The law has an ambivalent relationship with the future. It is not only that it is hard to make predictions, especially about the future, but also that a single word (in the future) by the lawmaker can quickly make years of law implementation (and relevant case law and legal theory) obsolete. Notwithstanding incertitude, however, path dependence (“the tendency of institutions or technologies to become committed to develop in certain ways as a result of their structural properties or their beliefs and values”) perhaps helps make predictions a bit less hopeless. It is around these thoughts, and concerns, that the analysis that follows unfolds. Five years have passed after 2018, the annus mirabilis for EU data protection when both the GDPR and the LED became effective, and this anniversary invites a retrospective assessment and a, modest, attempt to look into the future.