Restoring Legal Certainty in EU Data Protection Law
The final DigiData report on contextual identifiability, anonymisation assurance, scientific research, AI development and supervisory governance in the Digital Omnibus.
Technology law & regulatory strategy
Clarity for high-stakes digital systems.
DigiData helps technology companies, institutions and regulators turn complex digital rules into defensible decisions, rigorous evidence and workable implementation.
Led by Dr M.R. Leiser and strengthened by a purpose-built international network of legal, technical, behavioural, economic and policy experts when a project demands more than one discipline.
The DigiData method
01 · LawIdentify the real legal question
02 · EvidenceTest doctrine against systems and use cases
03 · StrategyBuild a position that survives scrutiny
04 · OutcomeMake the decision workable
Independent analysis. Direct advice. The right expertise assembled around the problem.
DigiData at a glance
Selected capability, work and publication numbers.
A quick overview of the service areas, selected engagements and public work currently featured on the site.
6connected service areas across digital regulation
10selected engagements and public-capacity examples
18public and forthcoming works in the library
0marketing trackers or non-essential cookies
Featured research
Current research and public contributions.
Recent reports and expert contributions on data protection, digital fairness and regulatory policy.
Dark Patterns Are Only the Surface
Slides, prepared remarks and a companion lecture from the European Economic and Social Committee hearing on the Digital Fairness Act, commercial practices and the evidence needed for enforcement.
Quoted in The Wall Street Journal
Mark Leiser examines consent and the pace of live shopping auctions in the newspaper’s investigation of Whatnot.
What DigiData does
Advice built around the decision, not the acronym.
Digital regulation rarely arrives as one clean legal question. DigiData connects doctrine, evidence, institutional incentives, system design and the consequences of implementation.
Digital regulatory strategy, legislative reform and institutional design
Strategic legal and policy analysis where overlapping digital rules, supervisory discretion and institutional design determine what can be built, shared or scaled.
- EU and UK digital regulation and regulatory overlap
- Legislative options, institutional reform and policy architecture
- Regulatory engagement, positioning and implementation strategy
Independent research, expert evidence, training and strategic briefings
Research and communication designed for decision-makers who need a position that can survive legal, political, technical and public scrutiny.
- Independent studies, evidence reviews and publishable reports
- Expert evidence, independent challenge and quality assurance
- Executive briefings, workshops, training and lecture programmes
AI governance, prohibited practices and regulatory implementation
Practical interpretation of the AI Act and adjacent regimes, focused on system architecture, actual use, affected people and defensible routes to deployment.
- AI Act implementation and prohibited practices
- Governance, oversight, evidence and documentation
- Use-case analysis, regulatory classification and risk calibration
Data protection, anonymisation, data access and assurance
Actor-specific identifiability, anonymisation evidence, data-access architecture and assurance methods that preserve legal status without destroying lawful utility.
- Contextual anonymisation, pseudonymisation and data status
- Data-access regimes and privacy-utility analysis
- DPIAs, impact assessment, assurance and independent review
Platform regulation, digital fairness and deceptive design
Analysis that connects interface design, system architecture, personalisation, market power and the combined operation of consumer, data and platform law.
- DSA, DMA, consumer law and the Digital Fairness agenda
- Dark patterns and deceptive system design
- Personalisation, recommender systems and consumer autonomy
Child safety, children’s rights and AI in education
Rights-based regulatory design for services and systems affecting children, with attention to evidence, proportionality, education and the limits of techno-solutionism.
- Child safety, age assurance and age-appropriate design
- Children’s rights and platform governance
- AI literacy, quality education and AI in education
DigiData
project lead
project lead
Legal doctrine
Technology
Behaviour & design
Economics
Policy practice
Sector expertise
Purpose-built expert network
One accountable lead. The range of expertise the work actually needs.
DigiData assembles purpose-built teams from a trusted international network of legal scholars, regulatory specialists, technologists, economists, behavioural researchers, designers, child-rights experts and sector specialists. Each team is configured around the problem rather than a permanent consultancy hierarchy.
DigiData defines the analytical architecture, selects and coordinates the necessary expertise, and retains responsibility for the coherence, quality and delivery of the work.
1
Define the problem precisely
Identify the legal, technical, behavioural and institutional questions that need separate treatment.
2
Assemble selectively
Bring in specialists only where their contribution improves the analysis or the credibility of the output.
3
Integrate, do not aggregate
Produce one coherent position rather than a bundle of disconnected expert views.
Selected engagements
Work that combines doctrine, evidence and institutional judgement.
The examples distinguish commissioned work, research partnerships, public submissions and earlier academic work completed in a personal capacity. They are not presented as a uniform client list.
European Commission AI Office
Interpreting the AI Act’s prohibitions on manipulation and exploitation
A final study report combining legal interpretation, stakeholder input, practical use cases, enforcement analysis and cross-regulatory mapping for Article 5(1)(a) and (b) of the AI Act.
Contribution: A public Commission study designed to improve legal clarity, support harmonised application and strengthen practical enforcement.
Dutch Ministry of the Interior and Kingdom Relations
Deceptive design in online services used by children
A comparative legal and policy study of interface tactics, system-level manipulation, personalisation, gamification and commercial exploitation affecting minors.
Contribution: Child-centred proposals on design standards, algorithmic scrutiny, enforcement and the development of a coherent digital-fairness framework.
Council of Europe
Artificial intelligence in education
Use-case mapping, legal gap analysis and regulatory design addressing AI systems operating within education as a protected public function.
Contribution: The working materials remain private. The engagement demonstrates DigiData’s ability to connect rights, educational quality, lifecycle duties and institutional implementation.
Selected organisations and collaborations
Experience across institutions, regulators, research and digital policy.
The marks record different forms of commissioned work, collaboration, participation or institutional engagement. They do not imply endorsement or a continuing client relationship.
Selected organisations and collaborations reflect different forms of commissioned work, participation, research, advisory activity or institutional engagement. Display does not imply endorsement, a current client relationship or agreement with every DigiData position.
Selected work
Research that becomes regulatory infrastructure.
Public studies, submissions and policy papers show how DigiData works: starting with difficult legal boundaries and ending with concrete institutional or operational choices.
PublishedReport for the European Commission on Article 5(1)(a) and (b) of the AI Act
A comprehensive analysis of subliminal, purposefully manipulative, deceptive and vulnerability-exploitative AI practices, including constitutive elements, enforcement challenges, use cases and interaction with the wider EU digital acquis.
PublishedAnalysis of Deceptive Design Techniques in Online Services Popular Among Children
A 155-page analysis of manipulative interfaces and system architecture, personalised influence, gamification, children’s vulnerabilities and the adequacy of the GDPR, DSA, UCPD and AI Act.
PublishedMaking Access to Google Search Data Work Without Inventing a Privacy Fiction
A submission on Article 6(11) DMA that preserves anonymisation as the legal condition for sharing personal search data, proposes tiered access modalities and introduces the AUIA.
PublishedThe Innovation Mandate
A proposal for a binding duty of evidence and public reason-giving when digital regulators choose among materially different lawful routes affecting rights, legal certainty, investment and scale.
PublishedFrom Individual Rights to Industrial Litigation
An analysis of collective redress, Article 82 GDPR, procedural fragmentation, forum selection, automation and the need to keep harm, procedure and remedy tightly coupled.
PublishedConsumer Interest and AI, Phase 2 Response: A Consumer AI Accountability Framework
An operational framework for adaptive and agentic consumer services, combining a five-tier functional risk ladder with mandates, action receipts, prohibited optimisation objectives, vulnerability-event controls, rights-friction parity, evidence packs, redress by design and earned safe harbours.
Products in development
From a legal conclusion to a usable assurance record.
TRACE and the AUIA are being developed as complementary components of a documentation stack for contextual data-status claims. The public website presents the concepts, not the tools.
In development
TRACE Passport
A concise, portable record of what an assessed data-status claim covers, for whom it applies, how the artefact may circulate and when reassessment is required.
Coming soon
AUIA
A structured evidence dossier for testing contextual anonymity first, retained utility second, and the access route and controls proportionate to any residual risk.
Blog and analysis
Current thinking without the noise.
The Blog brings together short notes, working observations and selected longer research essays, with clear links to the wider LawBhoy archive.
The Omnibus Must Build the Road
The EDPB has supplied an analytical map for anonymisation; the legislature must create the assurance system that makes it usable.
Read on SubstackAnonymisation, Innovation and the Missing Route to Lawful Use
The EDPB has improved the legal test, but organisations still need a reusable route to contextual anonymisation.
Read on SubstackAnonymisation, Two Ways
The EDPB’s new guidelines complicate the Commission’s Article 6(11) DMA playbook.
Read on SubstackLecture series
The Digital Fairness Act: What Europe Must Get Right
Five lectures examine the object of regulation, material distortion, relational vulnerability, evidence and enforcement.
Start a conversation
A difficult digital-regulation question deserves more than a generic compliance answer.
Tell DigiData what decision, dispute or policy problem you need to resolve. The initial enquiry form is designed to establish scope, urgency and the expertise the work may require.