Codes of (Mis)conduct? An Appraisal of Articles 40-41 GDPR in View of the 1995 Data Protection Directive and its Shortcomings

In its articles 40 and 41, the GDPR proposes the use of codes of conduct to help private actors demonstrate data protection accountability, as well as to aid with the implementation of the Regulation. However, the emphasis that the GDPR places on these soft law instruments is somewhat remarkable since both the EU and legal scholars concluded that article 27 of the 1995 Data Protection Directive, as the legislative predecessor to articles 40 and 41 GDPR, failed to make codes of conduct a key element of European data protection practices. This contribution seeks to investigate why the 1995 Directive was unsuccessful and, on the basis of those findings, attempts to formulate informed predictions on what any similarities and differences between article 27 DPD and articles 40-41 GDPR might tell us about the future course of codes of conduct under the GDPR