II. Importance of the EU as norm-setter

While the green and digital transitions are framed as complementary within the twin transition narrative, their regulatory trajectories have diverged significantly, especially once one separates EU climate law from the broader field of environmental law. The EU has emerged as a dominant norm-setter in digital regulation, with its influence often amplified by the Council of Europe’s instruments (such as Convention 108+ and the recent AI Framework Convention), which diffuse EU-compatible standards beyond the Union’s borders.Footnote ¹⁶ In contrast, its impact on traditional environmental law is much less prominent as the landscape of international regulatory actors is much more diverse.

Let us first look at the presence of traditional treaty law or conventions (accompanied or not by soft law clarification) at the global regulatory landscape of traditional environmental law. The sheer number of binding international law, de SadeleerFootnote ¹⁷ writes of 1,000 bilateral and multilateral environmental agreements clearly outnumbers and dwarfs anything comparable in international digital law. In international digital law, binding treaty instruments are scarce, and the few that do exist have largely emerged from a regional European organisation with an international vocation: the Council of Europe.

Contrast this sketch with international data law: The OECD in 1980 and the UN in 1990 both published Guidelines on the protection and free flow of data. Whereas both were important milestones that shaped emerging national data laws, they remained soft-law instruments and, therefore, merely set voluntary bases for the regulation of data.Footnote ¹⁸ The only legally binding international treaty in data protection law constitutes the 1981 Convention 108 by the Council of Europe – an island when compared to the ocean of international environmental instruments. More broadly in digital law, the Council of Europe adopted a cybercrime convention in 2004, that was “rivalled” by a UN instrument only very recently in 2024.Footnote ¹⁹ The Council of Europe’s 2024 Framework Convention on AI still remains the only legally binding international instrument on the regulation of AI.

In data law in particular, it is the EU that has become one of the most influential actors in shaping European and global data protection norms. It has and is achieving a Europeanisation of data protection norms beyond the EU’s borders not through legally binding international instruments but through what Bradford coined as the “Brussels Effect,” referring to its unilateral power to regulate global markets.Footnote ²⁰ Through market-driven harmonisation,Footnote ²¹ the EU has successfully exported its standards and legal institutions globally without resorting to international institutions (and global political harmonisation).Footnote ²² The regulation of the digital economy in general and the regulation of data with the EU’s regulatory “flagship” the GDPR, in particular, would thereby constitute a perfect example, according to Bradford, for the unilateral regulatory globalisation of the EU.Footnote ²³

Moreover, the EU’s norm-setting capacity in the digital has not been limited to the Brussels Effect. It further extends, albeit indirectly, through the Council of Europe, which frequently functions as a “regulatory ambassador” of EU standards in the realm of international law. With 27 of the 46 Council of Europe Members also being EU Member States, a conscious effort is necessary to ensure consistency and compatibility between Council of Europe Conventions and EU law.Footnote ²⁴ EU Member States thus ensure that the regulatory regimes of the Council of Europe do not hamper EU law in one way or another. The modernisation of Convention 108, which coincided with the overhaul of Europe’s data protection framework, exemplified the reciprocal influence between both institutions.Footnote ²⁵ A similar narrative explains the EU-dimension of the Council of Europe Framework Convention on Artificial Intelligence (AI Convention): The EU was among the early signatories of the Convention. Its AI Act, adopted first, strongly influenced the negotiation of the Convention whose design promotes global participation while aligning with, and effectively transmitting, the content of the EU AI Act.Footnote ²⁶

The EU and the Council of Europe therefore pursue complementary regulatory strategies in digital policy. Council of Europe conventions are based on general principles, whose flexibility, when implemented in national law, makes them appealing to both Member States and interested third countries.Footnote ²⁷ In contrast, EU digital legislation, particularly since the 2009 Lisbon Treaty, aspires to fully harmonise national law and has consistently reduced the possibility of national regulatory heterogeneity.Footnote ²⁸ For instance, with the Lisbon Treaty, a new sector-specific legal basis was created, which positioned the EU as the (almost) uncontested norm-setter for the regulation of personal data.Footnote ²⁹ It was subsequently used as a legal basis for the GDPR, which was presented with the bold claim of putting an end to the fragmented European digital market, leaving regulatory discretion to Member States only in limited situations.Footnote ³⁰

The previous teaches us that the EU has increasingly established itself as the dominant norm-setter in the digital sphere, with other sources of regional and international law playing a comparatively peripheral role. This stands in sharp contrast to the pre-Green Deal regulatory landscape in environmental law, where the EU’s norm-setting capacity has been shaped and constrained by an already dense web of multilateral treaties and soft law instruments. As a result, EU environmental law has generally developed in coexistence with, rather than in the absence of, international environmental law. By contrast, in certain environmental sub-fields where international governance is less developed – EU chemicals regulation under REACH being the most prominent example – the EU has assumed a much more assertive regulatory role.Footnote ³¹

The picture becomes more nuanced when turning to climate law. Whilst strong impetus for EU climate action is traced to the 1997 Kyoto Protocol, the EU soon sought to position itself as a central actor in the global fight against climate change.Footnote ³² The Lisbon Treaty, again, reinforced this ambition by explicitly recognising international climate action as a priority of EU environmental policy. The 2015 Paris Agreement was subsequently regarded as one of the EU’s major foreign environmental achievements as already prior to that agreement, it had agreed on a long-term strategy to reduce greenhouse gas emissions, thereby signalling its willingness to steer the direction of international climate governance.Footnote ³³ The European Green Deal continues this trajectory: the Commission explicitly declared that it “wants to use its economic weight to shape international standards,”Footnote ³⁴ directly alluding to Bradfords Brussels effect and signalling its aspiration to become a global norm setter in climate law. Yet, unlike in the digital sphere, this leadership does not unfold in isolation from international structures. Rather, it both relies upon and contributes to a broader multilateral framework, within which EU unilateral initiatives are intended to catalyse broader collective action.

The explanations for this differentiated norm-setting role of the EU are manifold. They may be traced, inter alia, to the expansion of the Union’s legal mandate following the Lisbon Treaty, which has facilitated more assertive regulatory intervention in certain policy areas; or to an increasing awareness of the transnational and economic nature of digitalisation that explains why the matter seems to flow naturally to the EU’s agenda and reinforces its capacity to act as a unilateral norm-setter – rooted in a project originally developed as an economic integration project centred on the creation and functioning of the internal market. This underlying dynamic is unlikely to change in the foreseeable future, as the internal market continues to operate as a powerful engine of regulatory harmonisation and norm-setting. Moreover, the emerging de-regulatory turn may prompt the EU to reassert its core economic and internal market objectives, with the consequence that more socially oriented goals – such as the protection of privacy or the environment – risk becoming ancillary, or even marginal, to market integration.Footnote ³⁵ A trend that might reinforce the EU’s role as a norm-setter in market-embedded domains such as digital regulation, while limiting its normative ambition in the environmental field.Footnote ³⁶

The next section shifts from “who regulates” to “how the EU regulates,” contrasting the relative reliance on binding legal acts and on funding‑based governance in the digital and green transitions. Bringing in non-legislative options to regulation, like grants and subsidies, taxes or tradable permits, allows a better assessment of the EU’s action in the green and the digital.

III. Importance of EU money-based policy making

The previous section has shown that international environmental law is characterised by a dense and mature multilateral architecture, within which the EU has traditionally operated as one actor among many. By contrast, the scarcity of binding international instruments in the digital field has enabled the EU to assume a far more unilateral and assertive norm-setting role. While in environmental law EU action thus typically coexists with pre-existing international frameworks, climate law illustrates that the Union has nonetheless sought to reposition itself as a leading regulatory force, hoping that its unilateral initiatives would catalyse broader multilateral cooperation.Footnote ³⁷

Shifting the focus from who regulates to how regulation is pursued, this section examines whether the Green Deal’s explicit aspiration to assume a norm-setting role translates into a more assertive regulatory model akin to that adopted in the digital sphere. As the following three observations demonstrate, however, the EU’s regulatory approach in the green transition diverges in important respects from its digital counterpart.

First, framed as a new growth strategy, the European Green Deal prioritises massive investmentsFootnote ³⁸ to steer market activity towards the objectives of green growth and climate neutrality. Whereas a growing but heavily contested legislative programme has emerged over the past years, a significant share of the Green Deal’s implementation relies therefore on a broad ecosystem of investment and funding instruments, including the RRF, InvestEU, the Social Climate Fund or the Innovation Fund. Funding thus holds an important place to steer transformative processes in the green transition. The use of governance through funding mechanisms to drive change at the national level has, however, raised concerns in the literature as to whether spending-based forms of governance are subject to a degree of judicial review comparable to that attached to classic regulatory instruments.Footnote ³⁹ Whereas similar instruments exist in the digital transition, such as the 2021 Chips ActFootnote ⁴⁰ that should enhance Europe’s digital sovereignty by strengthening semiconductor supply chains, these mechanisms operate alongside extensive “traditional” forms of hard-law regulation pursuing policy objectives independently of financial incentives.

Second, the foregoing (the green agenda’s reliance on money, rather than binding law) does, of course, not suggest that the Green Deal is without regulatory ambitions. Several of its key proposals, however, have faced strong resistance throughout the legislative process and were on the verge of failure,Footnote ⁴¹ withdrawn,Footnote ⁴² or watered down. ^{Footnote 43,Footnote 44} This dynamic has been reinforced by the growing electoral strength of populist parties at national level and in recent European elections, which has made ambitious environmental measures more politically costly and has incentivised both national governments and EU institutions to dilute or delay proposals perceived as economically or socially burdensome.Footnote ⁴⁵ Taken together, these developments place pressure on the overall trajectory of the Green Deal and call into question the EU’s capacity to assert itself as a strong regulator in the green transition.

This trajectory stands in contrast to its “digital twin,” where the EU has successfully advanced a comprehensive regulatory framework that spans from data governance and big tech oversight to AI regulation, enshrining what some scholars have described as “Europe’s digital constitution” into binding law.Footnote ⁴⁶ Recent developments nonetheless indicate that this contrast unfolds within a more complex political context, as ongoing discussions surrounding digital “omnibus” initiatives, including proposals to postpone AI Act obligations,Footnote ⁴⁷ suggest that digital regulation too remains exposed to political pressures capable of shaping its future trajectory.

Third and finally, while EU digital policy seemingly adopts a rigid top-down approach striving for fully harmonised legal frameworks, leaving Member States with virtually no flexibility, EU environmental law takes a more cooperative route as it grants considerable discretion to national lawmakers in achieving its objectives. We write “seemingly” since, although instruments such as the DMA, DSA or the AI Act centralise enforcement in the Commission to varying degrees, EU digital laws do not entirely remove Member State flexibility. In instruments such as the GDPR, the DA or the DGA, national authorities remain responsible for interpreting and enforcing abstract legal concepts, thereby giving rise to coordination and enforcement challenges.Footnote ⁴⁸

Nevertheless, the divergence in regulatory approaches that we do see between the green and the digital can be exemplified by the GovernanceFootnote ⁴⁹ or Nature Restoration Regulation,Footnote ⁵⁰ which require Member States to develop “national plans,” “restoration targets” and “appropriate and effective measures” to meet objectives set by EU environmental law.Footnote ⁵¹ The significant discretion granted by these instruments is further reflected in criticism by some environmental scholars who observe how “[e]nvironmental ‘plans’ and ‘programmes,’ ‘best available technique,’ reports and monitoring obligations are not defined with the necessary rigidity” and which would make effective monitoring and application of the law “difficult, if not impossible.”Footnote ⁵² With regard to the Green transition, Křepelka observes a trend towards adopting regulations but with directive-like provisions.Footnote ⁵³ Furthermore, others note that, since Member States must bear the “lion’s share of the financial costs associated with the green transition,” progress in divisive environmental matters is likely to be conditioned by fiscal constraints and the ambition of national policymakers.Footnote ⁵⁴

Taken together, our analysis highlights a marked divergence in the regulatory strategies underpinning the twin transitions. In the digital domain, the EU has relied primarily on highly harmonised hard-law instruments, with funding mechanisms playing a largely complementary role, for instance in supporting infrastructure or industrial capacity. From the perspective of regulatory theory, this approach closely resembles traditional forms of command-based regulation, characterised by centralised rule-setting and limited national discretion.Footnote ⁵⁵ In climate and environmental policy, by contrast, binding regulatory instruments coexist with, and are often mediated by, powerful budgetary and investment-based governance tools that leave Member States greater formal discretion while also requiring them to bear a significant share of the associated costs. This configuration aligns more closely with incentive-based regulatory techniques, in which compliance is steered through financial and programmatic mechanisms rather than uniform legal commands. As a result, the EU’s regulatory assertiveness in the green transition remains more fragmented and politically contingent than in its digital counterpart.

To better understand the different trajectories that both policy areas have taken, the following section examines why this regulatory shift towards a fully harmonised data protection framework that subsequently spilled over into the broader field of EU digital policy was able to occur. It shows how external shocks, such as the Snowden revelations or Brexit, constituted critical juncturesFootnote ⁵⁶ in the EU’s aspiration to become the dominant norm setter in the digital, and contrasts this trajectory with environmental and climate law-making, where comparable critical events have had a different, and often more limited, integrative effect at EU level.

IV. Importance of critical junctures driving EU policy making

On the basis of its Priorities Programme 2019–2024, creating a “Europe fit for the digital age” with a myriad of legislative proposals became a central objective. However, the EU’s regulatory efforts in the digital domain began already several decades ago with the adoption of the 1995 Data Protection Directive, which was followed by several legislative instruments that can be associated with the regulation of digital technologies, but which did not form part of a comprehensive policy approach to regulate the emerging digital sphere.Footnote ⁵⁷

This scattered approach changed with the 2010 Digital Agenda for Europe.Footnote ⁵⁸ Whereas the creation of the (“analogue”) single market had constituted the core of the regulatory efforts of the European integration project of the past decades, the 2010 Digital Agenda announced that it was time “for a new single market to deliver the benefits of the digital era” by addressing legal fragmentation of the patchwork of national online markets.Footnote ⁵⁹ Yet, some instruments proposed under this agenda met starkly contrasting outcomes. The 2011 proposal for a Common European Sales LawFootnote ⁶⁰ was ultimately abandoned due to Member States’ resistance to the harmonisation of their national contract law,Footnote ⁶¹ illustrating that full harmonisation in pursuit of the (digital) single market was far from inevitable. In contrast, the 2012 proposal to reform the European Data Protection frameworkFootnote ⁶² succeeded as it was adopted four years later and provided for a fully harmonised legal framework. This transformation was not only facilitated by the 2009 Lisbon reform but also by external shocks – critical junctures in the path taken by EU digital policy.

The legislative process of the data protection reform package, subject to intense lobbying activity, was far from smooth.Footnote ⁶³ It were the 2013 Snowden revelations on surveillance practices by US agencies which constituted a turning point.Footnote ⁶⁴ As the revelations showcased the invisible handshakeFootnote ⁶⁵ between US agencies and online intermediaries, concerns for the protection of data through regulation related not only to privacy concerns for EU citizens but also economic concerns for data by European companies that was accessed across the Atlantic. These revelations thus served as a wake-up call, emphasising the need for a strong European data protection framework to counter foreign digital surveillance and strongly impacted the position of policy-makers.Footnote ⁶⁶ The impact of the Snowden revelations went beyond Europe’s reformed data protection law as they were equally pivotal to understanding Europe’s digital policy shift towards digital sovereignty since 2015. Digital sovereignty denotes “a form of strategic autonomy from third countries and re-orienting relations with ‘Big Tech’, notably through the creation of EU’s own digital infrastructures”Footnote ⁶⁷ with the ultimate objective of preserving European core values, rights and principles.Footnote ⁶⁸ The Snowden revelations illustrated the challenges of enforcing EU law and protecting fundamental rights of EU citizens if it lacks sovereignty over technological infrastructure.

Three years after the Snowden revelations, Brexit and the 2018 Cambridge Analytica Scandal marked yet another critical juncture. They further heightened concerns that the misuse of data collected by Big Tech companies could not only infringe fundamental rights of EU citizens and harm economic interests of EU companies but also undermine the democratic foundations of Member States and the cohesion of the EU through disinformation online. Stronger regulatory oversight of digital platforms to strengthen democratic resilience in light of digital transformation was added to the EU digital policy agenda.Footnote ⁶⁹

Together, the Snowden Revelations and Cambridge Analytica exposed Europe’s vulnerabilities in the digital sphere, as framed in much of the policy discourse, particularly its dependence on foreign companies due to a critical lack of innovation. This diagnosis grounded emerging digital policy initiatives in the pursuit of digital and technological sovereignty.Footnote ⁷⁰ As put drastically by Lehdonvirta, the “EU has a digital single market today, but it wasn’t made in Brussels: it was made in Silicon Valley.”Footnote ⁷¹ This diagnosis of an EU that is structurally vulnerable and late in the digital race strengthened political support for a more assertive, sovereignty-oriented regulatory turn. Concerns about innovation deficits thus became intertwined not only with digital sovereignty and the fight against disinformation, but also with a core promise of the European integration project: ensuring prosperity through the progress of creating an ever-closer Union.

EU digital policy has attempted to address these challenges comprehensively with several detailed regulatory frameworks over the past years. The breadth of this emerging digital acquis can be illustrated by grouping some of the instruments along several functional dimensions. First, a set of instruments centres on the protection of fundamental rights, most prominently in form of the European data protection framework. Second, in the aftermath of the European Strategy for Data,Footnote ⁷² a series of instruments focused on unlocking the economic value of data such as the 2022 Data Governance Act, the 2023 Data Act or sectoral instruments such as the 2025 European Health Data Space Regulation.Footnote ⁷³ Third, measures that target the market power and systemic influence of Big Tech and online platforms. Most notably, the DMA, described as a “turning point in the economic regulation of digital markets,”Footnote ⁷⁴ seeks to promote innovation through competition by enabling disruptive firms to challenge dominant gatekeepers. The DSA, in turn, updates the 25-year-old conditional immunity framework,Footnote ⁷⁵ which granted liability exemptions to providers of certain internet intermediaries, with due diligence obligations that are particularly severe for very large online platforms and search engines.Footnote ⁷⁶ Finally, instruments that address AI technology and the safety and security of digital products, such as the 2024 AI Act or the 2024 Cyber Resilience Act, which seek to foster technological innovation while subjecting it to a clearly structured regulatory framework. Taken together, these instruments illustrate how the EU has responded to critical junctures by constructing an increasingly comprehensive regulatory architecture for the digital sphere.

In EU environmental policy, critical events have certainly also played an important role in shaping EU regulation. One may point, for instance, to the 1976 Seveso disaster in a chemical manufacturing plant that resulted in the adoption of the Seveso Directives, which lay down EU-wide rules on the prevention and control of major industrial accidents involving dangerous substances. However, we do not identify critical junctures in EU environmental policy that have produced a comparable reconfiguration of regulatory style across the policy field to that extent observed in EU digital policy. For instance, recent weather extremes, such as floods in different parts of Europe or rising temperatures, were indeed dramatic events for the concerned populations but did not trigger a similarly centralising EU response and did not result in broad political coalition mobilised around the protection of Europe against an identifiable “external opponent.”Footnote ⁷⁷ An identifiable “adversary” that is absent in EU environmental policy but present in EU digital policy in the form of, for instance, foreign states or large technology companies.

The following section takes a closer look at the regulatory instruments themselves in the twin transition. While both fields show a growing reliance on regulations, their substantive design and regulatory logic differ significantly.

V. Importance of act-ification and choice of regulatory instruments

We have seen how the EU has adopted divergent regulatory approaches in the twin transition. Environmental law that emerges from a variety of fora (international and European) and gives considerable leeway to national implementations. Contrasted with digital law that emerges (almost) exclusively from the European legislator and seeks to eliminate any variety on the national level. Critical junctures further help us understand how the EU has been able to position itself as the dominant norm-setter in digital policy and push through a series of directly applicable regulations. In environmental and climate law, critical events such as Seveso have certainly driven important regulatory innovations, but they have not (so far) generated a comparable wave of highly detailed, centralising “acts” across the whole field. Whilst regulations equally form part of the European environmental law acquis, they appear to be much less common and in the pre-Green Deal era more characteristic in fields that involve the control of risks of, for instance, toxic substances or products.Footnote ⁷⁸

From that perspective, more recent instruments such as the European Climate LawFootnote ⁷⁹ and Governance Regulation are notable outliers for two reasons. First, the legislator opted for regulations in a policy area in which directives had traditionally constituted the dominant instrument. Second, rather than establishing detailed and directly applicable regulatory frameworks, typically associated with regulations, both instruments primarily set long-term policy objectives and goals to be achieved by Union institutions and Member States. Such goalsetting, however, is more commonly associated with directivesFootnote ⁸⁰ than with regulations. Along similar lines, Křepelka observes a recent tendency in EU climate law towards the use of regulations but characterises instruments such as the LULUCF RegulationFootnote ⁸¹ as “a regulation with directive-like provisions.”Footnote ⁸² Taken together, this trend blurs the traditional distinction between regulations and directives.

Whereas we therefore observe a similar tendency of releasing regulations with popular, easy to remember names (act-ification) in both EU climate/environmental (“European Climate Law,” “Nature Restauration Law,” “Critical Raw Materials Act,” “Net-Zero Industry Act”) and digital law (“Digital Markets Act,” “Data Act,” “Artificial Intelligence Act”), it is their imposition of detailed regulatory frameworks with marked downplaying of national (legislative) discretion (regulatory brutality) what sets them apart. None of the recent instruments in EU digital law could be qualified as “regulations with directive-like provisions” – despite their reliance in practice on national authorities that are assigned a key role for providing guidance and enforcing them. It is thus this regulatory brutality that remains unique to EU digital policy and that has not been emulated by EU environmental or climate policy.Footnote ⁸³ Although we acknowledge that, similar to the digital field, the EU’s ambition in environmental and climate policy has evolved towards becoming a (global) norm setter, and although the adoption of almost 160 legislative acts under the Green Deal has been described as “the greatest shock wave since the creation of the single market,”Footnote ⁸⁴ this remarkable legislative surge has nevertheless not resulted in an equivalently tightly harmonised regulatory framework. Instead, environmental and climate policy continue to rely more strongly on framework legislation, programmatic objectives and national discretion than its digital counterpart.

This does not suggest that the relative lack of regulatory “brutality” in EU environmental and climate law should necessarily be regarded as a shortcoming or deficiency. On the contrary, less stringent regulation may offer several advantages, including greater scope for experimentation, a better fit with territorialised harms and smoother integration with existing national regimes. Again, the comparison with the digital transition is instructive. Although the EU digital regulatory framework remains in a phase of consolidation, the move towards more stringent regulation has already given rise to concerns about fragmentation and insufficient integration with existing law in post-GDPR lawmaking.Footnote ⁸⁵

Neither, however, does the current lack of regulatory brutality in EU environmental and climate policy suggest that the EU constitutional framework would prevent a more stringent regulatory approach. After all, environmental challenges are, just like their digital counterpart, inherently transnational and would therefore naturally call for a strong supranational approach. Furthermore, we have seen in the past how the division of competences between EU and Member States is not set in stone but ultimately politically malleable.Footnote ⁸⁶ What seems to count most is strong political support that pushes for regulations, although, as Křepelka warns, the heightened visibility associated with act-ified EU climate law may become problematic once political support erodes and enforcement costs materialise.Footnote ⁸⁷ Furthermore, highly stringent and act-ified regulatory frameworks may ultimately undermine democratic legitimacy by constraining meaningful political choice at national level once public support for climate measures erodes.Footnote ⁸⁸

VI. Importance of criminal law norms and sanctions

Striking is the different place which criminal law holds in both policy areas. The GDPR leaves the imposition of criminal sanctions entirely to the discretion of Member States, requiring only that they establish “effective, proportionate, and dissuasive” penalties for infringements not covered by its administrative fines.Footnote ⁸⁹ In practice, the main sanctioning tool used under the GDPR and related instruments has been administrative fines.Footnote ⁹⁰ This organised silenceFootnote ⁹¹ is noteworthyFootnote ⁹² from a comparative EU-law perspective and this for two reasons. First, prior to the GDPR, when enforcement was left almost entirely to the discretion of Member States, approaches differed: some relied primarily on civil or administrative sanctions, others adopted a more extensive set of data protection crimes, and some, such as Belgium, exclusively opted for criminal law.Footnote ⁹³ As such, the use of criminal law as a tool to address data protection infringements is therefore not alien to European legal systems.

Second, leaving criminal law sanctions entirely to the discretion of Member States not only misses out on an enforcement tool, at least if one assumes that criminal enforcement would in fact be used and coordinated, but fails to address the issue of legal fragmentation, which the GDPR was supposed to solve.Footnote ⁹⁴ That the EU did have the competence to include criminal law provisions was already established in the 2005 Environmental Crime CaseFootnote ⁹⁵ and put in black letter law with the Lisbon Treaty.

One might object that, if both administrative and criminal procedures overwhelmingly result in monetary penalties, the formal label of “criminal” adds little. However, administrative sanctioning regimes have traditionally been reserved for conduct that does not threaten the essential values of society and is therefore considered to warrant only a low degree of societal condemnation.Footnote ⁹⁶ Criminal law, by contrast, is often understood to have a distinct expressive and symbolic function and to trigger specific procedural safeguards and social meanings that may be normatively important when core democratic processes are at stake. Against this background, the EU’s reluctance to move more decisively into the territory of criminal law in the field of digital regulation is therefore noteworthy, especially considering that infringements of EU digital law can amount to attacks on fundamental societal values, such as democratic processes, as exemplified by Cambridge Analytica. If such attacks are not adequately addressed through the “moral condemnation” and the corresponding deterrent effect associated with criminal law, whose sanctioning tools such as prison sanctions clearly carry “a stronger message-sending role or expressive function than civil or administrative enforcement,”Footnote ⁹⁷ it could ultimately erode the legitimacy of EU digital policy.Footnote ⁹⁸

This risk becomes especially pronounced when serious wrongs done by powerful actors are not addressed adequately. While we can acknowledge the successes of the GDPR in strengthening enforcement mechanisms,Footnote ⁹⁹ and while we are well aware of the dangers of over-criminalisation, there remains a need to reflect on whether certain violations in the realm of EU digital policy warrant the scrutiny of a criminal approach at EU level. This message was picked up recently by two scholars in the context of the AI Act (also lacking criminal law provisions). They show that the idea of criminalising data protection wrongdoing is neither completely new nor can it also be applied to wrongs related to AI. In 2019, this matter was preliminarily scrutinised by the EU Council: “It could be appropriate to carry out a full and thorough examination/analysis of the necessity and advisability of establishing (further) minimum rules concerning the definition of criminal offences and sanctions in specific areas. The following areas were suggested by one or more Member States, or the Commission, as areas that could be looked into: … crimes relating to artificial intelligence, subject to further defining the issue at stake and subject to involving other relevant stakeholders.”Footnote ¹⁰⁰

The contrast to EU environmental law, considered as the most relevant area of law to the development of EU criminal lawFootnote ¹⁰¹ could hardly be more pronounced. The recent Environmental Crime Directive 2024/1203 described as a “revolution” in EU environmental lawFootnote ¹⁰² exemplifies how EU environmental law, as opposed to its digital twin, has embraced a criminal law approach to protect the environment and foster compliance with EU law. Neither international nor European environmental law has limited its enforcement arsenal by excluding criminal law. Instead, it has served as a driving force for achieving policy objectives – to such an extent that environmental crime has become the fourth largest criminal sector worldwide.Footnote ¹⁰³ Proposals to criminalise serious breaches of due diligence obligations as a tool to enhance collective deterrence, as recently suggested by a committee of the European Parliament when discussing the proposal of the Environmental Crime Directive, would currently be unfathomable in digital policy. Part of the reason may lie in the different spatial and causal structures of harm: environmental harms are tied to territory and material degradation in a way that fits traditional criminal-law imaginaries, whereas many digital harms (privacy violations, disinformation, data-driven manipulation) are diffuse, cross-border and often perceived as less tangible, which invites administrative rather than criminal responses.

At the very least, a more explicit debate is warranted on whether certain categories of digital wrongs – for instance systematic, large-scale interference with electoral processes – should remain in the domain of administrative fines alone, or whether a carefully delimited EU-level criminal law response could be justified, drawing on the environmental law experience. Different parts of digital law (such as platform/intermediary regulation, market and competition rules for gatekeepers or privacy and cybersecurity frameworks) would of course need to be interrogated separately, as proportional criminal law making requires. The questioning would need to be thorough and go beyond moral considerations. Michal Czerniawski and Anamaria Stoia, for example, stress the need for criminal law to improve extraterritorial enforcement of European norms and values. Platforms outside Europe might therefore be a target of a criminal law policy, to give an example.Footnote ¹⁰⁴

VII. Importance of judicial and administrative enforcement

Whereas criminal law is largely absent from the EU digital policy corpus, a comparatively strong and comprehensive (public and private) enforcement framework is being incorporated into EU digital policy. By contrast, environmental and climate law enforcement relies more heavily on a mix of domestic administrative and criminal mechanisms, Aarhus-based access to justice and Commission infringement proceedings, with far less EU-level institutionalisation of specialised authorities.

Public enforcement in the digital holds a particularly important space due to Article 8 Charter of Fundamental Rights of the EU and Article 16 TFEU, which attach to the right to data protection an obligation to establish an independent authority overseeing compliance with data protection law. Both provisions insist on the independence of these data protection authorities (DPAs). This constitutional anchoring makes DPAs paradigmatic examples of institutional “proxy advocates” for a fundamental right, something that has no obvious counterpart in EU environmental law. Art 52(1) GDPR adds that such independence must be “complete,” a requirement broadly interpreted both by the CJEU and the EU Commission.Footnote ¹⁰⁵ This way, a real new watchdog with a direct constitutional foundation was added to the three traditional Montesquieuian branches to provide additional layers of accountability in the digital realm.Footnote ¹⁰⁶

There are other new branches in Europe, but the data protection authorities stand out. The combination of their independence, a broad mandate over both public and private sectors and dense EU-level cooperation in the form of the European Data Protection Board is distinctive when compared to environmental enforcement structures.Footnote ¹⁰⁷ Their constitutional mandate is explicit: all compliance or non-compliance is subject to their control. The processing power of public and private parties might be legitimate in many cases, but even in these cases, its concrete deployment and compliance need to be systematically watched over by individual rights holders and official agencies, acting as “proxy advocates” or “offices of goodness.”Footnote ¹⁰⁸

Furthermore, we have been witnessing (at least) four significant developments in the area of enforcement of digital law: First, the CJEU in its case law increasingly gives shape to GDPR provisions on enforcement, for instance, with regard to the possibility of representative actions.Footnote ¹⁰⁹ Second, complementarities between different fields of law have been recognised by Courts, enabling, for example, consumer protection associations to enforce data protection as consumer law.Footnote ¹¹⁰ Third, regulatory overlaps that result not only from different fields of law but also different enforcement authorities, such as data protection and competition authorities, are increasingly being addressed in both literature and case law to address risks of lack of coherency and fragmentation through cross-regime cooperation.Footnote ¹¹¹ Finally, a new legislative proposal seeks to enhance efficiency and consistency in the enforcement of the GDPR in cross-border cases.Footnote ¹¹²

By contrast, in EU environmental and climate law, the architecture of enforcement looks different: rather than creating dedicated, independent authorities at EU and national level, the system relies on a combination of Aarhus-based access to justice, domestic administrative and criminal enforcement and Commission infringement proceedings. The Aarhus Convention and its EU implementation have indeed generated a rich body of case law, especially on environmental impact assessment and access to information, but they do not entail the creation of specialised “environmental authorities” comparable to DPAs. The Aarhus Convention, seeks to empower NGOs by granting them access to an effective review procedure – without, however, specifying how this should be achieved.Footnote ¹¹³ EU secondary law and CJEU case law have gradually specified some of these procedural guarantees, and NGOs frequently invoke Aarhus-based rights before national courts and the CJEU, particularly with regard to environmental impact assessments and planning disputes. Yet, standing (whose rights are infringed when the environment is damaged?) remains “the most serious stumbling block for applicants seeking to achieve environmental protection through court action.”Footnote ¹¹⁴ Although there have been meaningful improvements in access to justice for environmental NGOs, questions regarding standing and consistent national implementation therefore continue to pose challenges.Footnote ¹¹⁵

Could environmental law find inspiration in its digital twin? Building on debates about an “EU Environmental Agency with teeth,” one could imagine a constitutional mandate for independent environmental protection authorities, analogous to Article 8(3) for data protection, coupled with a cooperative body mirroring the European Data Protection Board. What if Article 37 of the Charter would, mirroring Article 8(3), enshrine the creation of independent authorities tasked with ensuring compliance with European environmental law – put differently, how would environmental protection fair if proxy advocates in the form of specialised state bodies constituted an additional enforcement player in environmental law?Footnote ¹¹⁶ What if there were not only independent national Data Protection Authorities but also national Environmental Protection Authorities with an institutionalised cooperative mechanism mirroring the European Data Protection Board? Such authorities could interact with, rather than replace, Aarhus-based access to justice, potentially easing standing obstacles by acting as institutional claimants or by supporting NGO litigation.

VIII. Importance of conflicting policy objectives

This section builds on the previous analysis of instruments, funding and enforcement to ask how these different regulatory styles mediate the tension between competitiveness/innovation and the protection of environmental and digital commons. Both environmental and digital policies in the EU are confronted with a recurring dilemma: how to sustain competitiveness and economic growth while protecting shared environmental and informational commons.Footnote ¹¹⁷ Take the green agenda: If international or Union law clearly prioritised one of these objectives, regulatory design could simply follow that hierarchy.Footnote ¹¹⁸ Instead, international environmental lawFootnote ¹¹⁹ tends to embed open-ended balancing clauses and procedural obligations that leave much of the reconciliation to implementing authorities and courts. In European climate law, this is visible too in the emphasis on framework targets, planning, reporting and impact-assessment duties,Footnote ¹²⁰ while more rigid, risk-based standards are less frequent and mainly reserved for specific high-hazard domains such as chemicals, industrial accidents and certain product-safety regimes.Footnote ¹²¹

A similar tension between conflicting or competing policy goals arises when the digital agenda affects the data economy, where the pursuit of data-driven growth collides with the fundamental rights to privacy and data protection.Footnote ¹²² The tension has been addressed in the various EU data laws over the past decade through detailed regulatory frameworks, however, with a seemingly different balancing and weighing of the interests involved. In the GDPR, the protection of personal data is architecturally central and framed as a condition for trust in digital markets; subsequent data-sharing instruments, by contrast, are more explicitly oriented towards unlocking data for innovation, industrial policy and the functioning of the internal market.Footnote ¹²³ Critics of the GDPR often attack its substantive provisions as overly precautionary and compliance-heavy (thwarting innovation),Footnote ¹²⁴ claiming that they raise transaction and storage costs and complicate access to large, integrated datasets for training AI systems.Footnote ¹²⁵

This critique mirrors long-standing complaints in environmental law that the precautionary principle is deployed in ways that slow technological development or impose disproportionate regulatory burdens.Footnote ¹²⁶ Recent policy initiatives, such as the Commission’s “Competitiveness Compass,” make this recalibration explicit by positioning competitiveness, innovation and security as central organising objectives for the next regulatory cycle, accompanied by commitments to reduce administrative burdens and streamline existing rules. Read together with the withdrawal of several regulatory proposals in the digital field, this signals a political climate in which environmental and data-protection objectives are increasingly mediated through a competitiveness lens rather than treated as simple constraints on growth.Footnote ¹²⁷

IX. Importance of organising normative foundations

Connected to the tensions between policy objectives in the twin transition are parallel normative debates on the commodification of nature and data. What should we think about regulatory strategies that rely on property rights, market instruments and pricing to discipline the use of environmental resources? Some critics warn that such approaches risk hollowing out intrinsic values and accelerating ecological degradation. Is commodification of nature necessary to prevent the tragedy of the commonsFootnote ¹²⁸ and an acceptable strategy to reach certain environmental goals,Footnote ¹²⁹ or not?Footnote ¹³⁰ EU environmental and climate law reflects this ambivalence: market-based instruments such as emissions trading and biodiversity offsetting coexist with regimes that treat certain environmental goods as non-substitutable and subject to strict public-law protection.

In the digital field, a similar controversy has unfolded around the status of personal and non-personal data and its potential for commodification.Footnote ¹³¹ Early calls to treat data as an object of property have largely been rejected in favour of a fundamental-rights-based data protection model,Footnote ¹³² yet recent legislative initiatives seek to construct a “genuine single market for data” and encourage data sharing as a production factor for competitiveness and innovation. This produces a deliberately ambiguous stance towards commodification:Footnote ¹³³ instruments such as the 2019 Digital Content Directive insist that personal data cannot be reduced to a commodity, yet it implicitly recognises that digital content is effectively exchanged for access to consumer data, and more recent EU data laws seem to embrace a more economic view of data that can be contractualised.Footnote ¹³⁴ High-profile disputes over “pay-or-consent” models and their compatibility with the GDPR’s requirement of freely given consent further expose the unresolved tension between treating data as a manifestation of fundamental rights and as tradable consideration. The commodification of data therefore remains an ambiguous issue in both law and policy.

Finally, the transformative impact of what are often framed as potential “existential crises” underscores that both environmental and digital law continue to grapple with deeply anthropocentric assumptions. Expanding deployment of AI systems and robotics in work, care and governance contexts prompts questions about human agency, vulnerability and the conditions under which non-human entities might acquire some form of legal personhood or rights-bearing status.Footnote ¹³⁵ At the same time, the accelerating effects of climate change and biodiversity loss challenge legal orders that still centre human interests and short-term economic welfare and stimulate debates about rights of nature, intergenerational equity and ecological constitutionalism.Footnote ¹³⁶

Placing humans firmly at the centre of legal protection is therefore being questioned in both literatures and areas of practice, as discussions about standing for natural entities, animals or automated agents illustrate.Footnote ¹³⁷ For the twin transition, these normative debates are not an abstract afterthought: they shape which interests count in impact assessments, who can appear before courts and how far regulatory frameworks can move beyond compensating human losses to safeguarding the conditions of life for future generations and non-human entities. Leaving these foundational questions unarticulated risks entrenching ad hoc solutions, fragmented across sectors and instruments, that generate contradictions when environmental, consumer, competition and data-protection rules intersect.Footnote ¹³⁸

X. Conclusion: disconnecting forms of regulation from substantive choices

Our introduction highlighted the frequently asserted link between form and substance. The metaphor of the “twin” transition likewise evokes resemblance and shared defining characteristics. Yet, as this article has shown, its two “twins” rest on markedly different regulatory logics.

Our analysis began by asking who has emerged as the dominant norm setter in fields associated with the digital and green transitions. It highlighted the importance of international law in environmental regulation and its comparative absence in the digital domain. While the EU has established itself as a dominant, largely unilateral norm setter in digital regulation, environmental law continues to operate within a more diverse and fragmented international landscape, notwithstanding the EU’s growing ambition to assume a comparable leadership role in the green transition, particularly in climate law.

Shifting from the question of who sets the norms to how regulation is pursued, Section III explored the prevalence of incentive-based policy making. Digital policy relies predominantly on highly harmonised hard-law instruments, while environmental and climate governance remain characterised by a more mixed toolbox, in which binding obligations coexist with funding-based and programmatic instruments that preserve greater national discretion. Section IV compared the existence of critical junctures in the twin transition, understood as moments of exogenous shock or crisis that open a window for significant shifts in regulatory competences and styles, rather than merely incremental adjustments. While critical events have undeniably impacted EU environmental regulation, we identified critical junctures, such as the Snowden revelations, only in the digital policy where they enabled a broader and more fundamental shift in regulatory approach across the field.

Section V focused on the phenomenon of “act-ification,” understood as the increasing reliance on prominently named EU regulations. At first glance, both transitions appear to converge on this trend. Yet, this formal convergence masks a deeper divergence in regulatory substance, revealing a disconnect between regulatory form and substantive regulatory choices. While regulations in EU digital law tend to impose highly harmonised, top-down frameworks with limited national discretion, regulations adopted in the context of the green transition often retain a more “directive-like”Footnote ¹³⁹ character. As a result, instruments deployed in the digital transition largely resemble traditional forms of command-based regulation, whereas the green transition exhibits a stronger reliance on incentive-based regulatory techniques, notably through the extensive use of funding-based mechanisms.

These differences further generate instructive points of comparison across the twin transitions. Differences in enforcement architectures are particularly salient. Sections VI and VII highlighted how environmental law has embraced criminal law as a means of fostering compliance with EU law, while digital regulation has generally relied on administrative enforcement, coupled with institutional innovation through independent supervisory authorities. From a comparative perspective, we suggested that each transition could draw lessons from the other. EU digital policy could engage more seriously with the potential role of criminal law in addressing serious digital wrongs, such as large-scale interference with electoral processes. Conversely, independent authorities modelled on data protection authorities could be explored as a means of strengthening compliance in EU environmental and climate law.

Finally, Sections VIII and IX identified commonalities with regard to the unstable normative foundations that underlie both transitions and how the recent de-regulatory turn in EU policy mediates the tension between competitiveness/innovation and the protection of environmental and digital commons. In the aftermath of initiatives such as the Commission’s “Competitiveness Compass,” the recalibration of EU policy has made explicit the repositioning of competitiveness and innovation as central organising objectives for the next regulatory cycle, with implications for both the digital and green transition.

Future research will therefore need to examine whether ambitions under the green transition risk vanishing as competitiveness concerns regain prominence, or whether, for instance, the dense international legal framework of environmental law may operate as a safeguard against the EU’s current de-regulatory turn.Footnote ¹⁴⁰ Similarly, in the digital domain, the absence of comparable international constraints raises the question of whether the EU will retain its role as a unilateral norm setter or instead yield to pressure from third countries to scale back its regulation of Big Tech companies.Footnote ¹⁴¹ Beyond such existential concerns for the twin transition, comparative research could further explore whether regulatory techniques developed in one field, such as the risk-based approach in digital lawFootnote ¹⁴² or the precautionary principle in environmental law,Footnote ¹⁴³ can meaningfully inform governance choices in the other, particularly as both transitions are exposed to increasing political contestation and shifting regulatory priorities.