The Commission was set up from the start to act as an independent supranational authority separate from governments; it has been described as "the only body paid to think European".  The members are proposed by their member state governments, one from each. However, they are bound to act independently – neutral from other influences such as those governments which appointed them. This is in contrast to the Council , which represents governments, the Parliament , which represents citizens , the Economic and Social Committee , which represents organised civil society, and the Committee of the Regions , which represents local and regional authorities. 
A report  by the European Union Agency for Network and Information Security elaborates on what needs to be done to achieve privacy and data protection by default. It specifies that encryption and decryption operations must be carried out locally, not by remote service, because both keys and data must remain in the power of the data owner if any privacy is to be achieved. The report specifies that outsourced data storage on remote clouds is practical and relatively safe if only the data owner, not the cloud service, holds the decryption keys.