The availability of data is a condition for the development of AI. This is no different in the context of healthcare-related AI applications. Healthcare data are required in the research, development, and follow-up phases of AI. In fact, data collection is also necessary to establish evidence of compliance with legislation. Several legislative instruments, such as the Medical Devices Regulation and the AI Act, enacted data collection obligations to establish (evidence of) the safety of medical therapies, devices, and procedures. Increasingly, such health-related data are collected in the real world from individual data subjects. The relevant legal instruments therefore explicitly mention they shall be without prejudice to other legal acts, including the GDPR. Following an introduction to real-world data, evidence, and electronic health records, this chapter considers the use of AI for healthcare from the perspective of healthcare data. It discusses the role of data custodians, especially when confronted with a request to share healthcare data, as well as the impact of concepts such as data ownership, patient autonomy, informed consent, and privacy and data protection-enhancing techniques.

There is no doubt that AI systems, and the large-scale processing of personal data that often accompanies their development and use, has put a strain on individuals’ fundamental rights and freedoms. Against that background, this chapter aims to walk the reader through a selection of key concerns arising from the application of the GDPR to the training and use of such systems. First, it clarifies the position and role of the GDPR within the broader European data protection regulatory framework. Next, it delineates its scope of application by delving into the pivotal notions of “personal data,” “controller,” and “processor.” Lastly, it highlights some friction points between the characteristics inherent to most AI systems and the general principles outlined in Article 5 GDPR, including lawfulness, transparency, purpose limitation, data minimization, and accountability.

The central aim of this book is to provide an accessible and comprehensive overview of the legal, ethical, and policy implications of AI and algorithmic systems more broadly. As these technologies have a growing impact on all domains of our lives, it is increasingly important to map, understand, and assess the challenges and opportunities they raise. This requires an interdisciplinary approach, which is why this book brings together contributions from a stellar set of authors from different disciplines, with the goal of advancing the understanding of AI’s impact on society and how such impact is and should be regulated. Beyond covering theoretical insights and concepts, the book also provides practical examples of how AI systems are used in society today and which questions are raised thereby, covering both horizontal and sectoral themes. Finally, the book also offers an introduction into the various legal and policy instruments that govern AI, with a particular focus on Europe.

Chapter 3 explores how EU data protection law relates to public–private direct cooperation on digital evidence in criminal investigations. It asks if a neat prima facie separation of the GDPR and the LED matches the realities of private-to-public data transfers for criminal investigations, and if that legal framework is harmonious enough to warrant description as an EU data protection acquis. It distinguishes scenarios of formal (and informal) direct cooperation, viewed through the conceptual prism of data controllership. It applies that frame to the European Commission’s 2018 ‘e-Evidence package’, along with co-legislators’ competing visions, before looking at the final 2023 compromise text from a data protection perspective. It discusses how far CJEU case law illuminates theoretical blind spots and if the ongoing strengthening of enforcement powers is likely to herald not only greater legal certainty on the supply of digital evidence but also meaningful, workable data subject rights. Last, it reflects on the future place of EU data protection standards within the Council of Europe’s own new direct cooperation mechanism – the Second Additional Protocol to the Budapest Convention.

The risks emanating from algorithmic rule by law lie at the intersection of two regulatory domains: regulation pertaining to the rule of law’s protection (the EU’s rule of law agenda), and regulation pertaining to the protection of individuals against the risks of algorithmic systems (the EU’s digital agenda). Each of these domains consists of a broad range of legislation, including not only primary and secondary EU law, but also soft law. In what follows, I confine my investigation to those areas of legislation that are most relevant for the identified concerns. After addressing the EU’s competences to take legal action in this field (Section 5.1), I respectively examine safeguards provided by regulation pertaining to the rule of law (Section 5.2), to personal data (Section 5.3) and to algorithmic systems (Section 5.4), before concluding (Section 5.5).

Some of the most important challenges flowing from the rise of algorithmic management for employment law, broadly conceived as encompassing both the individual and collective dimension of employment relation, as well as associated regulatory domains, including data protection and anti-discrimination law, insofar as they are relevant to the employment context, are examined.

This chapter explores the extraterritorial application of the U.S. sanctions: namely, the ability of those sanctions regulations to reach non-U.S. actors or activities taking place outside of the United States. The chapter examines a recent trend towards increasing extraterritorial enforcement by the U.S. sanctions authority. In particular, the chapter discusses the objections of China to such extraterritorial application of U.S. sanctions laws. Of particular focus are Russia’s and China’s attempts to de-dollarize and resort to alternative financial networks to lessen the impact of these sanctions.

Chapter 5 examines traditional data protection law’s regulatory outcomes. It shows why data rights and rules, while desirable, don’t address the core problems of the contracts model and can’t work well without the liability model. Data rights unintendedly impose administrative burdens on those they protect. Mandatory rules better address power asymmetries and manipulation than defaults. But our procedural rules overregulate while they underprotect: they benefit large players by adversely affecting new players and they allow companies to comply merely by following box-ticking exercises. Against this backdrop, laws legitimize exploitation that can be executed while remaining compliant. A risk-reduction approach based on standards would reduce informational exploitation.

The fourth letter in the acronym ABCD stands for Data. Against the background of the Big Data Age this chapter discusses the relationship between data and financial regulation in four major jurisdictions: US, EU, China and India. We argue that data regulation is a crucial cornerstone that influences how FinTech infrastructure can be designed, built and operated, and thus influences the emergence of FinTech ecosystems. For FinTech, data regulation is a new form of financial regulation.

The chapter explores the question of how different domestic and international law approaches to regulating the international transfer of personal data deal with cybersecurity threats. It examines the 2016 EU General Data Protection Regulation, the 2021 UK National Security and Investment Act, and the 2018 United States, Mexico and Canada Agreement, as representing distinct approaches for regulating international data transfers, namely data protection legislation, investment screening legislation, and digital trade agreements. The analysis demonstrates that a lack of uniformity in terms of what constitutes an adequate level and design of data protection mechanisms has left the issue of how to distinguish between acceptable and non-acceptable data-transfer restrictions largely unresolved.

Under public international law, a State has a right to exercise jurisdiction. States are expected to show restraint when attempting to regulate a situation with foreign elements. The research outlines territory- and personality-based permissive principles of jurisdiction. EU data protection provisions that lend themselves to extraterritorial application fall into the subjective territoriality, objective territoriality, passive personality, effects doctrine and potentially protective principles of jurisdiction. The provisions do not come under any one of these principles, but rather an interpretation of several of them. The applicable law articles in the General Data Protection Regulation could most plausibly constitute the objective territoriality (where an act is terminated) and passive personality (the nationality of a victim) principles. Whilst there appears to be a shift from territory to personality, for example, by referring to data processing in the context of activities ‘in the Union’ or individuals ‘subject to the jurisdiction of’ rather than data processing in the context of the activities ‘on the territory of a Member State’ or ‘in the territory of’ each state party’, to justify the exercise of jurisdiction, territory is still necessary to trigger the application of jurisdiction in the online sphere.

Sector-specific regulations apply in several network industries. The telecom sector and infrastructures such as utilities have been regulated based on the notion that they are natural monopolies and need to be regulated to prevent facilitation of monopolies. However, in the beginning of the internet era, large tech escaped regulation.1