EXECUTIVE SUMMARY 1

1 INTRODUCTION 6

PART I 9

2 MOVING AHEAD: THE QUEST FOR CHANGE 9

  2.1 USERS’ PERSPECTIVE 9

    2.1.1 CONSENT FATIGUE 12

    2.1.2 BEHAVIOURAL BIASES 13

    2.1.3 THE TRANSPARENCY GAP 13

    2.1.4 DEMAND FOR PERSONALISATION 14

    2.1.5 AI AS A TOOL FOR IMPROVING DATA PROTECTION 15

  2.2 FIRMS’ PERSPECTIVE 15

    2.2.1 DISPROPORTIONATE SME COMPLIANCE BURDEN 16

    2.2.2 REDUCED INNOVATION INCENTIVES 16

    2.2.3 VALUE OF DIVERSE DATASETS 17

    2.2.4 AI AS COMPLIANCE TOOL 18

  2.3 THE DUAL FRAMING AS FOUNDATION FOR PART II 18

3 THE BACKGROUND: EU DIGITAL REGULATION AT THE INTERSECTION OF DATA AND AI 20

PART II 23

4 THE DIGITAL OMNIBUS: A LEGAL AND LAW-AND-ECONOMICS ANALYSIS 23

  4.1 PERSONAL DATA IN THE AGE OF AI: A CONTESTED DEFINITION? 24

  4.2 AI MODEL TRAINING 27

    4.2.1 CODIFYING LEGITIMATE INTEREST AS THE LEGAL BASIS FOR AI TRAINING? 30

    4.2.2 RESIDUAL AND INCIDENTAL PROCESSING OF SPECIAL CATEGORIES OF DATA 33

    4.2.3 THE DIGITAL OMNIBUS ON AI: A RESHAPED DEBIASING EXCEPTION 35

  4.3 THE ENFORCEMENT OF DATA SUBJECTS’ RIGHTS UNDER THE GDPR AND THE CHALLENGES POSED BY AI TECHNOLOGIES 37

    4.3.1 ENFORCING THE RIGHT TO ERASURE IN AI MODELS 37

    4.3.2 THE RIGHT OF ACCESS AS A CONTESTATION-ENABLING SAFEGUARD? 42

  4.4 COOKIE FATIGUE: CONSENT MANAGEMENT AND PRIVACY SIGNALS 46

    4.4.1 A FRAGMENTED CONSENT REGIME 46

    4.4.2 THE SIX-MONTH BAN: A PARADOXICAL OPTION? 48

    4.4.3 A CENTRALISED CONSENT MANAGEMENT MECHANISM 49

    4.4.4 CONSENT MANAGEMENT AND PRIVACY SIGNALS FROM AN ECONOMIC PERSPECTIVE 51

PART III 54

5 CONCLUSION AND RECOMMENDATIONS 54

  5.1 OVERALL ASSESSMENT 54

  5.2 GENERAL RECOMMENDATIONS 54

  5.3 SPECIFIC RECOMMENDATIONS 55

ABOUT CERRE 58

ABOUT THE AUTHORS 59