The current practice of data protection law often fails to meet either the need for protection of the data subjects or the needs of the data-driven economy and data-driven research: on the one hand, control over one's own data is usually pure fiction due to the lack of documentation of given consent, and data subjects cannot effectively enforce their rights against a large number of controllers of largely unknown identity. On the other hand, the fact that consent can be withdrawn at any time as well as ambiguities with regard to the notion of consent being ‘freely’ given, pose considerable obstacles to the longer-term use of data (e.g. for health research). As a possible solution, Wendehorst has been advocating innovative data management and data trust systems for several years. However, this would require some few strong-willed interventions on the part of the legislator.