The purpose of this article is to provide a sound and coherent articulation of the rights to data protection, privacy and identity within the EU legal framework. For this purpose, the paper provides a number of important criteria through which the three different rights in question can be clearly defined, distinguished and articulated. Although intrinsically interrelated, the article draws attention to the importance of keeping the rights and concepts of data protection, privacy and identity explicitly defined and separated.Based on two proposed dichotomies (procedural/substantive and alethic/nonalethic), the paper makes three fundamental arguments: first, there are crucial and underlying distinctions between data protection, privacy and identity that have been overlooked in EU legislation (as well as by the legal doctrine that has analyzed this topic); second, the current data protection legal framework (and its articulation with the concepts of privacy and identity) presents serious lacunae in the fulfilment of its ultimate goal: the protection of the autonomy, dignity and self-determination of the human person; and, third, the right to identity should be explicitly mentioned in the EU Data Protection Directive.Profiling is taken as a case study technology to assert the importance of incorporating the right to identity in the EU data protection framework as well to document its current shortcomings.