ta processing. With reference to the recitals and the objective of the directive, the Court of Justice concludes that the harmonisation of the national laws regarding the protection of personal data is not limited to minimal harmonisation, but amounts to harmonisation which is generally complete. According to the Court of Justice of the European Union, the relevant provisions in Arts. 6 and 7 of Directive 95/46/EC are unconditional, exhaustive and restrictive and must be applied consistently throughout the EU. The Member States may neither fall short of nor exceed its requirements (cf. CJEU, Judgment of 20 May 2003, Österreichischer Rundfunk and Others, C-465/ 00, C-138/01 and C-139/01, EU:C:2003:294, para. 100; Judgment of 6 November 2003, Lindqvist, C-101/01, EU:C:2003:596, para. 95 et seq.; Judgment of 16 December 2008, Huber, C-524/06, EU:C:2008:724, paras. 51 and 52; Judgment of 24 November 2011, ASNEF and FECEMD, C-468/10 and C-469/10, EU:C:2011:777, para. 28 et seq.; Judgment of 7 November 2013, IPI, C-473/12, EU:C:2013:715, para. 31; Judgment of 19 October 2016, Breyer, C-582/14, EU:C:2016:779, para. 57; Judgment of 29 July 2019, Fashion ID, C-40/17, EU:C:2019:629, paras. 54 and 55). Accordingly, the Court of Justice of the European Union holds that the concept of necessity laid down by Art. 7 lit. e of Directive 95/46/EC, which requires specification, has its own independent meaning in EU law that cannot vary between the Member States (cf. CJEU, Judgment of 16 December 2008, Huber, C-524/06, EU:C:2008:724, para. 52). Currently, there is no need to decide whether these considerations by themselves are a sufficient basis for assuming that legislation is fully harmonised, or whether such an assumption would require a more solid basis given that the directive also contains indications to the contrary (cf. Recital 9 and Art. 5 of Directive 95/46/EC). In any case, this interpretation of the directive was confirmed through the enactment of the General Data Protection Regulation by the EU legislator as the politically responsible body, thus creating legal certainty. While the General Data Protection Regulation was not yet applicable at the time of the Higher Regional Court decision, it had already been finally adopted and had entered into force pursuant to Art. 99(1) GDPR. In light of the GDPR, the interpretation of the directive as “fully harmonising” the substantive requirements for the processing of personal data can be regarded as sufficiently certain. 40 bb) As the law currently stands, with the GDPR being applicable, it must be assumed all the more that the matter in question is fully harmonised; if the challenged decision were reversed and remanded to the Higher Regional Court, the court would have to observe the GDPR. In enacting the GDPR, the EU chose a regulation to create directly applicable law in all Member States so as to counter fragmentation in the implementation of data protection law across the EU and to better give effect to a consistent level of data protection throughout the EU (cf. Recitals 9 and 10 GDPR). While the GDPR does contain an opening clause on giving shape to the “media privilege” (Art. 85(2) GDPR) and, in various regards, even allows Member States – subject to notification – exemptions on certain points, it is not ascertainable that such 41 7/36