12 March 2025
Cross-Border Data Flows and India’s Digital Sovereignty
India’s data protection framework has been in the making for over a decade. The Digital Personal Data Protection Act was passed by Parliament in 2023, and the draft Digital Personal Data Protection Rules were released in January 2025 for public consultation. In this piece, I argue that the draft Rules do little to clarify India’s murky position on cross-border data flows. The ambiguous wording of the text grants unfettered discretion to the executive in operationalizing the localization mandate. Moreover, the lack of legislative protections for citizen privacy, coupled with missed opportunities to establish robust institutional frameworks undermines India’s own data diplomacy project. Continue reading >>
0 
14 August 2024
In the Shadows
Recent investigations by Netzpolitik and the German public service broadcaster Bayerischer Rundfunk into the company Datarade have shed light on a part of the digital economy that has so far operated mainly in the background: data trading. The key players in this sector are data brokers, whose business model is to trade in (non-)personal data. Data trading is a multi-billion-dollar component of the global digital economy and not a new phenomenon. This article outlines the legal implications of data trading in the context of the GDPR, the DSA and the AI Act. Continue reading >>
0
10 November 2023
Europe and the Global Race to Regulate AI
The EU wants to set the global rule book for AI. This blog explains the complex “risk hierarchy” that pervades the proposed AI Act, currently in the final stages of trilogue negotiation. This contrasts with the US focus on “national security risks”. We point out shortcomings of the EU approach requiring comprehensive risk assessments (ex ante), at the level of technology development. Using economic analysis, we distinguish exogenous and endogenous sources of potential AI harm arising from input data. We are sceptical that legislators can anticipate the future of a general purpose technology, such as AI. We propose that from the perspective of encouraging ongoing innovation, (ex post) liability rules can provide the right incentives to improve data quality and AI safety. Continue reading >>
0