Thanks to him, our floor was suffused with the smell of proper coffee. “No coffee, no meeting,” he warned his personal assistant, arriving in the office one morning. On another occasion, she was scandalized when I said he had asked me for another tazzina. That would be his fifth of the morning, she said. No way. I will make him a decaffeinato.  

“We need to be more communicative,” was one of his refrains. But not too communicative: “We have to speak in an institutional language,” he would say if my drafts got too fruity. Overall, he wanted data protection to descend from its ivory tower and demonstrate its relevance and value in the real world. He likened arid legal opinions to recitals of the Mysteries of the Rosary, which he would recall in monotone solemnity:

Nel primo mistero gaudioso ricordiamo l’annunciazione dell’Angelo a Maria Vergine...

Nel secondo mistero gaudioso ricordiamo la visita di Maria Santissima a Santa Elisabetta...

He worried about parochial jargon being a barrier for reaching out to non-specialists. Data protection was about showing respect for people. It was not an absolute right. It does not block technological progress or public safety or other things that society cares about; it’s essential for ensuring these things are done responsibly and sustainably. Take risks, don’t hide behind consent, but own those risks. Data protection lawyers, Giovanni would say, should not be like the Trappist monk from Non ci resta che piangere who appears from nowhere to harangue the unsuspecting Massimo Troisi with a reminder of his mortality: Ricordati che devi morire! Engage with the policy, and be persuasive.

Giovanni’s priority as supervisor was to be more "conversant with technology." So in the first year of his mandate, he went to Silicon Valley. He left convinced that the biggest challenge was not compliance with arcane data protection rules. Rather, it was the assumption, across boardrooms, venture capitalists and garage startups, that the only way for digital services to be profitable was to track people, profile and target them. Giovanni began to pepper his talks and articles with the mantra of "the dominant business model," before it became cool to do so. Only latterly did he have the chance to connect with fellow traveler Shoshana Zuboff when, at the beginning of this year, she came to Brussels to unveil her monumental exposé of “Surveillance Capitalism.” At his last public event, a high-powered powwow on privacy and competition that he co-hosted with the German Federal data protection commissioner, each of his fellow panelists echoed the phrase. Giovanni’s diagnosis was no longer eccentric and "out there"; it had become the new orthodoxy.

Giovanni was a policy entrepreneur. He spotted opportunities and threats on the horizon before others did. In 2015, with the data protection world absorbed with the EU General Data Protection Regulation negotiations and the judgments in Schrems and Google Spain, he pitched the concept of "digital ethics." He argued that artificial intelligence and smart-this-that-and-everything challenged not so much privacy as the basic, universal and inviolable right to human dignity. He got the world talking about ethics and technology at the 2018 international conference of privacy commissioners. Now chatter about "ethics and AI" has become so commonplace it risks descending into banality.

Giovanni, following his predecessor Peter Hustinx, saw — again long before it became cool — that privacy in the age of digitisation was inseparable from market power and therefore competition enforcement. It was in his garage, setting off to deliver a speech to antitrust lawyers, that the idea of a "Digital Clearinghouse" was hatched. It would bring together all willing enforcement agencies with responsibilities for digital markets. By July this year, he would share a platform with an outgoing secretary general of the European Commission who called on multiple regulators to act as if they were single regulators, and predicted that the convergence between privacy and competition would be "a running theme" for the next five years.

Giovanni was alone in 2017 in telling us that the novel obsession with "fake news" pointed to an underlying, systemic data protection problem. Data protection was not just about the individual — it was a core safeguard for societal cohesion and democracy itself. It is now cool to say this. There is no greater compliment to the man than that he has others now reading from his playbook.

It was on such broad canvasses that Giovanni painted. But what most engaged him were the finer details of legal texts; he was a magistrate probing arguments, teasing out potential ramifications. Watching him in action from close quarters was a great privilege. He would not impose his views but lead you through legal quandaries to a satisfactory conclusion. For several brain-sapping weeks in early summer 2015, he convened marathon sessions with the EDPS’s best lawyers to pick over three competing versions of the GDPR, by then into its fourth year of negotiations (the commission’s original proposal, the European Parliament and Council amendments), along with the EDPS’s own extensive opinion from 2012. The result was a GDPR mobile app juxtaposing the different texts with the EDPS’s advice on how to resolve the discrepancies.

Privacy was his last profession, and he practiced what he preached. He did not burden his closest colleagues with his personal affairs. And he never meddled with mine, except after I told him my wife was expecting again, and he advised us to go buy ourselves a TV. There was no need for him to pry because I know he cared.

The world was robbed of Giovanni too soon. His mind was awash with ideas. Recently, he was finalizing a "manifesto" for the future of privacy. In one of his last messages to me, he said, to paraphrase, “This had better be the best document of all time. I want the whole world talking about it. Balls of steel.” Then, after a pause, “You too are playing with your future with this document. Get it wrong, and you will end up in la merda.” In our final conversations, we spoke about the climate crisis and how technology instead of being part of the solution had instead become part of the problem with its carbon-emitting data-madness and reckless natural resource extraction. He had plans to visit China.

I wish I could remember more. I wish I had written down all his obscure Latin phrases and his tawdry expressions Roman dialect. He has left us with plenty to be getting on with. So many words. Parole, parole. Some receding, others lingering, like ghosts at cockcrow.

Grazie, caro Consigliere.

That never changed. Giovanni was always passionate about and committed to engaging with the wider public and to making the topic of data protection accessible to everybody.

I have always appreciated Giovanni's openness and his positive attitude. Giovanni was a real people’s person. He had a kind and personal word for everyone he worked with.

This openness was characteristic of his approach to work. Giovanni at all times tried to find solutions that suited as many situations and people as possible without losing sight of the importance of data protection.

Giovanni’s efforts were vital in kick-starting the EDPB and its Secretariat. Giovanni and his team were key in the two years leading up to the entry into application of the GDPR and the setting up the EDPB Secretariat. His contributions to the work of the board have been very valuable and important.

We will miss Giovanni’s commitment and leadership, but most of all, we’ll miss the person Giovanni Buttarelli, with whom many of us had the honour to work. 

We wish to express our sincerest condolences to Giovanni’s family. They are in our thoughts.

During that time, we spent many hours in the Borschette plenary meeting room in Brussels, and Giovanni and his EDPS team were always positioned directly opposite and facing the Irish DPC from the far side of the room. Whenever discussions got heated and started to go off track, a wink and a smile over to us from Giovanni would always tell us that all was not yet lost.

Because Giovanni believed in the possible.

That was Giovanni's skill. He had an incredible knowledge of the law he had helped to shape, but more than that he had a gift for understanding what the laws and statutes meant to people in the real world.

Most of all, Giovanni had an incredible generosity. He always had the time to share his insight, always had the time to answer a question, always had time to offer his support to the international data protection community. It was his knowledge and insight that made him a valued and respected colleague, but it was his generosity and warmth that made him a friend. I will miss him."

The first time Giovanni and I met, was in the fall of 1991. This was in the context of the Council Working Party in Brussels set up to look into the first Commission proposal for what eventually became the EU Data Protection Directive. As chairman of the Dutch DPA, I acted as chairman of the Working Party during the Dutch presidency. Giovanni was a member of the Working Party for the Italian Ministry of Justice. As a young magistrate, he had been seconded to the Ministry.

On the second day of a meeting, he told me that he could not stay any longer, as he had been called back for an urgent meeting in Rome. When I asked what the meeting was about, he explained that the Government had decided to take on the Mafia and that his input was required. Although the particular subject has taken more time than expected, it showed that he was involved in big files and knew how to set priorities. During the remaining meetings in Brussels, he was an active participant with a good combination of intelligence, creativity and ambition.

As the key person for data protection in the Ministry of Justice, Giovanni was also involved in the development of the Italian Data Protection Act. When this act was adopted and the Italian DPA was established, it was no surprise that Giovanni was asked to play a central role in it. With Stefano Rodota as the first president of the Garante, he was given large discretion to set up the office and act as its Secretary General.

From 1998 onward, we frequently met in the Article 29 Working Party. Two years before, I had been elected as its first chairman. Stefano Rodota was chosen as its deputy chairman and succeeded me as chairman in 2000. During this entire period, Giovanni played a key supporting role in the work of the group, either or not behind the scenes.

When Rodota left the Garante in 2005, the situation changed considerably for Giovanni, as his chemistry with the new president was more complicated. This was also apparent in the Article 29 Working Party, where Giovanni at some occasions could place a series of footnotes to positions just taken by his president. This in part made him look for an opportunity to continue his career at an international level.

In January 2009, based on a joint decision of the European Parliament and the Council, we began our close working relationship as supervisor and assistant supervisor at EDPS. In my case, it was a second term of five years, in his case it was a first.

In the beginning, he seemed to have problems adjusting to the different political and legal environment. For one thing: no large fleet of service cars, but only transport on the basis of need. I also remember a problem in the first months, when Giovanni had been invited for a private meeting with the Italian president and the most recent annual report at EDPS did not contain his picture. A solution for this problem must have been found very quickly.

On substance, we worked together as a team, virtually always on the basis of consensus. For practical reasons, a system of portfolio’s was developed, where Giovanni was in the lead for supervision and some policy fields, and I would concentrate on more strategic issues, such as the Review of the EU Data Protection framework, and cooperation with other DPA’s. However, all major work at EDPS was done in close harmony and with the support of a very able staff.

Our direct cooperation turned out to last even longer than expected, when the appointment procedure for a new team of Supervisors ran into problems, and we were expected to stay in office for almost another year. However, when I finally stepped down in December 2014, it was to hand over the EDPS office into the good care of Giovanni as my successor and Wojciech Wiewiórowski, the former head of the Polish DPA, as assistant supervisor.

In his term as supervisor, Giovanni has taken a number of initiatives, set out in an ambitious Strategy 2015-2019 “Leading by Example.” Apart from the final steps in the Data Protection Review, which resulted in the GDPR and an equivalent framework for the EU institutions, and the establishment of the European Data Protection Board as a separate legal entity, with a Secretariat provided by the EDPS, the strategy also addressed new subjects.

Among those was a major emphasis on the need for stronger Digital Ethics and a much closer cooperation of all regulators in the digital space, including those active in the field of competition and consumer protection. With these initiatives, Giovanni reached out to new stakeholders and fresh support in a now ongoing global debate.

Indeed, not the least of Giovanni’s accomplishments was that he succeeded in making data protection a global issue. The 40th International Conference of Data Protection and Privacy Commissioners, that took place in Brussels in October 2018, with keynote speakers such as Sir Tim Berners Lee, Director of the World Wide Web consortium, and Tim Cook, CEO of Apple, underlined this perfectly. At the time, I teased Giovanni, saying that Pope Francis was not on the program, but he beat me on this, since an official message from the pope was presented at the public session of the conference.

What Giovanni could not control, however, was the slow but steady progress of the fatal disease that caused his untimely passing away on Tuesday last week, only a few months before the end of his mandate as European Data Protection Supervisor. In a different reality, he might have easily secured a second mandate to finish the work he and his colleagues have initiated. It is now up to others to take on that responsibility.

Apart from all the good qualities mentioned in the various reactions to his death, Giovanni was also a very nice guy, charming and friendly to everyone interested in a good and open conversation. He will be missed by many, not least of course by his family, for many years.

Giovanni, dear friend and colleague, you can now relax and rest in peace. Your legacy is in good hands and will be further developed by others.

He routinely flew in to Washington from Europe, arriving at 4 p.m. (10 p.m. his time) and immediately made a presentation and took intense questions from the audience, after which he thrust himself into a reception, where he made time for me and everyone else. Given his stature and high position, he easily could have played the aloof regulator. But that was not his style — he was as open and considerate a person as I ever have encountered. The fact that he was held in high regard not only by fellow regulators, but also by representatives of the regulated, speaks volumes about what a true mensch he was. He will be sorely missed.

We worked together at the Italian DPA for more than eight years. My room was in the middle between the room of Stefano Rodota, the chairman of the Garante, one of the fathers of the EU privacy, and his room.

Giovanni was a very formal kind of person. He changed a lot in years and thanks to his international role he become more amicable and informal. He was an Italian judge before appointed as secretary general of the authority and this role conditioned his behavior for years. He was a wise and intelligent jurist, as well as a good person with plenty of humanism and empathy. We shared the passion for food and wine, and we always discussed the best restaurants we sampled around the world.

The world will miss a privacy champion and good man. I am losing my former boss and a great friend.

In the decade I have known him, I have always been awed not only by his great intelligence, but also by his warmth and generosity. Whether on or off the podium, Giovanni always had a twinkle in his eye as he dazzled with his brilliance. He will be sorely missed.

Buttarelli expertly and astutely carried a torch passed by the founding generation of privacy and data protection visionaries, including Stefano Rodotà, president of the Italian Garante, where Buttarelli was secretary general, Spiros Simitis, the world’s first data protection commissioner in Hesse, and Peter Hustinx, the first European Data Protection Supervisor, from an age of privacy as a fundamental value in the books to a day of data protection on the ground. It is no coincidence that he was the leader who brought Tim Cook, Apple’s CEO, and Koen Lenaerts, the president of the Court of Justice of the European Union, to the table, recognizing data protection as a prime concern for businesses and jurisprudence alike.

Buttarelli had an uncanny ability to navigate complex institutions and power brokers. Building on the cornerstone that Hustinx placed, he established the EDPS as a center of gravity for policy and regulation, where EU commissioners, the Council of Ministers, the CJEU and members of European Parliament would turn to for advice on drafting, interpreting and implementing the law. 

Buttarelli’s courage over the past couple of years, advancing an incredibly ambitious agenda even as he battled a serious condition, was palpable. Never missing a beat, a smile or a joke, he not only continued to relish the limelight but also greatly increased its intensity with a herculean global commissioners’ conference that saw the CEO of the world’s most valuable company shuttle to Brussels to claim data protection as the defining policy issue of our day.

The 2018 commissioners’ conference was the apotheosis of everything Buttarelli worked toward. And it was grand, including a call to “Choose Humanity: Putting Dignity back into Digital,” the title of his keynote speech. The conference focused on data ethics, an issue Buttarelli chose to highlight long before it swept to the forefront of attention of global media, politicians and the public at large. He realized that far from being a technical compliance issue, data protection defines and preserves our humanity in an age of rampant automation, machine learning and artificial intelligence. Indeed, it is a precondition to many of the fundamental rights so cherished by our liberal democracies, including the freedom of speech, equality before the law, and institutional and corporate accountability.

In the same vein, Buttarelli has long ago identified the interface of data protection and competition as a critical juncture for policymakers. He recognized that in an economy where data is a currency and a critical input to production, aggregators of data will develop enormous market power. He called for antitrust and privacy officials to convene to study, define and implement a common strategy to address the issues that we are now seeing escalating worldwide.

Earlier this year, the IAPP recognized Butteralli with its 2019 Privacy Leadership Award, and the Electronic Privacy Information Center handed him its International Privacy Award. These are just two landmarks in an illustrious career spanning the judiciary, academia and executive branch, in Rome and in Brussels, in a period of time of profound technological, economic and geopolitical change. With the policy discussion about the delicate fabric connecting humanity, technology, data and power just nascent, Butteralli — for many of us, Giovanni — will be sorely missed.  

It is difficult to quantify his legacy in data protection and privacy. He played a role in shaping the field by being one of the drafters of the first Italian Data Protection Code. Giovanni was an European par excellence, and he took on the task of leading the EDPS, influencing and shaping European policy at a crucial time, that of negotiating and adopting the GDPR. He was also a key figure in trans-Atlantic privacy. Not only that he was involved in different roles with both the adoption of the EU-U.S. Safe Harbor and subsequently the Privacy Shield, but he was always keen on ensuring that these two worlds of privacy communicate earnestly and openly with each other. He was a true ambassador.

Giovanni was a man with a vision. If today we are discussing the ethics of personal data processing in Al, machine learning, big data, this is because Giovanni placed ethics as the cornerstone of his first mandate as Supervisor. His efforts culminated with the extraordinary international conference on "Debating Ethics". If we are seeing competition law, data protection law and consumer protection law being more and more intertwined in real governance, this is also because some years ago Giovanni saw how the three fields will shape human society and pushed for setting up the Digital Clearinghouse, ensuring the relevant authorities talk to and learn from each other.

But above all, Giovanni was a kind leader and a mentor to many of us. His passion and energy inspired generations of "European Data Protection geeks," as he fondly called us. He will be dearly missed.

Over the years, I felt ever-increasing respect for his passion, humanity and unstinting devotion to data protection, and the demands he put on others were never as high as the standards he set for himself. This culminated in his selection as European Data Protection Supervisor, where his achievements included strengthening the global role of the EDPS, issuing an app with drafting suggestions for the GDPR, creating the EDPS ethics advisory group, and hosting the 40th International Conference of Data Protection and Privacy Commissioners in Brussels in 2018. Indeed, his early work in digital ethics shows what a visionary he was. I am terribly saddened to lose such a good friend but am sure that he would want us to focus our energies on advancing his legacy. Si monumentum requiris, circumspice.

There are times when setbacks help hone the skills of the person. Giovanni’s mandate was delayed for a year. He and the other candidates for the European Data Protection Supervisor position were rejected at first, and a new posting took place. Giovanni responded by creating a fully formed picture of what his mandate could achieve. So, when he was named, he could move forward immediately. He truly had a plan for what needed to be achieved before 2020.

Christian mentioned Giovanni’s skills at listening to people. He was always testing his views and doing so in the context of the reality. He also was testing what is achievable and how it can be achieved. An effective leader is one who thinks to the future but speaks a step ahead of the present. He saw the shortcomings in emerging law to deal with the innovation of an observational society that drives analytics and concretely laid the pathway to ethics being an essential piece of filling that gap in data protection. His global reach can be seen in guidance published on ethical artificial intelligence in Singapore and Hong Kong.

So, in the end, we will miss Giovanni even more than we currently think we will. Giovanni made institutions better by having forward-looking vision and the skill to institutionalize that vision. Giovanni established a legacy, but that legacy requires special skills to nurture. Giovanni, and Peter Hustinx before him, nurtured a generation of data protection policy developers. My hope is that this next generation will become practical implementers of the Buttarelli vision.

With a trademark smile and a mischievous twinkle in his eyes, Giovanni knew how to listen to people from idealist academics to industry lobbyists and to cajole them to seek practical solutions that were true to data protection principles. Over the years, Giovanni's intellect, good judgment and personal warmth made him an extraordinarily important cornerstone in the construction of international privacy rules and norms and a beloved member of the international data protection community. Giovanni's memory and legacy are sure to be an important influence on data protection and civil rights around the world for many years to come. A dieu mon ami, à dieu.

With the loss of Giovanni, we have lost a great man and a superstar in our data protection field. His thoughtful approach and passionate care of things dear to him, is reflected not just in his work, but more powerfully in his fabulous children who themselves are wonderful, thoughtful and accomplished people. His charisma and formidable presence have always delighted and amazed me and I especially loved seeing him with his beautiful and accomplished wife. They were a dazzling couple. I send my thoughts and prayers to his wife and children, to his lucky EDPS family, who got to work daily with him, to his European DPA family, and to the larger data-protection community. We admired and loved him. We were and are thankful for him. And, we will miss him so much.

But, while Giovanni won us with his charm and elegance, he challenged us with his thought. I sometimes see European data protection practice as too much about compliance — focusing narrowly on what the text says and checking boxes, That was not so under Giovanni's tutelage. His opinions as European Data Protection Supervisor were grounded in legal erudition but looked at the spirit of the law and the broader implications of the issue. And in his early focus on ethics and human dignity, he reminded us that the really hard questions in privacy and data protection cannot be answered adequately by text or compliance checklists; they call for understanding what is just and right. Over these past 18 months, peaking with his tour de force at the ICDDPC conference in Brussels last year, Giovanni quite literally poured his life into this vision.

One definition of judicious is "having, showing, or done with good judgment or sense." Those of on who knew Giovanni will smile, recognizing the aptness of this description. To be judicious requires listening carefully and sympathetically to differing perspectives. That was emphatically true for Giovanni — he engaged deeply, over many years, with the approach to privacy technelogy taken within the U.S., while remaining an exemplar of the European approach to these issues. To be judicious also requires an understanding of the fundamental principles at stake. Here, as well, Giovanni earned recognition. He embodied the necessity of considering ethics and fundamental rights jurisprudence as we build the institutions of en information age. Believing deeply in fundamental principles, while being open to the perspective of others—that is judiciousness, indeed.

As a person, Giovanni in my experience was unfailingly kind, polite, and a good listener. The privacy community around the world has lost this man of good judgment and sense. We honor his memory, and can aspire to that good judgment and sense as we face new challenges in our field.

Though there are too many memories to be listed here from the many encounters I was lucky to have with him, I would only mention a few special occasions very briefly.

First: a sold-out IAPP European Data Protection Congress in Brussels. The year was 2014. I was nervous; participating in this conference as a legal counsel for a major stock-listed corporation, in my age group (25-plus), was for me something huge. Filled with both excitement and enthusiasm, I sat in the grand hall where Buttarelli gave his remarks at the Closing General Session. He spoke about the plurality of values at stake: freedom of expression, freedom to conduct business, but also right to security — “values,” as I wrote down his remarks onto my notebook. This was his positive “spell” that would always make a difference.

Second, in 2016, it was another notebook at another privacy event, this time in Washington, D.C. It was early April, and the cherry trees were barely in blossom. I was in town because I was to receive my IAPP student scholarship award. Again, filled with much excitement as I was, I listened to Buttarelli speaking on panels, first on big data, then on the GDPR and Privacy Shield. “Our commonly held principles and standards of conduct are being influenced by the rapidly changing digital landscape” was his framing of this picture that I wrote down from his remarks. Brilliantly intelligent, it was no doubt. Also, off-stage, whether from sharing best practices on how to counter the heavy jet-lag or on how to write about data protection matters, it was obvious that he was someone who also perceived everybody also very humbly and humanly. He also drew much influence from his experiences from the Italian judiciary. I couldn’t help at noting the catchy phrases in Latin he cultivated in his allocutions: “errare humanum est, perseverare diabolicum,” and “regus sic stantibus.” He never seemed to lose sight of the goal.

As European Data Protection Supervisor, he opted toward consistency as key to his work. And not only in terms of regulation, but his words were powerful also in terms of the ethics.

Buttarelli leaves to us a rich legacy, whether in terms of formal allocations, ethics or his interaction with others. Even with the most difficult issues, he framed them with a calmness and sophistication. He truly embraced both walking the road and knowing the end direction.

It is, above all, his profound humanity that remains. A true uomo universale of our privacy and data protection century.