Belgian scholar publishes magisterial deep dive into comparative data privacy law across Atlantic

Dr. Sylvia Lissens has published her remarkable dissertation in comparative law as a book, Personal Data Protection in the United States and the European Union (Larcier-Intersentia 2026).

Here is the publisher's description:

In today’s digitized world, personal data is being requested and collected everywhere. With the emergence of the internet and devices that are connected to the internet, such as smartphones, smartwatches or even smart fridges, the collection of personal data has expanded to an unprecedented scale. Personal data flows between the European Union and the United States are occurring on a daily basis, since most U.S. big tech companies sell their devices and offer their services in the EU. Successive deals were made in order to protect citizens’ personal data, but most of them did not survive scrutiny by the Court of Justice of the European Union.

Upon closer inspection, the underlying problem appears to be the different qualifications and frameworks used for personal data (protection) in the EU and the U.S., defining it respectively as a fundamental (human) right and a trade asset. This book addresses the question of what the core differences between the U.S. and EU legal approaches towards personal data (protection) are, where they come from, and whether there are signs of convergence. Functional comparative law research is conducted on three levels to reflect the perspectives of the three main stakeholders: the private sector, civil society and the public sector, focusing on intelligence and law enforcement agencies.

The U.S. and the EU seem to understand and qualify personal data differently in words and deeds, but upon closer inspection they have more in common than may seem at first sight. The findings in this book confirm that it is possible to develop a roadmap for the U.S. and EU legal approaches towards data privacy to coexist, and that convergences can be found at the level of the private sector, civil society, and the public sector intelligence and law enforcement agencies. Data privacy principles developed in different parts of the world and by several organizations share many elements in common. It is time for actors and regions to decide to cooperate and engage in mutual understanding, as the internet does not know any borders in a globalized world.

Dr. Sylvia Lissens is a legal scholar specializing in data protection, international data exchange, and the intersection of technology, security and fundamental rights. Holding master’s degrees in Law and Criminological Sciences, she conducted doctoral research on EU–U.S. data protection and international cooperation at KU Leuven. Through collaborations with the University of Helsinki, Venice International University, Duke University, and the Jagiellonian University of Cracow, she developed expertise in cybersecurity, policing, counterterrorism, and the legal implications of emerging technologies.

The work is magisterial: an astonishingly comprehensive and insightful survey of the history and cultural context of data privacy on the two sides of the Atlantic, unlike any resource before it. I was immensely privileged to learn from Lissens as an adviser from the U.S. side in her work, and as a member of the committee for her defense at KU Leuven in Belgium in 2025. A hat tip to the indispensable support for Dr. Lissens of her significant other, the multi-talented Giovanni C., and to my friend, colleague, and fellow adviser, Professor Przemysław Pałka, Jagiellonian University.

As gratifying a culmination of achievement as this book is, I am even more thrilled to report that Lissens soon will start work as a lawyer and data privacy officer for the Belgian federal police agency. Watch this space for great things to come.

Belgian scholar finds fault on both sides of Atlantic, charts midway course for U.S.-EU data privacy

KU Leuven Profs. Jan Wouters, Evelyne Terryn, and Peggy Valcke; Sylvia Lissens; me; KU Leuven Prof. Marieke Wyckaert, dissertation committee chair; and via Zoom, Prof. Przemysław Pałka, Jagiellonian University, Poland (photo presumed © and used with permission) 

Congratulations to newly minted-Doctor Sylvia Lissens, who defended her dissertation in the Leuven Centre for Global Governance Studies at Katholieke Universiteit (KU) Leuven in Belgium on October 1.

Dr. Lissens's dissertation is The U.S. and EU Approach Towards Personal Data Protection: "A Collision of Tides or a Convergence of Waves?": A Legal Exploration of the Differences and Convergences Between the United States and the European Union. The first paragraph of the dissertation gives a sense of its ambitious scope:

This research addresses the question of what the core differences between the U.S. and EU legal approaches towards personal data (protection) are and if there are signs of convergences. The question is approached through functional comparative law research conducted on three levels to reflect the perspectives of the three main stakeholders: the private sector, civil society, and the public sector, consisting of government intelligence and law enforcement agencies. The United States and the European Union seem to understand and qualify personal data differently in words and deeds, but upon closer inspection they have more in common than may seem at first sight. Consequently, it was possible to develop a roadmap for how the U.S. and EU approaches can co-exist, based on the convergences between the U.S. and EU approaches towards data privacy on all three levels.

I have learned and benefited immensely from serving on Lissens's dissertation committee for about the last five years. I myself posited a convergence in the data privacy expectations of American and European people many years ago, before the EU General Data Protection Regulation (GDPR) superseded its predecesor EU Data Protection Directive. I dared not then conceive a practical framework for a U.S. "adequacy" determination under what became the GDPR, which is the aim of Dr. Lissens's work. 

Faculty of Law at KU Leuven, Belgium
RJ Peltz-Steele CC BY-NC-SA 4.0

The dissertation is especially bold by European standards for suggesting that the EU might have to trim the sails of the GDPR to meet the United States partway. Most works in this vein take the GDPR at face value as a favorable norm. Lissens rather criticizes the GDPR for exporting worldwide norms with almost imperial ferocity, thus failing to give legal regimes and cultural communities around the world an opportunity to develop data privacy standards that might be qualitatively different or appropriately more or less protective of personal liberty. This critique resonates with contemporary critical perspectives in comparative law, which might note that the individualist model of privacy right that the GDPR promotes discounts the prominence of collectivist values in non-European legal systems.

On October 1, Lissens defended her theses ably against healthy skepticism both from European interrogators and from me. I asked whether the hodgepodge of U.S. state data protection systems, as long as Congress remains paralyzed, can possibly be GDPR "adequate" when the state systems reach only consumer transactions. 

Consumer privacy is mostly what the GDPR is worried about, Lissens reasoned, and the EU might have to settle for the states' laboratory approach. Contrary to what I have witnessed as the prevailing ethos among young people in Europe, Lissens argued that European people might have to become comfortable with the notion known to U.S. law that being photographed in a public place is not a privacy violation.

On the national security front, Lissens, like EU courts and human rights advocates, finds plenty cause for concern in dragnet U.S. security surveillance. But she also calls out EU member states for national security practices that are not so different from American methods.

I asked Lissens whether the U.S.-EU Data Privacy Framework can hold up when it does not require the United States to divulge to European complainants how their privacy was compromised or what was done about it. She fairly answered that European citizens usually can expect nothing more from their own governments. 

Moreover, Lissens questions the competence of European courts in the EU treaty system to apply data protection law at all to the national security apparatuses of EU member states, much less to challenge U.S. policy. While she has admiration for the work of European privacy advocates such as Max Schrems, she challenges the very premise of the Schrems decisions in the EU Court of Justice insofar as they assumed jurisdiction over national security policy by way of data protection enforcement.

Among Lissens's distinguished credentials is a 2020-21 stint at Duke University, my alma mater in law, where she held a scholarship to study as a master's student and started adding expertise in U.S. law to her multi-jurisdictional expertise. Lissens, who herself has taught comparative law and graciously visited my class in the past via Zoom, is on the academic job market. She is a gifted scholar and teacher, so schools, place your bids.

Lissens presents EU data protection, IoT research

Sylvia Lissens, a Ph.D. student and teaching assistant at the KU Leuven Centre for Global Governance Studies in Belgium, presented part of her doctoral research comparing U.S. and EU data protection law at a doctoral seminar in Lyon, France, in December.

In her research, Lissens focuses on the internet of things (IoT) to examine how American and European law protects the personal data that machines increasingly collect. She has a law degree from KU Leuven and a background in criminology, so is especially interested in government access to personal data, which has been a sticking point in trans-Atlantic privacy negotiations.

Looking at the emerging norms in state legislation in the United States, on the one hand, and at developing data protection jurisprudence in the European Union, on the other hand, Lissens hopes to identify points of convergence and divergence that might smooth the way forward for agreement over data flows.

In Lyon, Lissens presented findings from the EU leg of her research at the International Doctoral Seminar in European and International Human Rights Law, hosted by the Université Jean Moulin Lyon 3. She explained how the broad range of data collected by devices in our homes, from phones to refrigerators, will confront national security and international trade regimes with new challenges in the protection of personal privacy.

Comparative law is among Lissens's teaching responsibilities at KU Leuven. She joined my Comparative Law class by Zoom this semester to provide an EU perspective on contemporary European legal issues. Students' experience was greatly enriched by both her experience as a professional and her informed perspectives as a Belgian voter. I'm privileged to serve on Lissens's dissertation committee.