Legal challenges in Data Driven Innovation

Legal challenges in Data Driven Innovation, edited by Jonida Milaj, brings together fifteen contributions across data and innovation, AI and data, and data spaces and global challenges. Published in 2026 following a 2025 Groningen workshop, the collection examines tensions among technological development, rights, competition, institutional capacity, and unequal power. This guide explains the contributors’ questions and arguments in the book’s context. Study tasks support legal analysis and evidence evaluation rather than provide a compliance checklist for a real project.

Chapter-wise summaries and study tasks

Chapter 1: The Reality of the GDPR's Deterrent Effect

Carmen Pennanen examines whether the GDPR’s enforcement arrangements create the deterrence its goals require. A maximum available fine and a consistently effective enforcement system are different things. The argument connects sanctions with enforcement capacity, coordination, and how organizations assess the likelihood and consequences of noncompliance.

Read the proposed reforms as responses to an institutional problem rather than assume larger penalties alone establish better protection. Evaluate which evidence measures complaints, investigations, decisions, delay, or changed behavior. Those indicators address different stages and cannot simply be substituted for one another. The chapter invites scrutiny of the gap between formal rights and their implementation.

Study task. Reconstruct the deterrence argument as a causal chain. Identify evidence needed at each stage and compare a sanction-focused reform with one addressing enforcement resources or coordination.

Chapter 2: GDPR: Innovating the Right to Be Forgotten with Blockchain

Cristian Costin considers the tension between blockchain architectures and the right to be forgotten. Persistence and decentralized operation can conflict with expectations about changing or removing personal information. The chapter explores legal and technical adaptation rather than treating all blockchain designs as identical or assuming one solution removes the difficulty.

Separate where information is stored, who can influence it, and what remains linkable after a proposed intervention. Removing access, changing a key, or altering an external reference may have different consequences from erasing underlying information. Evaluate a solution through the actual system and the right being considered, with attention to residual identifiability and responsibility.

Study task. Map a hypothetical blockchain data flow, distinguishing on-chain and off-chain material. Compare two proposed responses to an erasure request and identify the factual and legal assumptions each requires.

Chapter 3: Schrödinger’s Data: Rethinking the Binary Distinction Between Personal and Non- Personal Data in the Age of Synthetic Information.

Vilma Margarit uses synthetic information to question a simple personal-versus-nonpersonal data distinction. Data generated rather than directly recorded can still raise identification and inference questions depending on its origin, structure, context, and combination with other information. The chapter’s thought experiment encourages attention to uncertainty rather than assuming a label settles classification.

Separate a synthetic-data generation claim from evidence of privacy protection. Evaluation needs a stated threat model and an understanding of what a recipient can infer. The contribution raises a conceptual challenge to binary classification; it should not be read as declaring every synthetic dataset either categorically regulated or categorically outside protection.

Study task. Compare two synthetic datasets with different source dependence and available linking information. Explain which facts would change the classification analysis and what evidence would test a claim of reduced identification risk.

Chapter 4: Data Ownership, Consent, and User Privacy in the World of Video Games

Willem Drapers examines data ownership language, consent, and privacy in video games, including providers operating across several lines of business. Collection for gameplay and reuse for another commercial purpose raise different questions. The contribution emphasizes purpose limitation as a way to evaluate boundaries around repurposing, rather than treating initial participation as unlimited permission.

Trace the actual information and actors before accepting the language of ownership. Behavioral records, account information, inferred interests, and advertising relationships can involve different roles and expectations. The analytical task is to connect a stated purpose with collection, subsequent use, and the meaningful choices available to players.

Study task. Draw a fictional game-data ecosystem with collection purposes and later recipients. Identify where a new use changes the analysis and distinguish a consent interface from evidence that the particular reuse is justified.

Chapter 5: Automated Vehicles and the lawfulness of data processing under Art. 6 GDPR

Maximilian Kloth analyzes lawful grounds for data processing in automated vehicles through the GDPR’s Article 6 framework. Vehicles can process information about occupants and others in the surrounding environment, making one account holder’s agreement an incomplete description of every affected person. Different processing purposes require separate analysis.

Safety, navigation, product improvement, and additional commercial uses should not be collapsed into one technical necessity. Identify the controller, information, purpose, affected people, and proposed ground before assessing an argument. The chapter examines the legal problem in the collection’s context; a real system would need current, fact-specific evaluation rather than a single ground selected from this summary.

Study task. Separate three processing purposes in a hypothetical automated vehicle. For each, list the missing facts needed to assess a proposed lawful basis, including people captured incidentally by environmental sensing.

Chapter 6: Sailing into Monopoly: How Data Accumulation by Autonomous Ships Violates Competition Law

Inés López Abad connects autonomous shipping with data accumulation and competition concerns. Operational data can support improved systems while also strengthening incumbents’ advantages and making entry or interoperability more difficult. The chapter examines how control of information may translate into market power rather than assuming that technological efficiency and competitive openness always move together.

A competition argument needs a defined market, mechanism, and evidence of effects. Large datasets alone do not settle every legal question. Compare claims about scale, access, feedback loops, and barriers, asking whether a proposed remedy preserves useful development while addressing the specific source of exclusion.

Study task. Build a data-advantage feedback diagram for a fictional shipping platform. Identify the evidence needed to connect accumulated data with an entry barrier and compare two remedies against that mechanism.

Chapter 7: Porter's Hypothesis: Reframing the Effects of the GDPR on AI Innovation

Karabo Lerato Mokoena revisits the regulation-versus-innovation debate through Porter’s hypothesis and the GDPR’s relationship with AI development. The contribution asks what kind of innovation should be encouraged, recognizing that compliance burdens and rights-protective design incentives can coexist. Innovation is not a single quantity independent of social objectives.

Separate short-term cost claims from arguments about longer-term changes in products, practices, trust, or market structure. A regulation can shape the direction of development without ensuring every effect is beneficial. Evaluate the proposed mechanism and counterfactual rather than infer success or failure simply from the presence of legal constraints.

Study task. Compare a cost-only account with an innovation-quality account of the same fictional rule. Specify outcomes, timescale, and a plausible comparison needed to assess each argument.

Chapter 8: Anonymisation as a Tool for Data Protection for AI Model Training

Marina El Moufti examines anonymisation for AI training and the difficulty of managing re-identification risk. Removing obvious identifiers is not the same as demonstrating that data can no longer be linked to people under relevant conditions. Dataset combination, background knowledge, and model-related risks make context important. The chapter acknowledges limits and considers ways of managing them.

Assess anonymisation as an evidence-based process with assumptions, not a permanent assurance supplied by a filename. Distinguish input-data protection from questions about information retained or exposed through a trained model. A useful evaluation states who might attempt identification, what resources are available, and how risks are monitored.

Study task. Write a threat model for a hypothetical training dataset. Compare a simple identifier-removal step with a fuller anonymisation assessment and explain which residual risks require testing or additional controls.

Chapter 9: The Use of Automated Deception Detection for Law Enforcement in the EU: Regulatory and Technical Assessment under the AI Act

Natálie Binderová evaluates automated deception detection in EU law enforcement from regulatory and technical perspectives. A system’s claimed ability must be distinguished from validated accuracy, robustness, and suitability in the actual setting. The chapter examines qualification under the AI Act and shortcomings that matter when a prediction can influence treatment of individuals.

Consider the reference standard, population, conditions, and consequences of errors. An overall accuracy figure can hide unequal performance or an unsuitable test setting. The legal discussion concerns the contribution’s analysis and publication context; it does not establish that a particular current tool is permitted or reliable.

Study task. Evaluate a fictional validation report for a deception-detection system. Identify missing information about ground truth, population, errors, and use, then explain how those gaps affect the legal and rights analysis.

Chapter 10: The Legal and Ethical Challenges Posed by AI-Assisted Police Reports in the Criminal Procedure

Konstantina Kelesidi studies AI-assisted police reporting and its implications for criminal procedure. Turning observations or notes into an authoritative narrative can introduce errors, omissions, or framing that later readers find difficult to detect. Human review is important, but its presence alone does not prove that the original evidence and generated account remain traceable.

The chapter connects these issues with fair-trial concerns and the presumption of innocence. Distinguish an administrative drafting benefit from the evidential role a report may later acquire. Accountability requires examining provenance, review, disclosure, and the ability to challenge a disputed statement rather than treating polished language as a sign of reliability.

Study task. Trace a hypothetical observation through notes, AI draft, human revision, and final report. Mark where a contested statement could be introduced and what records would allow it to be checked.

Chapter 11: Consent as a Catalyst? The GDPR, the DGA, and the Role of Data Altruism Organizations in Fostering European Innovation

Paulina Anna Ryszkowska considers data altruism organizations under the GDPR and Data Governance Act framework. The contribution questions whether the promised innovation benefits outweigh legal and administrative burdens. Consent and an organizational label do not automatically establish useful, trusted access to data for research.

Reconstruct the author’s critical argument rather than generalize it into a claim that voluntary data sharing has no value. Compare the intended governance mechanism with the practical steps required of participants, organizations, and researchers. Evidence about uptake, cost, access, trust, and actual research use would help assess the proposed balance.

Study task. Map the steps required for a fictional data-altruism arrangement. Identify the burden at each step and propose evidence that could support or challenge the chapter’s assessment of added value.

Chapter 12: The European Health Data Space and Medical AI Devices

Mariam Ibrahim examines the European Health Data Space in relation to medical AI. The analysis recognizes the potential of improved data access while asking whether governance sufficiently addresses risks such as bias, data shifts, misuse, and limited explainability. Access to more information is not itself proof of a safe or useful medical system.

Separate data-space governance, model development, device evaluation, and clinical deployment. Each stage poses different questions, and responsibility can become unclear at their boundaries. This is an analysis of the contributor’s argument, not a recommendation about a medical device or a statement that data availability settles clinical suitability.

Study task. Draw a hypothetical health-data-to-device pathway. Identify a risk and responsible actor at each stage, then explain why lawful data access would not by itself validate the resulting clinical use.

Chapter 13: Patents, Data Privacy, and Innovation within the European Health Data Space

Darina Pitkevica connects the European Health Data Space with patents, privacy, innovation, and distribution of benefits. Data access and intellectual-property incentives can interact in ways that shape who can develop products and who gains from them. The chapter argues that legitimacy requires more than technological infrastructure or legal text alone.

Examine access, benefit sharing, and individual autonomy as related but distinct questions. A wider research pool does not automatically ensure equitable outcomes or resolve conflicting claims over downstream inventions. Compare the proposed public benefits with the institutional arrangements intended to deliver them, rather than allowing innovation to function as an untested justification.

Study task. Construct a stakeholder map for a fictional health-data innovation project. Compare access and benefit-sharing arrangements and identify evidence needed to judge their effects on research incentives and contributor autonomy.

Chapter 14: AI, Competition, and Geopolitics: Europe’s Need for Digital Independence

Luke Crofton Arbuthnot analyzes AI, competition, and geopolitics through Europe’s digital-independence ambitions. Dependency can concern infrastructure, platforms, computing resources, data access, or industrial capacity rather than a single foreign supplier. The argument links regulation with industrial policy and coordinated infrastructure development.

Digital sovereignty is an objective requiring definition and tradeoff analysis. A measure could increase local capacity while reducing competition or interoperability if poorly designed. Distinguish strategic aspiration from a supported causal account of how a policy changes dependence. Evaluate alternatives against the specific vulnerability and public objective being addressed.

Study task. Define one digital dependency in a fictional European sector. Compare regulatory, infrastructure, and industrial responses, identifying complementary measures and a possible unintended competition effect.

Chapter 15: Tracing Flight Lines Between Times: A Minimal Insight Into the Contemporary Reality of Data Colonialism in Latin America

Eduardo Aguirre Mercado examines data colonialism and the environmental and political relationships surrounding digital infrastructure in Latin America. The contribution expands attention beyond individual data rights to historical inequalities, resource use, and who controls or benefits from extraction. Data centers and AI supply chains connect apparently immaterial services with land, energy, water, labor, and governance.

A global analysis must identify concrete mechanisms rather than treat all local communities or countries as identical. Compare promised investment benefits with evidence about decision-making power, burdens, and alternatives. The chapter asks readers to incorporate these relationships into innovation debates instead of leaving them outside a narrowly technical success measure.

Study task. Map a fictional digital-infrastructure project across resources, ownership, public decisions, and affected communities. Identify evidence needed to distinguish a mutual-benefit claim from an arrangement reproducing unequal control.

How to study this book

1. Identify each contributor’s question, thesis, legal framework, evidence, and proposed response before comparing chapters.
2. Separate description of a legal provision from an interpretation, policy argument, or empirical claim about its effects.
3. Create data-flow and stakeholder maps before analyzing consent, access, responsibility, or competition.
4. Date legal sources and check current official texts, implementation stages, and relevant decisions before applying an argument to a real situation.
5. Use the three parts to connect rights, technical design, institutional capacity, and distributional effects rather than reviewing each in isolation.

Questions for reflection

• Which assumption about a technology carries the legal argument?
• What evidence would challenge the claimed effect of a rule or reform?
• Who gains control, who bears risk, and who can contest the outcome?

Source edition and coverage

This guide covers all fifteen contributions in the 2026 edited collection and attributes their positions as arguments. It reflects the volume arising from the March 2025 workshop and the editor’s March 2026 introduction; it is an educational reading guide, not current advice for a particular legal matter. These are original study explanations and learning tasks. Read the complete book at the official source.