STeP Talks

The Regulation of Digital Technologies in the EU

After the summer break, this October STeP Talks is back with an exciting book presentation, followed by the interesting discussion, on “The Regulation of Digital Technologies in the EU: Act-ification, GDPR Mimesis and EU Law Brutality at Play” written by Vagelis Papakonstantinou and Paul De Hert.

This publication delves into the “EU regulatory initiatives concerning technology-related topics have spiked over the past few years. On the basis of its Priorities Programme, which is focused on making Europe ‘Fit for the Digital Age’, the European Commission has been busily releasing new texts aimed at regulating a number of technology topics, including data uses, online platforms, cybersecurity, and artificial intelligence. This book identifies three phenomena which are common to all EU digital technologies-relevant regulatory initiatives: act-ification, GDPR mimesis, and regulatory brutality. These three phenomena serve as indicators or early signs of a new European technology law-making paradigm that now seems ready to emerge. They divulge new-found confidence on the part of the EU digital technologies legislator, who has now asserted for itself the right to form policy options and create new rules in the field for all of Europe. Bringing together an analysis of the regulatory initiatives for the management of technology topics in the EU for the first time, this book will be of interest to academics, policymakers, and practitioners, sparking academic and policymaking interest and discussion.”

During this event, we will have the co-author, Vagelis Papakonstantinou (Professor on Personal Data Protection Law at the Faculty of Law & Criminology of the Free University of Brussels), and discussant, Lorena Flórez Rojas (Assistant Professor in Technology Law at the University of Groningen), explore the topics raised in this publication.

Join us on the 17^th of October from 10.00-11.00 online.

Vagelis Papakonstantinou

Vagelis Papakonstantinou is a Professor on Personal Data Protection Law at the Faculty of Law & Criminology of the Free University of Brussels (VUB, Vrije Universiteit Brussel), focusing also on Cybersecurity, Intellectual Property, and the broader topic of technology regulation. He works though the Cyber and Data Security Lab (CDSL), where he is its scientific coordinator, as well as through VUB’s Research Group on Law Science Technology & Society (LSTS) and the Brussels Privacy Hub.

Since the early 2000s Vagelis Papakonstantinou has participated in the law-making committees for the release of all major EU, Council of Europe and Greek laws and regulations on personal data protection (the Council Framework Decision 2008/977/JHA, the EU PNR Directive, Convention 108+, the GDPR, the Police and Criminal Justice Data Protection Directive, Greek law n.4624/2019).

Since 2018, when the GDPR became applicable, he has participated either as a partner through VUB’s CDSL or as an external expert in EU-funded research projects of a total worth of more than 100m Euros.

In addition to the above, through MPlegal, a niche technology law firm, Vagelis Papakonstantinou practices business law with a particular emphasis on technology start-ups and mid-size companies. To match these interests, he also teaches “Entrepreneurship” at the Executive MBA Programme of the University of the Aegean.

For the period 2016-2021 he has been a member (alternate) of the Hellenic Data Protection Authority. Since 2021 he has been the Data Protection Officer (DPO) of Greece's centre-right (governing) political party Nea Demokratia - ND. In the past, he has been a member of the Board of Directors of the Hellenic Copyright Organisation (for two terms).

Lorena Flórez Rojas

Lorena Flórez Rojas is an Assistant Professor of Law at the University of Groningen, specializing in the intersection of law, technology, and consumer rights. With a Ph.D. in Individual Person and Legal Protections from Italy's Scuola Superiore Sant'Anna, she focuses on the impact of emerging technologies on consumers and markets. Her expertise spans commercial law, securities, and law and technology, developed during her tenure as an Assistant Professor at Los Andes University in Bogotá from 2019 to 2022. Lorena leads innovative projects, including the development of an ethical-legal toolkit for AI adoption in organizations. She has contributed to AI research within the CinfonIA group, coordinated a book on disruptive technologies, and authored pieces on AI in Colombia. Her work extends to educational initiatives, having contributed to two significant MOOCs on AI and designed the Ethics in AI module for a Master's program. Her research culminated in a comprehensive information file that informed the Beta version of an ethical-legal toolkit, published on GECTI's webpage. She continues to bridge the gap between legal frameworks and technological advancements, contributing to the responsible development and implementation of AI and other disruptive technologies.

Keep an eye out for more updates on this STeP Talk!

Book presentation: The Privacy Fallacy. Harm and Power in the Information Economy

In this edition of STeP Talks, we will be joined by Igancio Cofene, who holds the Research Chair in A.I. Law & Data Governance at McGill University, Montréal, Canada. He will share his latest book ‘The Privacy Fallacy. Harm and Power in the Information Economy’ with us: ‘Our data is besieged by tech companies, leading to hidden AI harms in the information economy. Companies can do this because our laws are built on outdated ideas that trap lawmakers, regulators, and courts into wrong assumptions, resulting in ineffective legal remedies to one of the most pressing concerns of our generation. Drawing on behavioral science, social data science, and economics, Ignacio Cofone challenges existing laws and reform proposals and dispels enduring misconceptions about AI-driven interactions. This exploration offers a view of why current laws and regulations fail to protect us against corporate digital harms, particularly those created by AI. Cofone then proposes a better response: meaningful accountability for the consequences of corporate data practices. Ultimately, accountability requires creating a new type of liability system for AI harms that recognizes the value of privacy.’ Our panelists will engage in a discussion with Ignacio on the topic of his book.

Join us on July 2nd from 11.00-12.30 online or on-site in Groningen (Lokinzaal (floor -1), Röling Building, Oude Boteringestraat 18) to discuss privacy challenges by registering here!

Ignacio Cofone

Ignacio Cofone is the Canada Research Chair in AI Law & Data Governance at McGill University Faculty of Law, where he teaches Privacy Law and AI Regulation, and an Affiliated Fellow at the Yale Law School Information Society Project. His research explores how law should adapt to technologically-driven social and economic change with a focus on data harms and AI decision-making.

Jonida Milaj-Weishaar

Dr Jonida Milaj-Weishaar is Assistant Professor in Technology Law and Human Rights at the Security, Technology, and e-Privacy (STeP) research group, Groningen University. Her main research focus is on the challenges that technology creates for the protection of fundamental rights of individuals. She is especially interested in new developments in the field of AI and Data Spaces. Jonida is a research fellow at the Information Society Law Center, University of Milan, and she is also a visiting lecturer at the Central University of Political Science and Law in Beijing.

Sophia Salziger

Sophia Salziger is a PhD candidate at the University of Groningen and a member of the STeP research group. Her research focuses on civil liability for non-material damage in the event of data protection violations. She examines monetary compensation for non-material damage, such as psychological distress, damage to reputation and infringements of personality rights. For this purpose, she conducts a comparative study of Article 82 GDPR within the Transboundary Legal Studies and Private Law departments.

Keep an eye out for more updates on this STeP Talk!

Current developments in Article 82 GDPR

This STeP Talk reflects on the latest developments on non-material damages and their compensation under Article 82 GDPR. It provides an overview of the recent judgments of the Court of Justice of the European Union on the interpretation of Article 82 GDPR and critically discusses them with the aim of finding practical solutions at national level. A much debated issue in relation to Article 82 GDPR is the concept of non-material damage.
Sophia Salziger questions whether the categorisation of non-material damage as a 'concept' is not misleading and restrictive in practice. The recent developments of the Court of Justice seem inconsistent when analysed from the perspective of the subject matter of tort law.
As a solution to the current problem of defining damages under Article 82 GDPR, Stephan Mulders proposes a new framework for determining personality damages for GDPR infringements, using a risk-based and fundamental rights approach. In this approach, the risk of future damage should be considered as damage, thereby bypassing the problem of causality in the context of data protection cases.

In addition, this STeP Talk will provide some interesting insights into Dutch collective claims for non-material damages under Article 82 GDPR, to see how the claim is enforced and what bottlenecks occur in practice.

Join us on the 19th of June from 11.00-12.30h online or onsite in Groningen (Lokinzaal (floor-1), Rölingbuilding, Oude Boteringestraat 18) by registering here!

Stephan Mulders

Stephan Mulders specialises in data protection and technology law. As a lawyer at Van Diepen Van der Kroef in Amsterdam and as an external PhD at Maastricht University, he works on complex GDPR compliance issues. His doctoral research focuses on collective compensation for GDPR breaches, more specifically the concept of damage under Article 82 GDPR.

Sophia Salziger

For her a PhD project at the University of Groningen, Sophia Salziger is researching on non-material damage in the event of data protection violations under Article 82 GDPR. Therefore, she is conducting a comparison of national case law with a focus on psychological distress, privacy harms and personality rights infringements.

The Digital Markets and Services Acts: Ready, set, …. Go?

No law is an island. Any field of law is intricately connected to any number of other legal disciplines. Such connections present both obstacles and opportunities in equal measure. This is especially evident in 2023’s Digital Markets Act and Digital Services Act.

These new additions to EU law are intended to regulate some of the largest online companies and include elements of competition law, data protection law, and consumer protection law. The European Commission has wasted little time putting its new tools into practice, as recent developments have shown. Investigations under the DSA have already been announced with regards to Twitter (currently X) and TikTok, and investigations under the DMA concern Alphabet, Apple and Meta.

These investigations also show the multi-faceted nature of these new laws. TikTok’s concerns addictive design and so-called ‘dark patterns’, Meta’s involves privacy issues regarding its pay-or-consent model, and both Alphabet and Apple’s concern anti-steering practices.

However, many questions still remain. For example, the DMA has been criticized for lacking a solid legal-theoretical basis, being intended primarily to regulate just a few companies (currently six , none of which EU-based), and rather predictable ones at that. In fact, it has even been suggested that art. 114 TFEU does not suffice as a legal basis for the DMA for this reason.

More broadly, other questions also remain on a substantive and procedural level. For example, how do the DMA and DSA relate to the fields of law mentioned earlier? If these laws take inspiration from competition law, data protection law, and consumer protection law, and sometimes even codify case law from all of these areas, what is the added value of combining it all into these two documents? What happens when the DMA and DSA overlap with other provisions, such as art. 102 TFEU or the GDPR; is there a dividing line, or is the Commission free to choose the most effective line of attack? And where does it leave national supervisory authorities, who now find stringent new rules in laws they have no regulatory powers over?

Please join us on the 18^th of June from 13.30-15h online or onsite in Groningen (room 3A), Rölingbuilding, Oude Boteringestraat 18) by registering here!

Rasmus Geertsema

Rasmus Geertsema is a competition lawyer, currently with the legal service of the Authority for Consumers and Markets (ACM). He holds an LLB and LLM in European Economic Law from the University of Groningen. At the ACM, he works on a broad range of competition cases in which he is both involved during the administrative as well as the litigation phase. His particular interests are the by object/effect distinction, transactionalism in competition law enforcement and the standard of proof in competition law.

Belle Beems

Belle Beems works as a PhD candidate at the department International and European Law at the Radboud University. Her research is focused on public enforcement of competition, data protection, and consumer protection law on personal data markets. She is particularly interested in cooperation and coordination between different enforcers.

Peter van de Waerdt

Peter van de Waerdt is an expert on the relations between data protection law and competition law. His research is focused on digital markets; and specifically how both competition and privacy issues play a vital interconnected role in the regulation of large digital market companies. For example; how personal data collection is often the cornerstone of online market power, and how the GDPR's concepts of transparency and consent are affected by market dominance in turn.

Automated Decision-Making under the GDPR and beyond: Current Developments

Join us on the 17^th of May from 9-11h online or onsite in Groningen (Lokinzaal (floor -1), Rölingbuilding, Oude Boteringestraat 18) for a discussion on issues concerning automated decision-making under article 22 GDPR by registering here!

Paul de Hert

Paul is Full Professor at the Faculty of Law & Criminology at the VUB and an associate professor at the Law School/Tilburg Institute for Law and Technology (TILT), University of Tilburg. He is Director of the VUB’s Research Group on Human Rights, Vice-Dean of the Faculty of Law & Criminology, and a former director of the LSTS and of the Department of Interdisciplinary Studies of Law and Senior Researcher in iBOF project ‘Future-proofing human rights, Developing thicker forms of accountability’. His talk is titled ‘The role of governments in society. Teaching by example’.

Margaret Warthon

Margaret is a PhD candidate at the University of Groningen. She holds a law degree from the Pontifical Catholic University of Peru and an LL.M. in Intellectual Property Law from the University of Göttingen. Her research aims to develop mechanisms that balance data protection transparency requirements with competing interests in the public sector's use of biometric decision-making systems.

Automated mobility: legal aspects of unmanned ships and self-driving cars

The maritime sector faces challenges to become more sustainable and remain safe, secure and efficient at the same time. To learn more about these challenges that the maritime sector faces in particular in light of increased automation, the AUTOROBUST project on robust and safe control of remotely operated offshore vehicles will be presented at our March STeP Talks. The use of maritime automated surface ships (MASS) may contribute to reaching these sustainability, safety and efficiency goals. Unmanned ships not only pose technical challenges, they also give raise a large number of legal questions. Who is responsible for a ship without a captain on the bridge and how should the concept of good seamanship be interpretated? We will discuss the latest developments in regulating unmanned ships, learn about the particularities of the maritime world and discover parallels and differences between (regulating) ships and other modes of (unmanned) transport as similar legal questions and challenges are relevant in relation to self-driving cars. During this STeP Talk, we will explore how the two fields can supplement each other.

Welmoed van der Velde

Welmoed is a maritime lawyer who works as a professor in applied sciences (lector) at NHL Stenden University of Applied Sciences. She conducts applied research in areas where law and technology meet, for example on the legal aspects of unmanned ships. Welmoed also acts as a deputy-judge at the Court of Appeal in The Hague and the Maritime Disciplinary Court in Amsterdam. She obtained her PhD at Rijksuniversiteit Groningen with a thesis on the position of seagoing ships in private international law in 2006. Afterwards, she worked as a legislative lawyer at the Ministry of Justice in which capacity she drafted legislation and negotiated international treaties in the field of contract and liability law, transport law and private international law.

Ming Cao

Ming Cao has since 2016 been a professor of networks and robotics with the Engineering and Technology Institute (ENTEG) at the University of Groningen, the Netherlands, where he started as an assistant professor in 2008. Since 2022 he is the director of the Jantina Tammes School of Digital Society, Technology and AI at the same university. He received the Bachelor degree in 1999 and the Master degree in 2002 from Tsinghua University, China, and the Ph.D. degree in 2007 from Yale University, USA. From 2007 to 2008, he was a Research Associate at Princeton University, USA. He worked as a research intern in 2006 at the IBM T. J. Watson Research Center, USA. He is the 2017 and inaugural recipient of the Manfred Thoma medal from the International Federation of Automatic Control (IFAC) and the 2016 recipient of the European Control Award sponsored by the European Control Association (EUCA). He is an IEEE fellow and has received a number of prestigious research grants, e.g. NWO vici (2023) and ERC consolidator (2017) and starting (2011) grants. His research interests include autonomous robots and multi-agent systems, complex networks and decision-making processes.

Nynke Vellinga

Nynke Vellinga works at the STeP research group, Department of Transboundary Legal Studies, University of Groningen. She received her PhD in 2020 for the dissertation 'Legal Aspects of Automated Driving. On Drivers, Producers, and Public Authorities' from the same university. After her doctorate, she continued her research in the field of autonomous mobility and law. Her research focuses on legal questions surrounding traffic law, liability, insurance, vehicle requirements, data protection, and cybersecurity. She has actively contributed to, among other things, the ITU Focus Group on Assisted and Automated Driving of the International Telecommunication Union, leading to a technical report under her editorship. In addition, Nynke is an international research fellow at the Information Society Law Center (ISLC) of the "Cesare Beccaria" Department of Legal Sciences, University of Milan.

Regulating New Surveillance Technologies at Work. A Human Computer Interaction Approach

During this seminar, Sandy Gould (University of Cardiff) will illustrate how workplace surveillance is advancing with virtual and physical sensors using machine intelligence. Critics often link these systems to the history of Scientific Management critiques. He will show how, instead, such understandings of today's technology overlook crucial changes in workplace measurement. Building on Sandy Gould's, Michele Molè (University of Groningen) will outline the legal challenges in the EU to protect workers' privacy and fundamental rights. The AI Safety Initiative Groningen will moderate the Q&A.

Join us on the 19th of February from 17.00-19.00h online or on-site in Groningen (Lokinzaal (floor -1), Röling Building, Oude Boteringestraat 18).

Sandy Gould

Sandy Gould is Senior Lecturer at the School of Computer Science and Informatics at Cardiff University. His research generally focuses on technology in the workplace, but he has worked on a number of human-centred computing topics including interruptions, multitasking and interruptionism, emoji and interaction design.

Michele Molè

Michele Molè is a PhD candidate at the University of Groningen Law Faculty. His research focuses on the regulation of workplace surveillance and new technologies in the EU.

The discussion will be moderated by the AI Safety Initiative Groningen. This initiative empowers students, academics, everyone, to ensure that AI is safe and responsible, for current and future generations. AISIG's offerings include AI Safety courses, hackathons, in-depth discussions, speaker events featuring thought leaders; and an evolving array of exciting opportunities.

Article 25 GDPR: Engineering data protection into digital innovation

In this STeP Talk, three experts will share their perspective on article 25 of the General Data Protection Regulation on privacy by design and privacy by default.

Join us on the 17^th of January from 13.00-14.30h online or on-site in Groningen (Lokinzaal (floor -1), Röling Building, Oude Boteringestraat 18).

Jaap-Henk Hoepman

Jaap-Henk Hoepman (1966) is currently a guest professor at the PRISEC - Privacy And Security group of Karlstad University, Sweden. He is also an associate professor at the Digital Security group of the Radboud University, Nijmegen, the Netherlands, working for the iHub, the interdisciplinary research hub on Digitalization and Society. In addition, he is an associate professor in the IT Law section of the Faculty of Law of the University of Groningen. Moreover, he is a principal scientist (and former scientific director and co-founder) of the Privacy & Identity Lab.

He studies privacy by design and privacy friendly protocols for identity management and the Internet of Things. He speaks on these topics at national and international congresses and publishes papers in (inter)national journals. He also appears in the media as security and privacy expert, and writes about his research in the popular press. He is actively involved in the public debate concerning security and privacy in our society.

In October 2021 his book Privacy Is Hard and Seven Other Myths. Achieving Privacy through Careful Design appeared at MIT Press.

Efstratios Koulierakis

Efstratios Koulierakis is a PhD candidate at the Department of Transboundary Legal Studies, in the Graduate School of Law of the University of Groningen, and a member of the STeP research group. He holds a law degree from the National and Kapodistrian University of Athens, and an LL.M with distinction from KU Leuven. Efstratios works within the interdisciplinary project KnowGraphs, part of the Marie Skłodowska-Curie actions (grant agreement no 860801). His PhD focuses on the relation between data protection by design and knowledge graphs. His research interests include EU technology law, human rights, and personal data protection.

Monique Kalsi

Monique Kalsi is a PhD researcher focusing on the application of data protection by design and by default obligations resulting under article 25 of the General Data Protection Regulation to biometric technologies. Her research also analyzes if the legal requirements of the data protection by design and by default approach can influence the development of new generation of biometric technologies and improve their acceptability in society. Her Ph.D. is a part of the TReSPAsS-ETN (Training in Secure and Privacy-Preserving Biometrics) project.