EU data access and portability in practice: nothing but resignation and frustration?

In theory, the EU equips its citizens with strong rights as regards the access to and portability of their personal data. These rights were first formalized in the 2016 General Data Protection Regulation and further reinforced with the 2023 Data Act. However, in practice, the full realization of these rights remains a distant goal. Users face barriers such as power asymmetries, complex request procedures, and inconsistent technical standards. This discrepancy between an ideal and the real world may foster privacy fatigue and exhaustion. In this chapter we link legal redress mechanisms and the privacy fatigue literature, which offers another perspective to rethinking current legislative paradigms and future regulatory directions. We further argue that EU policymakers, while empowering individuals’ legal rights, should also consider the subjective experiences of those exercising these rights; otherwise, the normative goals will remain undermined.