Generative artificial intelligence (AI) systems, such as large language models, image synthesis tools, and audio generation engines, present remarkable possibilities for creative expression and scientific discovery but also pose pressing challenges for privacy governance. By identifying patterns in vast troves of digital data, these systems can generate hyper-realistic yet fabricated content, surface sensitive inferences about individuals and groups, and shape public discourse at an unprecedented scale. These innovations amplify privacy concerns about nonconsensual data extraction, re-identification, inferential profiling, synthetic media manipulation, algorithmic bias, and quantification. This article argues that the current U.S. legal framework, rooted in a narrowly targeted sectoral approach and overreliance on individual notice and consent, is fundamentally mismatched to address the emergent and systemic privacy harms of generative AI. It examines how the unprecedented scale, speed, and sophistication of these systems strain core assumptions of data protection law, highlighting the misalignment between AI’s societal impacts and individualistic, reactive approaches to privacy governance. The article explores distinctive privacy challenges posed by generative AI, surveys gaps in existing U.S. regulations, and outlines key elements of a new paradigm to protect individual and collective privacy rights that (1) shifts from individual to collective conceptions of privacy; (2) moves from reactive to proactive governance; and (3) reorients the goals and values of AI governance. Despite significant obstacles, it identifies potential policy levers, technical safeguards, and conceptual tools to inform a more proactive and equitable approach to governing generative AI.

It is widely presumed that privacy is ‘factive’, i.e. that it cannot be diminished by accessing or disseminating falsehoods. But if this is so, what wrongs are committed in cases where others access documents of ours (letters, medical records, etc.) which contain false information? In this article, I examine various ways of explaining the wrongfulness of accessing and dissemination falsehoods (defamation; that privacy can be violated without being diminished; ‘control’ accounts of privacy; downstream revelations of truths; that falsehoods diminish ‘propositional’ or ‘attentional’ privacy). I lay out what each of these accounts misses about accessing falsehoods, about privacy, and/or about the right to privacy. I then propose two alternative ways of accounting for the intuitive wrongfulness of accessing and disseminating falsehoods: viewing them as merely ‘attempted’ privacy violations and weakening the truth condition of privacy diminishments.

Competition law is experiencing a transformation from a niche economic tool to a Swiss knife of broader industrial and social policy. Relatedly, there is a narrative that sees an expansive role for competition law in broad areas such as sustainability, privacy, and workers and labour rights, and a counternarrative that wants to deny it that role. There is rich scholarship on this area, but little empirical backing. In this article, we present the results of a comprehensive empirical research into whether new goals and objectives such as sustainability, privacy, and workers and labour rights are indeed endorsed in EU competition law and practice. We do so through an investigation into the totality of Court of Justice rulings, Commission decisions, Advocate General opinions, and public statements of the Commission. Our findings inject data into the debate and help dispel misconceptions that may arise by overly focusing on cherry-picked high-profile decisions while overlooking the rest of the EU’s institutional practice.

We find that sustainability is partially recognised as a goal whereas privacy and labour rights are not. We also show that all three goals are more recent than classic goals, that EU institutions have not engaged much with the areas of sustainability, privacy, and workers and labour rights, and that the Commission’s rhetoric is seemingly out of pace with decisional practice. We also identify trends that may bode for change, and we contextualize our analysis through the lens of the history and nature of the EU’s integration and economic constitution.

This article explores Vietnam’s distinctive approach to data privacy regulation and its implications for the established understandings of privacy law. While global data privacy regulations are premised on individual freedom and integrity of information flows, the recent Vietnamese Decree 13/2023/NĐ-CP on Personal Data Protection (herein PDPD) prioritise state oversight and centralised control over information flows to safeguard collective interests and cyberspace security. The fresh regulatory logic puts data privacy under the regulation of government agencies and moves the privacy law arena even further away from the already distant judicial power. This prompts an exploration of the nuances underlying the ways regulators and the regulated communities understand data privacy regulation. The article draws on social constructionist accounts of regulation and discourse analysis to explore the epistemic interaction between regulators and those subject to regulation during the PDPD’s drafting period. The process is highlighted by the dynamics between actors within a complex semantic network established by the state’s policy initiatives, where tacit assumptions and normative beliefs direct the way actors in various communities favour one type of thinking about data privacy regulation over another. The findings suggest that reforms to privacy laws may not result in “more privacy” to individuals and that divergences in global privacy regulation may not be easily explained by drawing merely from cultural and institutional variances.

Algorithmic human resource management (AHRM), the automation or augmentation of human resources-related decision-making with the use of artificial intelligence (AI)-enabled algorithms, can increase recruitment efficiency but also lead to discriminatory results and systematic disadvantages for marginalized groups in society. In this paper, we address the issue of equal treatment of workers and their fundamental rights when dealing with these AI recruitment systems. We analyse how and to what extent algorithmic biases can manifest and investigate how they affect workers’ fundamental rights, specifically (1) the right to equality, equity, and non-discrimination; (2) the right to privacy; and, finally, (3) the right to work. We recommend crucial ethical safeguards to support these fundamental rights and advance forms of responsible AI governance in HR-related decisions and activities.

Generative artificial intelligence (AI) has catapulted into the legal debate through the popular applications ChatGPT, Bard, Dall-E and others. While the predominant focus has hitherto centred on issues of copyright infringement and regulatory strategies, particularly in the context of the AI Act, a critical but often overlooked issue lies in the friction between generative AI and data protection laws. The rise of these technologies highlights unresolved tension between safeguarding fundamental protection rights and and the vast, almost universal, of scale of data processing required for machine learning. Large language models, which scrape nearly the whole Internet rely on and may even generate personal data falling under the GDPR. This tension manifests across multiple dimensions, encompassing data subjects’ rights, the foundational principles of data protection and the fundamental categories of data protection. Drawing on ongoing investigations by data protection authorities in Europe, this paper undertakes a comprehensive analysis of the intricate interplay between generative AI and data protection within the European legal framework.

In our digitalized modern society where cyber-physical systems and internet-of-things (IoT) devices are increasingly commonplace, it is paramount that we are able to assure the cybersecurity of the systems that we rely on. As a fundamental policy, we join the advocates of multilayered cybersecurity measures, where resilience is built into IoT systems by relying on multiple defensive techniques. While existing legislation such as the General Data Protection Regulation (GDPR) also takes this stance, the technical implementation of these measures is left open. This invites research into the landscape of multilayered defensive measures, and within this problem space, we focus on two defensive measures: obfuscation and diversification. In this study, through a literature review, we situate these measures within the broader IoT cybersecurity landscape and show how they operate with other security measures built on the network and within IoT devices themselves. Our findings highlight that obfuscation and diversification show promise in contributing to a cost-effective robust cybersecurity ecosystem in today’s diverse cyber threat landscape.

The world is witnessing an increase in cross-border data transfers and breaches orchestrated by State and non-State actors. Cross-border data transfers may lead to friction among States to localize or globalize data and to provide regulatory frameworks. “Data warfare” or information-war operations are often not covered under conventional rules; however, they are categorized as acts of espionage and subject to domestic regulations. As such, the operations are used to achieve a variety of objectives, including stealing sensitive information, spreading propaganda, and causing economic damage. Notable instances of the theft of sensitive information include the recent Bangladesh government website breach, exposing 50 million records, and the Unique Identification Authority of India (UIDAI) website hack.

Regulating the “data war” under the existing principles of international law may be unsuccessful in creating robust international legal frameworks to address the associated challenges. These developments further accentuate the global divide between data-rich regions in the Global North, with strong data protection mechanisms (such as the GDPR and the California Privacy Rights Act), and regions in the Global South, where there is a lack of comprehensive data protection laws and regulatory regimes. This disparity underscores the urgent need for global cooperation for substantial international regulatory mechanisms.

This article examines the complexities surrounding data warfare; it highlights the imperative need for establishing a robust global legal framework for data protection, delving into the concept of data war. It also acknowledges the growing influence of advanced technologies like data computing and mining and their ongoing threats to the fundamental rights of individuals associated with exposed personal data. The authors address the deficiencies in international legal provisions and advocate for a global regulatory approach to data protection as a critical means of safeguarding personal freedoms and countering the escalating threats in the digital age.

This article examines what the state of the law regarding the tortious protection of the privacy of corporations tells us about the concept of a legal person. Given that non-human persons are capable of having an interest in at least their informational privacy, logic would seem to dictate that they should be recognised such a right protecting their personality. In reality, the law is most hesitant to concede the right to privacy to non-natural persons (the same being true of reputation). This suggests that, for the dominant strand of the law at least, despite the rhetoric, legal persons do not really have rights of personality; in other words, that they are not really persons.