Data protection

The EU AI Act Evaluated Using the 5AIMS Framework

European Data Protection Law Review, 11(4), 420-433

2025

Co-authors: Wendy Hall

Themes: Artificial Intelligence (AI), Data protection

Category: Journal article, Peer reviewed

This article extends the Four Internets framework for studying ideological approaches to Internet governance to the governance of AI (Artificial Intelligence Management Strategies, AIMS). The derivation of the 5AIMS framework is explained, and it is applied to the EU AI Act to show how the EU’s approach to AI regulation has shifted from its previous practice, eg with data protection. The framework is also used as a lens to critique the Act, and to frame the prospect of the Act repeating the Brussels effect of influencing global AI regulation.

On blockchains and the General Data Protection Regulation

EU Blockchain Observatory and Forum

2018

Co-authors: Luis-Daniel Ibáñez, Elena Simperl

Themes: Blockchain/cryptocurrency, Data protection

Category: Open access, Peer reviewed, White paper/report

In this paper, we review the legal and technological state of play of the GDPR-Blockchain relationship. Next, we analyse three interaction scenarios between data subjects and blockchain systems, and propose possible ways of achieving GDPR compliance by using state of the art technologies. Finally we review current efforts in the use of blockchains to enforce GDPR principles, in particular ‘Data Protection by Design’.

The right to be forgotten: the good, the bad and the ugly

IEEE Internet Computing, 19(4), 73-79

2015

Themes: Data protection

Category: Journal article, Open access, The Digital Citizen

Viviane Reding’s (three-time European Commissioner) muscular speeches advocating a right to be forgotten for Europeans kick-started a ruckus that has pitched the European Union (EU) against the US and privacy activists against Big Data advocates. This issue gained momentum in May 2014, when an appeal by Google Spain against a decision of the Spanish Data Protection Authority (DPA), la Agencia Española de Protección de Datos (AEPD), was rejected by the Court of Justice of the European Union (CJEU), thereby enshrining the right to be forgotten in law. This paper discusses in depth considers the right to be forgotten, including its potential ramifications and successes.