RETHINKING EUROPEAN CYBERSECURITY INTEGRATION THROUGH LIBERAL INTERGOVERNMENTAL POLITICS IN GENERAL DATA PROTECTION REGULATION ENFORCEMENT STUDY
Main Article Content
Abstract
The phenomenon of cyberattacks and data breaches in the EU has led to the implementation of the General Data Protection Regulation (GDPR) in 2018. However, this regulation could turn the supranational institution into a sovereign-based decision-making body and shift people's behavior toward enforcing data protection rules. This study investigates how the European Union implemented its strategy to enforce cybersecurity mechanisms between its member states through data protection regulations. This study employs a qualitative case study approach and collects data from 285 enforcement reports, five binding reports from the EDPB, and two unstructured interviews. We used reflexive thematic analysis to obtain the meaning of each report and each interview. The results reveal that supervisory authorities exercise power and create national and regional preferences that follow individuals and companies in the enforcement of data protection mechanisms in the EU. The study finds that Germany and France share the power to require multinational companies and public entities to comply with data protection rules across the EU. According to the thematic analysis, three themes emerge from the data collected in France and Germany: harmonization of Data Protection and cybersecurity, blending of enforcement, balancing Sovereignty and integration, and protecting national values through EU mechanisms. It shows that the EU’s cybersecurity strategy aligns with the principles of Liberal Intergovernmentalism, in which each member state negotiates its preferences through the EDPB and between member states, rather than with the principles of functionalism, in which institutions cooperate voluntarily through spillover mechanisms.
JEL Classification Codes: F52, F51, K24.
Downloads
Article Details
Section

This work is licensed under a Creative Commons Attribution 4.0 International License.
How to Cite
References
Andress, J., & Winterfield, S. (2011). Cyber Warfare: Techniques, Tactics and Tools for Security Practitioners. Elsevier. https://doi.org/10.1016/C2010-0-66971-9
Arquilla, J., & Ronfeldt, D. (1997). In Athena’s Camp: Preparing for Conflict in the Information Age (1st ed.). RAND Corporation.
Barrinha, A., & Christou, G. (2022). Speaking Sovereignty: The EU in the cyber domain. European Security, 31(3), 356–376. https://doi.org/10.1080/09662839.2022.2102895
Barrinha, A., & Turner, R. (2024). Strategic narratives and the multilateral governance of cyberspace: The cases of European Union, Russia, and India. Contemporary Security Policy, 45(1), 72–109. https://doi.org/10.1080/13523260.2023.2266906
Bellanova, R., Carrapico, H., & Duez, D. (2022). Digital/sovereignty and European security integration: An introduction. European Security, 31(3), 337–355. https://doi.org/10.1080/09662839.2022.2101887
Bjola, C., & Zaiotti, R. (2020). Digital Diplomacy and International Organisations: Autonomy, Legitimacy and Contestation (C. Bjola & R. Zaiotti, Eds.; 1st ed.). Routledge. https://doi.org/10.4324/9781003032724
Bora, S. I. (2023). ‘A Sovereign Europe’? Strategic Use of Discourse at the Service of French Economic Interests in EU Politics (2017–2022). JCMS: Journal of Common Market Studies, 61(5), 1281–1297. https://doi.org/10.1111/jcms.13463
Braun, V., & Clarke, V. (2021). Thematic Analysis: A Practical Guide (1st edition). Sage Publication.
Bergmann, J. (2019). Neofunctionalism and EU external policy integration: the case of capacity building in support of security and development (CBSD). Journal of European Public Policy, 26(9), 1253–1272. https://doi.org/10.1080/13501763.2018.1526204
Carrapico, H., & Barrinha, A. (2018). European Union cyber security as an emerging research and policy field. European Politics and Society, 19(3), 299–303. https://doi.org/10.1080/23745118.2018.1430712
Carver, J. (2024). More bark than bite? European digital sovereignty discourse and changes to the European Union’s external relations policy. Journal of European Public Policy, 31(8), 2250–2286. https://doi.org/10.1080/13501763.2023.2295523
Dunn Cavelty, M. D. (2008). Cyber-security and Threat Politics: US Effort to secure the information age. Routledge. Retrieved from https://www.routledge.com/Cyber-Security-and-Threat-Politics-US-Efforts-to-Secure-the-Information-Age/Dunn/p/book/9780415569880?srsltid=AfmBOoqb7nRK_otjjknintzPjtFr-P35idfkBd8mkgLhJuXBc9sDDEI_
Dunn Cavelty, M. D., & Wenger, A. (2022). Cyber Security, Politics, Socio-Technological Transformations, and Political Fragmentation. Routledge.
Ciulla, M., & Varma, T. (2021). The lonely leader: The origins of France’s strategy for EU foreign policy. European Council on Foreign Relations. Retrieved from https://ecfr.eu/article/the-lonely-leader-the-origins-of-frances-strategy-for-eu-foreign-policy/
European Commission. (2020). SHAPING EUROPE’S DIGITAL FUTURE. Retrieved from https://share.google/TEP6oGmv7J7mpIb9Q
Cymutta, S. (2020). National Cybersecurity Organisation: Germany.
Daras, N. (2019). Cyber-Security and Information Warfare.
Davies, P. (2022). France election: How Macron and Le Pen’s pledges for tech, cybersecurity, and social media compare. Euro News. Retrieved from https://www.euronews.com/next/2022/04/20/french-election-how-macron-and-le-pen-s-pledges-for-tech-cybersecurity-and-social-media-co
Di Salvo, P., & Negro, G. (2016). Framing Edward Snowden: A comparative analysis of four newspapers in China, United Kingdom and United States. Journalism, 17(7), 805–822. https://doi.org/10.1177/1464884915595472
Ewane, G. (2025). Norway’s Immigration Policies and the Influence of Europeanisation.
Farrand, B., Carrapico, H., & Turobov, A. (2024). The new geopolitics of EU cybersecurity: Security, economy and Sovereignty. International Affairs, 100(6), 2379–2397. https://doi.org/10.1093/ia/iiae231
Finnemore, M., & Hollis, D. B. (2016). Constructing Norms for Global Cybersecurity. American Journal of International Law, 110(3), 425–479. https://doi.org/10.1017/S0002930000016894
Schimmelfennig, F. (2024). Crisis and polity formation in the European Union. Journal of European Public Policy, 31(10), 3396-3420. https://doi.org/10.1080/13501763.2024.2313107
Freudlsperger, C., & Jachtenfuchs, M. (2021). A member state like any other? Germany and the European integration of core state powers. Journal of European Integration, 43(2), 117–135. https://doi.org/10.1080/07036337.2021.1877695
Fuchs, T. A. E. (2018). The Limits of European Integration Theories: Cyber-Development and the Future of the European Union. In: Carayannis, E., Campbell, D., Efthymiopoulos, M. (eds) Handbook of Cyber-Development, Cyber-Democracy, and Cyber-Defense. Springer, Cham. https://doi.org/10.1007/978-3-319-09069-6_62
Gagnon, Y.-C. (2010). The Case Study as Research Method: A Practical Handbook. Presses de Universite du Quebec.
Geers, K. (2011). STRATEGIC CYBER SECURITY. CCD OOE Publication.
Genschel, P., & Jachtenfuchs, M. (Eds.). (2013). Beyond the Regulatory Polity?: The European Integration of Core State Powers. Oxford University Press. https://doi.org/10.1093/acprof:oso/9780199662821.001.0001
Genschel, P., & Jachtenfuchs, M. (2016). More integration, less federation: The European integration of core state powers. Journal of European Public Policy, 23(1), 42–59. https://doi.org/10.1080/13501763.2015.1055782
Hansel, M. (2023). Great power narratives on the challenges of cyber norm building. Policy Design and Practice, 6(2), 182–197. https://doi.org/10.1080/25741292.2023.2175995
Haroche, P. (2023). A ‘Geopolitical Commission’: Supranationalism Meets Global Power Competition. JCMS: Journal of Common Market Studies, 61(4), 970–987. https://doi.org/10.1111/jcms.13440
Hilden, J. (2019). The Politics of Datafication: The Influence of Lobbyist on the EU’s Data Protection Reform and its Consequences for Legitimacy of the GDPR. Doctoral Dissertation. Retrieved from https://helka.helsinki.fi/discovery/fulldisplay/alma9932988073506253/358UOH_INST:VU1
Jancuite, L. (2020). European Data Protection Board: A nascent EU agency or an ‘intergovernmental club’? International Data Privacy Law, 10(1), 57–75. https://doi.org/10.1093/idpl/ipz021
Juned, M., Martin, A., & Pratama, N. (2024). Bjorka’s Hacktivism in Indonesia: The Intercourse Paradox of Cyberdemocracy, Cyberactivism, and Cybersecurity. Academic Journal of Interdisciplinary Studies, 13(5), 369. https://doi.org/10.36941/ajis-2024-0171
Karjalainen, T. (2022). The battle of power: Enforcing data protection law against companies holding data power. Computer Law & Security Review, 47, 105742. https://doi.org/10.1016/j.clsr.2022.105742
Kasper, A., & Osula, A.-M. (2023). ‘Spill Over’ and ‘Fail Forward’ in the EU’s Cybersecurity Regulations. In D. Ramiro Troitiño, T. Kerikmäe, & O. Hamuľák (Eds.), Digital Development of the European Union: An Interdisciplinary Perspective (pp. 21–44). Springer International Publishing. https://doi.org/10.1007/978-3-031-27312-4_3
Kohler, C. (2020). The EU Cybersecurity Act and European standards: An introduction to the role of European standardization. International Cybersecurity Law Review, 1(1–2), 7–12. https://doi.org/10.1365/s43439-020-00008-1
Lamont, C. (2021). Research Methods in International Relations (Second Edition). Sage Publication.
Liebetrau, T. (2024). Problematising EU Cybersecurity: Exploring How the Single Market Functions as a Security Practice. JCMS: Journal of Common Market Studies, 62(3), 705–724. https://doi.org/10.1111/jcms.13523
Lubis, Setiyono, B., Kushandajani, & Sardini, N. H. (2025). THE STRUCTURE AND STRATEGY OF LOCAL STRONGMEN IN THE DEFEAT OF INDEPENDENT CANDIDATES: A QUALITATIVE STUDY. Bangladesh Journal of Multidisciplinary Scientific Research, 10(5), 12–19. https://doi.org/10.46281/4kz2g758
Lynskey, O. (2017). The ‘Europeanisation’ of Data Protection Law. Cambridge Yearbook of European Legal Studies, 19, 252–286. https://doi.org/10.1017/cel.2016.15
Major, C., & Molling, C. (2018). Franco-German Differences Over Defense Make Europe Vulnerable.
Mantelero, A. (2013). Competitive value of data protection: The impact of data protection regulation on online behaviour. International Data Privacy Law, 3(4), 229–238. https://doi.org/10.1093/idpl/ipt016
Mueller, M. L. (2010). Networks and States: The Global Politics of Internet Governance. The MIT Press. https://doi.org/10.7551/mitpress/9780262014595.001.0001
Mushaben, J. M. (2022). Against All Odds: Angela Merkel, Ursula von der Leyen, Anngret Kramp-Karrenbauer and the German Paradox of Female CDU Leadership. German Politics, 31(1), 20–39. https://doi.org/10.1080/09644008.2021.2000599
Munkoe, M., & Molder, H. (2022). Cybersecurity in the era of hypercompetitiveness: can the EU meet the new challenges?. Revista CIDOB d’Afers Internacionals, 131, 69-92. Retrieved from https://www.jstor.org/stable/27186235
Nicoli, F. (2020). Neofunctionalism revisited: integration theory and varieties of outcomes in the Eurocrisis. Journal of European Integration, 42(7), 897–916. https://doi.org/10.1080/07036337.2019.1670658
Pohle, J. (2020). Digital Sovereignty. A new key concept of digital policy in Germany and Europe.
Ruohonen, J. (2024). The Incoherency Risk in the EU’s New Cyber Security Policies. https://doi.org/10.48550/ARXIV.2405.12043
Schallbruch, M., & Skierka, I. (2018). The Organisation of Cybersecurity in Germany. In Cybersecurity in Germany (pp. 31-47). Cham: Springer International Publishing. https://doi.org/10.1007/978-3-319-90014-8
Schramm, L., & Krotz, U. (2024). Leadership in European crisis politics: France, Germany, and the difficult quest for regional stabilization and integration. Journal of European Public Policy, 31(5), 1153–1178. https://doi.org/10.1080/13501763.2023.2169742
Siegel, C. A., & Sweeney, M. (2020). Cyber strategy: risk-driven security and resiliency. Auerbach Publications.
Steiger, S., Schunemann, W. J., & Dimmroth, K. (2017). Outrage without Consequences? Post-Snowden Discourses and Governmental Practice in Germany. Media and Communication, 5(1), 7–16. https://doi.org/10.17645/mac.v5i1.814
Staunton, T. (2025). An exploration of tensions amongst career guidance practitioners when it comes to the conceptualisation of digital technology. International Journal for Educational and Vocational Guidance, 1–17. https://doi.org/10.1007/s10775-024-09722-2
Börzel, T. A., & Risse, T. (2019). Grand theories of integration and the challenges of comparative regionalism. Journal of European Public Policy, 26(8), 1231-1252. https://doi.org/10.1080/13501763.2019.1622589
Weiss, M., & Krieger, N. (2025). The political economy of cybersecurity: Governments, firms and opportunity structures for business power. Contemporary Security Policy, 46(3), 403–428. https://doi.org/10.1080/13523260.2025.2474867
Wiliarty, S. E. (2011). Gender and energy policy making under the first Merkel government. German Politics, 20(3), 449–463. https://doi.org/10.1080/09644008.2011.614841
Willsher, K., & Henley, J. (2017). Emmanuel Macron’s campaign hacked on eve of French election. Retrieved from https://www.theguardian.com/world/2017/may/06/emmanuel-macron-targeted-by-hackers-on-eve-of-french-election
Yannakogeorgos, P. A., & Lowther, A. B. (Eds.). (2013). Conflict and Cooperation in Cyberspace: The Challenge to National Security (0 ed.). CRC Press. https://doi.org/10.1201/b15253
Yanwardhana, E. (2023). Jokowi: Data Adalah “New Oil” yang Berharga & Tidak Terhingga. CNBC Indonesia.
Yin, R. K. (2009). Case Study Research: Design and Methods (3rd ed.). Sage Publication.
Zisan, T. H. (2021). ANALYZING THE STATUS OF WOMEN IN E-GOVERNANCE ERA OF BANGLADESH: CHALLENGES AND POTENTIALS. Bangladesh Journal of Multidisciplinary Scientific Research, 3(2), 1-10. https://doi.org/10.46281/bjmsr.v3i2.1169