This article argues that civil liability in EU digital regulation does more than enforce regulatory duties or compensate damage arising from regulatory breaches: it also produces governance effects by specifying regulatory duties and (re)allocating regulatory risks between market actors. Drawing on regulatory theory and examples from the case law of the Court of Justice and national courts in the fields of data protection, online platform regulation and competition law, the article demonstrates how these duty-specifying and risk-allocating effects emerge through the very structure of compensation claims: damage, unlawfulness and causation.
This case note comments on the preliminary ruling of the Court of Justice of the EU in Case C-526/24 Brillen Rottler v TC of 19 March 2026, which addresses the abuse of rights under the General Data Protection Regulation (GDPR), specifically in the context of requests for access to personal data under Article 15 GDPR and compensation under Article 82 GDPR. First, the Court held that even a first access request may be regarded as “excessive” where the controller demonstrates that it was not made to be aware of the data processing and verify its lawfulness, but with an abusive intention, such as artificially creating the conditions for a compensation claim. Publicly available information showing a pattern of repeated requests and claims to different controllers may be considered in this assessment. Second, the Court confirmed that a right to compensation can arise from an infringement of the right of access. Third, it clarified that non-material damage in those cases encompasses the loss of control over the personal data or the uncertainty about its processing, provided the data subject has actually suffered such damage and has not caused it through their own conduct. This note situates the judgment within the broader framework of case law on the abuse of rights and the recent Digital Omnibus proposal, and it outlines its practical significance for balancing the protection of the data subjects with the need to safeguard controllers against illegitimate claims.
The year 2024 marked a turning point for EU delict law, as the EU adopted a new Product Liability Directive to replace its 1985 predecessor. The new Directive, however, does more than modernise product liability law. It also reflects a deeper shift in how the EU uses private law as a tool of governance. While doctrinal commentary has largely treated the Directive as a remedial private-law instrument, this article argues that it also pursues regulatory functions. In that sense, it reflects the increasingly blurring boundary between private and public law, a development already noted in European legal scholarship. This article contributes to that debate in three ways. First, it shows how that regulatory dimension is expressed through the Directive’s objectives, namely the internal market, innovation, the circular economy and private enforcement. Second, it argues that those objectives are not relevant in every dispute, but only where particular provisions giving effect to them are applied. Third, it proposes a three-step test for determining when regulatory objectives are relevant in a given dispute and examines the consequences that follow: where this is so, those provisions should be interpreted differently from classic private-law provisions, through a forward-looking reading that advances those regulatory aims.
The advancement of AI relies on text and data mining (TDM) to acquire training data, yet its large-scale algorithmic crawling activities fundamentally conflict with copyright regimes. Through comparative legal research, this article reveals the divergent governance approaches and efficacy deficiencies within the three major jurisdictions of the European Union, the United States and China. We argue that the current regulatory model adopted by the EU may adversely affect the dynamism of Europe’s AI industry. At the policy level, the EU should construct a synergistic “Cost-Benefit-Governance” framework, reducing compliance costs through differentiated regulation, collective licensing, and fiscal support measures. It should also leverage unified internal rules and international multilateral platforms to foster governance consensus. In legal practice, the EU should advance the clarification and tiered application of copyright exceptions. This can be achieved by refining rules, implementing data classification governance and innovating safe harbour liability mechanisms to enhance legal predictability, thereby balancing technological innovation and copyright protection. This framework aims to mitigate the inhibitory effect of current systems on AI innovation and address jurisdictional barriers through international cooperation.
Modern regulatory frameworks assume that the phenomena they govern are knowable: harms can be identified, probabilities estimated and risks balanced against benefits. This article argues that this assumption becomes unstable when applied to genuinely novel technologies. Drawing on Frank Knight's distinction between risk and uncertainty, it contends that contemporary EU digital regulation - particularly the EU AI Act, alongside the Digital Services Act and the GDPR - applies the form of risk-based analysis to domains where the necessary epistemic foundations are absent. These regimes borrow models developed for pharmaceuticals and environmental regulation and extend them to technologies whose future effects remain deeply uncertain. The article traces the historical development of risk-based regulation, examining both its virtues and structural limitations. It argues that such frameworks systematically marginalize diffuse, long-term and structural harms, while delegating assessment to regulated entities thus creating incentives for conservative self-evaluation. It then explores decision-making under deep uncertainty (DMDU) as a source of alternative regulatory approaches, including adaptive and precautionary techniques. Finally, the article argues that risk assessment is inherently political, embedding normative choices that risk-based methodologies often obscure rather than resolve.
