Path Dependence and Network Effects of the GDPR

This article analyzes the global dominance of the General Data Protection Regulation (GDPR) through the theoretical lenses of path dependence and network effects. The authors describe how historical decisions created a self-reinforcing legal trajectory, leading to a "lock-in" phase where the EU standard prevails as the primary global framework. They identify four specific legal mechanisms—adequacy decisions, standard contractual clauses, binding corporate rules, and extraterritorial application—that incentivize third countries and international corporations to adopt European standards. By examining the evolution from early fragmentation to current unification, the text explains why shifting away from the GDPR is increasingly difficult for global actors. Ultimately, the researchers suggest that the EU must simplify the regulation to maintain its leading position and ensure the network remains attractive to new members.

The podcast is based on the following article:

• Path Dependence and Network Effects of the GDPR, in: International Data Privacy Law, Vol. 16(2), 2026, pp 1-14 (with M. Kositwatanarerk).

This podcast explores the evolving legal and economic framework of data ownership, questioning whether current property rights adequately address the unique challenges of the digital economy. A governance crisis is identified where the United States faces "constitutional inversion" due to dominant tech platforms, while China operates under a system of state-driven digital arbitrariness. To resolve these issues, the podcast proposes a novel regulatory model inspired by the EURATOM treaty regarding nuclear materials. This alternative suggests that the public sector should hold residual control rights over data through an independent agency, granting companies usage rights while maintaining the power to enforce safety and competition. Ultimately, this approach aims to protect private autonomy and individual privacy by treating data as a distinct class of assets requiring a specialized institutional order.

The podcast is based on the following article:

• Datenökonomie – Zwischen ordnungspolitischer Inversion und staatlicher Willkür, in: Bechtold, S. and Spiecker, I. (eds.), Law, Behavior and Decision – Recht, Verhalten und Entscheidung: Festschrift für Christoph Engel, Baden-Baden: Nomos, 2026, pp. 481-495.

This whitepaper examines the integration of artificial intelligence into the daily lives of children and adolescents, focusing on its role in education, social media, and leisure activities. The authors highlight how AI can foster educational equity and individualized learning while simultaneously posing risks to the cognitive and emotional development of young users. Key concerns addressed include the vulnerability of minors to manipulation, algorithmic bias, and significant privacy risks associated with data collection. To mitigate these dangers, the text advocates for a multidisciplinary approach involving legal frameworks, age-appropriate design, and the promotion of AI literacy. Ultimately, the document and podcast characterize the responsible shaping of AI as a collective societal duty to protect children’s rights and autonomy in a digital world.

For the link of the publication of the article mentioned above, please click here.

The article investigates the complex relationship between academic experts and the political sphere, highlighting how scientific policy advice is often hindered by a lack of empirical consensus and a prevailing reproduction crisis in research. Moving beyond the ideal of objective guidance, the authors apply an economic lens to reveal that both politicians and advisors are frequently driven by self-interest, seeking to maximize their own power, prestige, and income rather than serving the public good. The text argues that modern social media has transformed researchers into communication instruments, where a scholar's personal brand is used by officials to legitimize predetermined agendas rather than to foster genuine evidence-based reform.

For the link of the publication of the article mentioned above, please click here.

The European Union has introduced the AI Act, aimed at establishing a comprehensive framework for regulating AI systems according to the level of risk they pose. This podcast focuses on the ex post dimension of digital vulnerability, identifying four obstacles that hinder individuals from seeking remedies through tort liability: the difficulty in identifying harm, the presence of pure economic loss, the quantification of non-material damage and the issue of federalism. Recognising these four elements provides a basis for reclassifying AI systems based on the nature of harm they may cause. This podcast will be explored through the article ‘Developing a harm-based approach to understand digital vulnerability in the era of AI: a perspective of the European Union’. This article is written by Klaus Heine and Shu Li.

For the link of the publication of the article mentioned above, please click here.

Ignacio Cofone’s book “The Privacy Fallacy” is the starting point for a methodological discussion about how the notion of privacy is approached by law. It is distinguished between law as a practice and law as science. The first is a technique of conflict resolution, while the latter derives empirically testable hypotheses from a theory. In “The Privacy Fallacy” we find both. Epistemological problems arise when the two approaches are not analytically separated. This discussion is guided by the article ‘What do privacy scholars maximize? – Law as a practice and law as a science’, written by prof. Heine.

For the link of the publication of the article mentioned above, please click here.

To get a better understanding of the fundamental problem that economic analysis of law has with autonomous decision-making, different routes for solving the problem are scrutinized. The analysis shows that the toolbox of Law and Economics does not yet provide a clear answer. Doctrinal law can also give no conclusive answers. Instead, this contribution proposes taking a closer look into legal history. The recourse to legal history can neither replace theory, nor can legal rules from the past be transplanted to the present. Yet, a look into legal history can provide fresh ideas on how to deal effectively with the challenges of autonomous decision-making. This podcast is guided by the following paper of prof. Heine: ‘Autonomous Decision-Making as a Challenge for Legal Research’.

For the link of the publication of the paper mentioned above, please click here.

The GDPR has shaken up the world for both businesses and consumers. New rights and obligations have emerged, and many revolve around various data protection requests. The recent case C-307/22 was analysed by Larisa Munteanu in a brief study that highlights how inconsistency may arise from attempted consistency, at EU level: Can "abusive requests" be both the genre and the species in certain circumstances? Should more guidelines be issued? The case note raised such questions, but also addressed the implications of the CJEU ruling in the context of data protection interpretations and several Private Law branches.

For the link of the publication of the study mentioned above, please click here.