This first study of the 2023 Council of Europe (CoE) Data Protection Regulations focuses on the institutional design of the Data Protection Commissioner and the Data Protection Officer (DPO). It shows that the reform of both offices was inspired by the EU offices of the EDPS and the EU DPOs. In the context of an EU-CoE dialectical relationship in data protection, the EU exerts significant influence over institutional design. The article highlights differences between those offices and their EU counterparts. In particular, the weak enforcement/monitoring powers of the CoE Commissioner limit possibilities for accountability within the organisation. The study ends with recommendations to strengthen the Commissioner’s mandate.

For as vivid the academic debate around issues of algorithmic bias, discrimination and unfairness has been in the context of EU law, little attention has been paid thus far to the way in which such instances have been dealt with by courts. This article examines from a non-discrimination law perspective how domestic courts of Member States as well as the European Court of Justice have approached cases of algorithmic bias in automated decision-making, by focusing on the judges’ engagement with discrimination-related considerations. For the purposes of my analysis, I propose a taxonomy of judgments dealing with cases of algorithmic bias and analyse a number of examples accordingly to showcase the distinct features of each category. In this regard, a first distinction is drawn between judgments relating to cases of ‘algorithmic discrimination’ and those concerning cases of ‘unfair algorithmic differentiation’. Depending on the extent to which courts take into account any risks of discrimination in the cases falling under the second category, I further distinguish between judgments of ‘discrimination reflection’, those of ‘discrimination awareness’, and those of ‘discrimination silence’. On the basis of this classification, I then attempt to shed more light on how non-discrimination and data protection law may interact with each other in practice in cases of algorithmic bias. Finally, the article concludes with some reflections on the prevailing tendency to address equality concerns through recourse to data protection rules.

This review essay critically examines three recent books on the digitalization and datafication of humanitarian action: #Help, Humanitarian Extractivism, and Technocolonialism. Each monograph offers a compelling analysis of the myriad ways that humanitarians’ use of digital technologies has reshaped governance and the international order, created new risks, and exacerbated power imbalances. Fundamentally, each book concludes that the various transformations technology has wrought in humanitarianism are, at best, unintended, inconsistent, or unfulfilled in their impact and, at worst, deeply problematic. Setting aside the books’ contributions, each leaves out two important elements. First, in selecting examples, the authors leave mostly unanswered the question of what, if any, positive impacts data and technology have had on or for humanitarian response and those whom it is intended to help. Second, each is mostly silent with regard to practical steps that can be taken to address its critiques, with only Technocolonialism offering three broad avenues for reform. In the context of the current crisis in the humanitarian sector, with the closure of USAID and dramatic declines in funding, there is a need for pragmatic options for the future that, by necessity, involve a creative reimagining of the digital infrastructures underpinning the humanitarian response.

This article examines the governance challenges of human genomic data sharing. The analysis builds upon the unique characteristics that distinguish genomic data from other forms of personal data, particularly its dual nature as both uniquely identifiable to individuals and inherently collective, reflecting familial and ethnic group characteristics. This duality informs a tripartite risk taxonomy: individual privacy violations, group-level harms, and bioterrorism threats. Examining regulatory frameworks in the European Union (EU) and China, the article demonstrates how current data protection mechanisms—primarily anonymisation and informed consent—prove inadequate for genomic data governance due to the impossibility of true anonymisation and the limitations of consent-based models in addressing the risks of such sharing. Drawing on the concept of “genomic contextualism,” the article proposes a nuanced framework that incorporates interest balancing, comprehensive data lifecycle management, and tailored technical safeguards. The objective is to protect individuals and underrepresented groups while maximising the scientific and clinical value of genomic data.

The EU has been represented as a singular ‘Digital Empire’ speaking with one voice on matters of EU digital regulation. Closer examination of discrete areas of EU digital regulation reveals a more nuanced picture suggesting clear institutional divergence between the EU institutions regarding the substantive protection afforded by EU law. A detailed analysis of EU data protection adequacy decisions brings to the surface intra-EU tensions concerning the substance of core EU fundamental rights. This analysis reveals that the EU Commission has taken on a more prominent role in adequacy decision-making since the entry into force of the EU’s General Data Protection Regulation at the expense of other relevant stakeholders. Furthermore, the Commission’s decisional practice does not align fully with the stance of the Court of Justice on the right to data protection. New sites of intra-EU human rights tensions are therefore uncovered with consequences for the legitimacy of the EU as a digital regulator and the role of the Commission as a guardian of the treaties.

The concept of identifiability remains a foundational yet contentious criterion in European Union (EU) data protection law. Similarly, anonymisation has sparked intense debate.

This paper examines recent developments that have shaped the EU’s approaches to identifiability and anonymisation, including trends in the Court of Justice of the European Union (CJEU) case law, national supervisory authority (SA) assessments of anonymisation processes, and the recent European Data Protection Board (EDPB) Opinion 28/2024 addressing the anonymity of artificial intelligence models and EDPB Guidelines 01/2025 on pseudonymisation.

The paper explores how the balance between over-inclusiveness and under-inclusiveness is being calibrated, suggesting the emergence of a functional definition of personal data in CJEU case law. It underscores the importance of the burden of proof in evaluating anonymisation processes, as confirmed by national SA assessments. Finally, it highlights how to ensure consistency between the GDPR and data sharing mandates stemming from the new generation of EU data regulations.

The implementation of the General Data Protection Regulation (GDPR) in the EU, rather than the regulation itself, is holding back technological innovation. The EU’s data protection governance architecture is complex, leading to contradictory interpretations among Member States. This situation is prompting companies of all kinds to halt the deployment of transformative projects in the EU. The case of Meta is paradigmatic: both the UK and the EU broadly have the same regulation (GDPR), but the UK swiftly determined that Meta could train its generative AI model using first-party public data under the legal basis of legitimate interest, while in the EU, the European Data Protection Board (EDPB) took months to issue an Opinion that national authorities must still interpret and implement individually, leading to legal uncertainty. Similarly, the case of Deepseek has demonstrated how some national data protection authorities, such as the Italian Garante, have moved to ban the AI model outright, while others have opted for investigations. This fragmented enforcement landscape exacerbates regulatory uncertainty and hampers EU’s competitiveness, particularly for startups, which lack the resources to navigate an unpredictable compliance framework. For the EU to remain competitive in the global AI race, strengthening the EDPB’s role is essential.

This study, authored by Dr Fahimeh Abedi, Prof. Tim Miller and Prof. Atif Ahmad, explores the skills gaps lawyers face when advising on emerging technologies in an increasingly complex digital landscape. Using an exploratory sequential mixed methods approach, the authors conducted qualitative interviews with 26 in-house lawyers and a broader quantitative survey revealed key challenges, including complex legislation, unclear regulatory frameworks and ethical concerns in data use. Findings highlight a significant gap in technological literacy within the legal profession, emphasising the need for improved knowledge, skills and ethical awareness. This research provides a roadmap for equipping legal professionals for responsible leadership in a technology-driven future, offering significant insights for policymakers and regulators.