AI-related products and services increasingly find their way into daily life. Are the EU's fundamental rights to privacy and data protection equipped to protect individuals effectively? In addressing this question, the dissertation concludes that no new legal framework is needed. Instead, adjustments are required. First, the extent of adjustments depends on the AI discipline. AI-powered emotion recognition, typing with thoughts or eavesdropping virtual assistants: AI covers various concepts, including the disciplines machine learning, natural language processing, computer vision, affective computing and automated reasoning. Second, the extent of adjustments depends on the type of legal problem. Two instruments might be helpful for more effective legislation: rebuttable presumptions and reversal of proof. And in some cases the solution is technical, not legal.