Franziska Boehm’s research while affiliated with University of Luxembourg and other places

... Another crucial example is "vertical mixity", an expression that points at international agreements split between EU substantive regulation and Member State implementation, which is fictitious according to García Andrade: "since the treaty-making power is a normative power, the Union will be entitled to conclude these agreements alone, either for being a field of exclusive EU competence in the case of short-term visas, or a concurrent competence that the EU may exercise in the case of readmissions" (2019: 45 Before the Treaty of Lisbon was adopted, the European Community lacked a legal basis that it could have relied upon to legislate in the field of personal data. This gap did not prevent it from regulating the matter and data protection rules were provided for in both intergovernmental 33 and supranational instruments 34 , given that the justice and home affairs area is the prominent example of a sectorial-patchworked regulation (Boehm, 2012 (Liñán Nogueras, 1996: 13-16;2001: 374;2020: 126). Thus, the proposed legislation on the protection of personal data was smartly designed under the logic of trade liberalisation among Member States (Lynskey, 2015: 47-48). ...

Reference:

The European Union’s external competence in the data protection field: Is mixity the only way out?