Christian D'Cunha, European Data Protection Supervisor, Head of the Private Office

He was entitled to be confident, and not only because of his debonair demeanor. He had a global fan base, the extent of which we are only beginning to fathom, as the tributes come flooding in. But a more important endowment was his self-doubt. He concealed it expertly, but I believe it was what made him intensely sensitive to what other people thought and said and what gave him his insatiable hunger always to do more and do better.

Thanks to him, our floor was suffused with the smell of proper coffee. “No coffee, no meeting,” he warned his personal assistant, arriving in the office one morning. On another occasion, she was scandalized when I said he had asked me for another tazzina. That would be his fifth of the morning, she said. No way. I will make him a decaffeinato.

“We need to be more communicative,” was one of his refrains. But not too communicative: “We have to speak in an institutional language,” he would say if my drafts got too fruity. Overall, he wanted data protection to descend from its ivory tower and demonstrate its relevance and value in the real world. He likened arid legal opinions to recitals of the Mysteries of the Rosary, which he would recall in monotone solemnity:

Nel primo mistero gaudioso ricordiamo l’annunciazione dell’Angelo a Maria Vergine...

Nel secondo mistero gaudioso ricordiamo la visita di Maria Santissima a Santa Elisabetta...

He worried about parochial jargon being a barrier for reaching out to non-specialists. Data protection was about showing respect for people. It was not an absolute right. It does not block technological progress or public safety or other things that society cares about; it’s essential for ensuring these things are done responsibly and sustainably. Take risks, don’t hide behind consent, but own those risks. Data protection lawyers, Giovanni would say, should not be like the Trappist monk from Non ci resta che piangere who appears from nowhere to harangue the unsuspecting Massimo Troisi with a reminder of his mortality: Ricordati che devi morire! Engage with the policy, and be persuasive.

Giovanni’s priority as supervisor was to be more "conversant with technology." So in the first year of his mandate, he went to Silicon Valley. He left convinced that the biggest challenge was not compliance with arcane data protection rules. Rather, it was the assumption, across boardrooms, venture capitalists and garage startups, that the only way for digital services to be profitable was to track people, profile and target them. Giovanni began to pepper his talks and articles with the mantra of "the dominant business model," before it became cool to do so. Only latterly did he have the chance to connect with fellow traveler Shoshana Zuboff when, at the beginning of this year, she came to Brussels to unveil her monumental exposé of “Surveillance Capitalism.” At his last public event, a high-powered powwow on privacy and competition that he co-hosted with the German Federal data protection commissioner, each of his fellow panelists echoed the phrase. Giovanni’s diagnosis was no longer eccentric and "out there"; it had become the new orthodoxy.

Giovanni was a policy entrepreneur. He spotted opportunities and threats on the horizon before others did. In 2015, with the data protection world absorbed with the EU General Data Protection Regulation negotiations and the judgments in Schrems and Google Spain, he pitched the concept of "digital ethics." He argued that artificial intelligence and smart-this-that-and-everything challenged not so much privacy as the basic, universal and inviolable right to human dignity. He got the world talking about ethics and technology at the 2018 international conference of privacy commissioners. Now chatter about "ethics and AI" has become so commonplace it risks descending into banality.

Giovanni, following his predecessor Peter Hustinx, saw — again long before it became cool — that privacy in the age of digitisation was inseparable from market power and therefore competition enforcement. It was in his garage, setting off to deliver a speech to antitrust lawyers, that the idea of a "Digital Clearinghouse" was hatched. It would bring together all willing enforcement agencies with responsibilities for digital markets. By July this year, he would share a platform with an outgoing secretary general of the European Commission who called on multiple regulators to act as if they were single regulators, and predicted that the convergence between privacy and competition would be "a running theme" for the next five years.

Giovanni was alone in 2017 in telling us that the novel obsession with "fake news" pointed to an underlying, systemic data protection problem. Data protection was not just about the individual — it was a core safeguard for societal cohesion and democracy itself. It is now cool to say this. There is no greater compliment to the man than that he has others now reading from his playbook.

It was on such broad canvasses that Giovanni painted. But what most engaged him were the finer details of legal texts; he was a magistrate probing arguments, teasing out potential ramifications. Watching him in action from close quarters was a great privilege. He would not impose his views but lead you through legal quandaries to a satisfactory conclusion. For several brain-sapping weeks in early summer 2015, he convened marathon sessions with the EDPS’s best lawyers to pick over three competing versions of the GDPR, by then into its fourth year of negotiations (the commission’s original proposal, the European Parliament and Council amendments), along with the EDPS’s own extensive opinion from 2012. The result was a GDPR mobile app juxtaposing the different texts with the EDPS’s advice on how to resolve the discrepancies.

Privacy was his last profession, and he practiced what he preached. He did not burden his closest colleagues with his personal affairs. And he never meddled with mine, except after I told him my wife was expecting again, and he advised us to go buy ourselves a TV. There was no need for him to pry because I know he cared.

The world was robbed of Giovanni too soon. His mind was awash with ideas. Recently, he was finalizing a "manifesto" for the future of privacy. In one of his last messages to me, he said, to paraphrase, “This had better be the best document of all time. I want the whole world talking about it. Balls of steel.” Then, after a pause, “You too are playing with your future with this document. Get it wrong, and you will end up in la merda.” In our final conversations, we spoke about the climate crisis and how technology instead of being part of the solution had instead become part of the problem with its carbon-emitting data-madness and reckless natural resource extraction. He had plans to visit China.

I wish I could remember more. I wish I had written down all his obscure Latin phrases and his tawdry expressions Roman dialect. He has left us with plenty to be getting on with. So many words. Parole, parole. Some receding, others lingering, like ghosts at cockcrow.

Grazie, caro Consigliere.

Search resources

Featured resources

IAPP Global Legislative Predictions 2026

Salary and Jobs Report 2025-26: Privacy, AI Governance and Digital Responsibility

Mid-career transitions in privacy, AI governance and cyber

Privacy Curricula in US Law Schools

All IAPP resources

Filter results

Resource type

Subject

Industry

Law and regulation

Domain

Profiles in Privacy — A conversation with Brendon Lynch

Profiles in Privacy – A conversation with Beverly Walker

Building a Privacy Culture: A Conversation with Privacy Program Managers

IAPP 20th Anniversary Board Chair Chat

IAPP 20th Anniversary: Visions of Privacy Report

How to Build a Culture of Privacy

How to maximize your IAPP membership

Celebrating Data Privacy Day with the IAPP Engagement team

How technology is racing ahead of medical ethics and family relationships

In Memoriam: Giovanni Buttarelli, 1957–2019

How I got my start in privacy

How I got my start in privacy - Ryan Barker

How I got my start in privacy: The series

Brendon Lynch on his Vanguard Award win

Privacy In Art: Orwell's 1984

IAPP Privacy Bar Section Announcement

Privacy breeding innovation

People in privacy: New privacy pros

The changing meaning of "personal data"

The IAPP Celebrates its Tenth Anniversary