2009 was a year of change - both actual and promised - in the legal framework governing data protection. The Lisbon Treaty embedded data protection as a fundamental right of European Union citizens. It provided the basis for an extension of data protection rights into all areas of EU activity. It gave new authority to the European Parliament as co-legislator in this area.