A public body asks whether GDPR principles echo earlier Directive 95/46 themes. Which answer is most accurate?

Core data-protection principles show continuity from the Directive 95/46 era into the GDPR—evolution and strengthening, not total reinvention from zero. Public bodies can map legacy knowledge of fairness, purpose limitation, data quality, and security into Article 5 while recognising new emphases such as accountability, stronger rights, and tougher enforcement under a directly applicable regulation. The GDPR did not invent fairness, purpose limitation, and security as brand-new ideas with no Directive ancestry. Directive 95/46 principles were not limited to agricultural subsidies. They were not abolished and replaced by cookie-consent colour codes alone. Exam caveat: continuity-versus-reinvention questions reward recognising familiar principles upgraded by the GDPR’s architecture. Operational check: when migrating a Directive-era records schedule, retain principle mapping tables (purpose, retention, security) and add GDPR-specific accountability artefacts such as records of processing and DPIA triggers rather than discarding prior controls as obsolete. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion.