The assumption of the conference on ‘Reinventing Data Protection?’ was that data protection and privacy are not the same thing, though they may overlap. One of the questions raised by advanced data processing techniques like data mining and profiling is whether the assumption that it is data that need to be protected still holds.¹ The data protection directive of 1995 builds on the concept of personal data, defined as data that relate to an identified or identifiable natural person.²