, 2016.) ch. 3; DOUGAN, Michael. Judicial activism or constitutional interaction? Policymaking by the ECJ in the field of Union citizenship. Cambridge Yearbook of European Legal Studies, Cambridge, v. 3, p. 199-228, 2006;TRIDIMAS, Takis. The general principles of EU law. 2. ed. Oxford: Oxford University Press, 2006. p. 273-275.
• ²⁵
  DOUGAN, Michael. When Worlds Collide! Competing Visions of the Relationship between Direct Effect and Supremacy. Common Market Law Review, v. 44, p. 931-963, 2007.
• ²⁶
  MARSHALL v Southampton and South-West Hampshire AHA (Teaching). Case 152/84. [1986] ECR 723; FACCINI DORI v Recreb Srl. Case C-91/92. [1994] ECR I-3325.
• ²⁷
  CRAIG, Paul; DE BÚRCA, Gráinne.EU law: text, cases, and materials. 6. ed. Oxford: Oxford University Press, 2015. p. 361-364; TRIDIMAS, Takis.The general principles of EU law. 2. ed. Oxford: Oxford University Press, 2006. p. 309-312; DOUGAN, Michael. When worlds collide! Competing visions of the relationship between direct effect and supremacy. Common Market Law Review, v. 44, p. 931-963, 2007.
• ²⁸
  FRANTZIOU, Eleni.The horizontal effect of the EU Charter of Fundamental Rights: a constitutional analysis. Oxford: Oxford University Press, 2023. Ch. 2.
• ²⁹
  LENAERTS, Koen. Exploring the limits of the EU Charter of Fundamental Rights. European Constitutional Law Review, v. 8, p. 375-404, 2012; TRIDIMAS, Takis.The general principles of EU law. 2. ed. Oxford: Oxford University Press, 2006. p. 309-310.
• ³⁰
  LENAERTS, Koen. Exploring the limits of the EU Charter of Fundamental Rights. European Constitutional Law Review, v. 8, p. 375-404, 2012; CRAIG, Paul. The ECJ and ultra vires action: a conceptual analysis. Common Market Law Review, v. 48, p. 395-437, 2011.
• ³¹
  FRANTZIOU, Eleni.The horizontal effect of the EU Charter of Fundamental Rights: a constitutional analysis. Oxford: Oxford University Press, 2023. Ch. 2.
• ³²
  European Union. Court of Justice of the European Union. Case C-555/07, Kücükdeveci v Swedex GmbH & Co. KG. European Court Reports, 2010, p. I-365; European Union. Court of Justice of the European Union. Case C-414/16, Egenberger. ECLI:EU:C:2018:257: European Union. Court of Justice of the European Union. Case C-68/17, IR. ECLI:EU:C:2018:696;European Union.Court of Justice of the European Union. Case C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González. ECLI:EU:C:2014:317.
• ³³
  FRANTZIOU, Eleni. The horizontal effect of the EU Charter of Fundamental Rights: a constitutional analysis. Oxford: Oxford University Press, 2023. Ch. 2; DE BÚRCA, Gráinne. After the EU Charter of Fundamental Rights: the Court of Justice as a human rights adjudicator? Maastricht Journal of European and Comparative Law, v. 20, p. 168-184, 2013.
• ³⁴
  HABERMAS, Jürgen. Between facts and norms. Cambridge: Polity Press, 1996; ALEXY, Robert. A theory of constitutional rights. Oxford: Oxford University Press, 2002. p. 355-361.
• ³⁵
  LENAERTS, Koen. Exploring the limits of the EU Charter of Fundamental Rights. European Constitutional Law Review, Cambridge, v. 8, p. 375-403, 2012; FRANTZIOU, Eleni. The horizontal effect of the EU Charter of Fundamental Rights: a constitutional analysis. Oxford: Oxford University Press, 2023. Ch. 3;WEATHERILL, Stephen. Land and values in the European Union. In: Land and Values in the European Union. Oxford: Oxford University Press, 2016. Ch. 3; CRAIG, Paul. Fundamental rights, principles and the Charter. Maastricht Journal of European and Comparative Law, Maastricht, v. 19, p. 595-620, 2011.
• ³⁶
  GARDBAUM, Stephen. The “horizontal effect” of constitutional rights. Michigan Law Review, Michigan, v. 102, p. 387-459, Jan./Feb. 2003.
• ³⁷
  FRANTZIOU, Eleni.The horizontal effect of the EU Charter of Fundamental Rights: a constitutional analysis. Oxford: Oxford University Press, 2023. Ch. 4; TRIDIMAS, Takis. The ECJ and the national courts: dialogue, cooperation, and instability. In: CHALMERS, Damian; ARNULL, Anthony (Ed.). The Oxford handbook of European Union law. Oxford: Oxford University Press, 2015. p. 403-429.
• ³⁸
  LENAERTS, Koen. Exploring the limits of the EU Charter of Fundamental Rights. European Constitutional Law Review, Cambridge, v. 8, p. 375-403, 2012; DE BÚRCA, Gráinne. After the EU Charter of Fundamental Rights: the Court of Justice as a human rights adjudicator? Maastricht Journal of European and Comparative Law, Maastricht, v. 20, n. 2, p. 168-184, abr./jun. 2013.
• ³⁹
  SILVA, Jorge Pereira da. Deveres do Estado de proteção de direitos fundamentais. Lisboa: Universidade Católica Editora, 2015. p. 102.
• ⁴⁰
  EUROPEAN UNION. Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation - GDPR). Official Journal of the European Union, Luxembourg, L 119/1, 4 May 2016.
• ⁴¹
  KOKOTT, Juliane; SOBOTTA, Christoph. The distinction between privacy and data protection in the jurisprudence of the CJEU and the ECHR. In: HIJMANS, H.; KRANENBORG, H. (Ed.). Data Protection 2014: how to restore trust? Contributions in honour of Peter Hustinx. Cambridge: Intersentia, 2014. p. 83-95.
• ⁴²
  EUROPEAN DATA PROTECTION SUPERVISORY. Study on the essence of the fundamental rights to privacy and to protection of personal data (2022) 17; GONZÁLEZ FUSTER, Gloria. The emergence of personal data protection as a fundamental right of the EU. Dordrecht: Springer, 2014; LOCK, Tobias. Articles 6-19. In: KELLERBAUER, Manuel; KLAMERT, Marcus; TOMKIN, Jonathan (ed.). The EU treaties and the Charter of Fundamental Rights: a commentary. Oxford: Oxford University Press, 2019. p. 2123.
• ⁴³
  EUROPEAN DATA PROTECTION SUPERVISORY. Study on the essence of the fundamental rights to privacy and to protection of personal data (2022) 17
• ⁴⁴
  EUROPEAN UNION. Charter of Fundamental Rights of the European Union. Art. 8(1).
• ⁴⁵
  Some scholars call these ‘principles’ while others ‘obligations’, see EUROPEAN DATA PROTECTION SUPERVISORY. Study on the essence of the fundamental rights to privacy and to protection of personal data (2022) 17 and footnote 59.
• ⁴⁶
  EUROPEAN UNION. Charter of Fundamental Rights of the European Union. Art. 8(2).
• ⁴⁷
  EUROPEAN UNION. Charter of Fundamental Rights of the European Union. Art. 8(3).
• ⁴⁸
  HONDIUS, Frits W. Data law in Europe. Stanford Journal of International Law, Stanford, v. 16, p. 95-120, 1980.
• ⁴⁹
  COHEN, Julie E.Between truth and power: the legal constructions of informational capitalism. Oxford: Oxford University Press, 2019. p. 3-6.
• ⁵⁰
  EUROPEAN UNION. Charter of Fundamental Rights of the European Union. Art. 8(2).
• ⁵¹
  EUROPEAN UNION. Charter of Fundamental Rights of the European Union. Art. 8(3).
• ⁵²
  EUROPEAN UNION. Charter of Fundamental Rights of the European Union. Art. 8(2).
• ⁵³
  On the problem of legislative discretion see BARAK, Aharon. Proportionality: constitutional rights and their limitations. Cambridge: Cambridge University Press, 2012. p. 135; PEREIRA DA SILVA, Jorge. Deveres do Estado de Protecção de Direitos Fundamentais. Lisboa: Universidade Católica Editora, 2015. p. 563.
• ⁵⁴
  ‘Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.’
• ⁵⁵
  EUROPEAN UNION. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation - GDPR). Official Journal of the European Union, Luxembourg, L 119/1, 4 May 2016. Recital 1 and art. 1(2).
• ⁵⁶
  MONIZ, Graça Canto. DPIAs and fundamental rights governance. Information & Communications Technology Law, Abingdon, advance online publication, 2025. Available at: https://doi.org/10.1080/13600834.2025.2495441. Accessed: 19 May 2025.
• ⁵⁷
  LYNSKEY, Orla. Courts, regulation, and data protection in the EU. European Constitutional Law Review, Cambridge, v. 17, n. 4, p. 527-530, Oct./Dec. 2021.
• ⁵⁸
  BIEKER, Felix. The right to data protection: individual and structural dimensions of data protection in EU law. Cham: Springer, 2022. p. 258.
• ⁵⁹
  EUROPEAN UNION. Regulation (EU) 2016/679 (GDPR). Official Journal of the European Union, Luxembourg, L 119/1, 4 May 2016. Arts. 5(2), 24 and 25.
• ⁶⁰
  EUROPEAN UNION. Regulation (EU) 2016/679 (GDPR). Official Journal of the European Union, Luxembourg, L 119/1, 4 May 2016. Art. 4(7) Regulation.
• ⁶¹
  EUROPEAN UNION. Regulation (EU) 2016/679 (GDPR). Official Journal of the European Union, Luxembourg, L 119/1, 4 May 2016. Art. 4(8) Regulation.
• ⁶²
  BIEKER, Felix. The right to data protection: individual and structural dimensions of data protection in EU law. Cham: Springer, 2022. p. 169.
• ⁶³
  GELLERT, Raphaël. The risk-based approach to data protection. Oxford: Oxford University Press, 2020.
• ⁶⁴
  EUROPEAN UNION. Regulation (EU) 2016/679 (GDPR). Official Journal of the European Union, Luxembourg, L 119/1, 4 May 2016. Arts. 24, 25 and 32.
• ⁶⁵
  LYNSKEY, Orla. The foundations of EU data protection law. Oxford: Oxford University Press, 2015. p. 15.
• ⁶⁶
  MONIZ, Graça Canto. DPIAs and fundamental rights governance. Information & Communications Technology Law, Abingdon, advance online publication, 2025. Available at: https://doi.org/10.1080/13600834.2025.2495441. Accessed: 19 May 2025.
• ⁶⁷
  CHIARA, Pier Giorgio; GALLI, Frederico. Normative considerations on impact assessments in EU digital policy. Media Laws, Rome, v. 2, p. 86, 2024.
• ⁶⁸
  CURTIN, Deirdre. Challenging executive dominance in European democracy. Modern Law Review, London, v. 77, n. 1, p. 1-32, Jan./Mar. 2014.
• ⁶⁹
  BASSINI, Marco. Fundamental rights and private enforcement in the digital age. European Law Journal, Oxford, v. 25, n. 2, p. 182-197, Mar./Apr. 2019.
• ⁷⁰
  Ibid.
• ⁷¹
  EUROPEAN UNION. Regulation (EU) 2016/679 (GDPR). Official Journal of the European Union, Luxembourg, L 119/1, 4 May 2016. Art. 5(2).
• ⁷²
  CURTIN, Deirdre. Challenging executive dominance in European democracy. Modern Law Review, London, v. 77, n. 1, p. 10-14, Jan./Mar. 2014.
• ⁷³
  LYNSKEY, Orla. Courts, regulation, and data protection in the EU. European Constitutional Law Review, Cambridge, v. 17, n. 4, p. 527-530, Oct./Dec. 2021.
• ⁷⁴
  COURT OF JUSTICE OF THE EUROPEAN UNION (CJEU). Case C-131/12, Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González. Judgment of 13 May 2014. EU:C:2014:317. paras. 69-74.
• ⁷⁵
  COURT OF JUSTICE OF THE EUROPEAN UNION (CJEU). Case C-131/12, Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González. Judgment of 13 May 2014. EU:C:2014:317. paras. 69-74.
• ⁷⁶
  EUROPEAN UNION. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Official Journal of the European Communities, L 281/31, 23 Nov. 1995.
• ⁷⁷
  COURT OF JUSTICE OF THE EUROPEAN UNION (CJEU). Case C-131/12, Google Spain SL and Google Inc v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González. Judgment of 13 May 2014. EU:C:2014:317. paras. 69-74.
• ⁷⁸
  EUROPEAN UNION. Court of Justice of the European Union. Case C-136/17, GC and Others v CNIL, Judgment of 24 September 2019. EU:C:2019:773, paras. 56-58.
• ⁷⁹
  EUROPEAN UNION. Court of Justice of the European Union. Case C-362/14, Maximillian Schrems v Data Protection Commissioner (Schrems I), Judgment of 6 October 2015. EU:C:2015:650.
• ⁸⁰
  EUROPEAN UNION. Court of Justice of the European Union. Case C-311/18, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Schrems II), Judgment of 16 July 2020. EU:C:2020:559.
• ⁸¹
  Art 51(1) Charter limits the Charter’s scope to EU institutions and to Member States when implementing Union law. Nonetheless, the Court has adopted a functional reading, allowing the Charter to apply where private actors operate within EU-regulated frameworks.
• ⁸²
  KOKOTT, Juliane; SOBOTTA, Christoph. The distinction between privacy and data protection in the jurisprudence of the CJEU and the ECHR. In: HIJMANS, H.; KRANENBORG, H. (ed.). Data protection 2014: how to restore trust? Contributions in honour of Peter Hustinx. Cambridge: Intersentia, 2014. p. 83-95.
• ⁸³
  FRANTZIOU, Eleni. The horizontal effect of the Charter of Fundamental Rights of the EU: rediscovering the reasons for horizontality. European Law Journal, Oxford, v. 25, n. 1, p. 57-67, Jan./Feb. 2019.
• ⁸⁴
  FRANTZIOU, Eleni. The horizontal effect of the EU Charter of Fundamental Rights: a constitutional analysis. Oxford: Oxford University Press, 2023. Ch. 2.
• ⁸⁵
  DE GREGORIO, Giovanni. The rise of digital constitutionalism in the European Union. European Law Journal, Oxford, v. 27, n. 1, p. 1-25, Jan./Feb. 2021.
• ⁸⁶
  ZUBOFF, Shoshana. The age of surveillance capitalism: the fight for a human future at the new frontier of power. London: Profile Books, 2019. p. 8-18
• ⁸⁷
  COHEN, Julie E.Between truth and power: the legal constructions of informational capitalism. Oxford: Oxford University Press, 2019. p. 3-6.
• ⁸⁸
  DE GREGORIO, Giovanni. The rise of digital constitutionalism in the European Union. European Law Journal, Oxford, v. 27, n. 1, p. 1-25, Jan./Feb. 2021.
• Como citar esse artigo/How to cite this article:
  MONIZ, Graça Canto. The hybrid nature of horizontality in EU Data Protection Law: the Charter, the Regulation and the Court of Justice of the EU. Revista de Investigações Constitucionais, Curitiba, v. 12, n. 3, e522, set./dez. 2025. DOI: 10.5380/rinc.v12i3.100151.
• Declaração de disponibilidade de dados/Data Availability Statement
  This study did not generate or use any datasets and is based exclusively on bibliographic and documentary research.

• Editor-in-chief:
  Daniel Wunder Hachem

• Associate Editor:
  Luzardo Faria

Data availability

This study did not generate or use any datasets and is based exclusively on bibliographic and documentary research.

Publication Dates

• Publication in this collection
  13 Feb 2026
• Date of issue
  Sep-Dec 2025

History

• Received
  20 June 2025
• Accepted
  17 Oct 2025