Workshops

Workshop 1

Private law and the EU digital regulations: interdisciplinary significances

Prof. Francisco de Elizalde - Jean Monnet Chair in EU Digital Private Law and Associate Professor, IE University (Madrid)

Tuesday, 24 February 2026, 2:00 p.m. - Aula Magna, Via Belmeloro 10, Bologna

The seminar aims to assess the transformation of private law by the EU digital regulations: DSA, DMA, DA, DGA, and the AI Act. The digital regulations address concerns that were traditionally the domain of public law, such as the protection of fundamental rights, democracy, and mental health, to mention some. However, they innovate as they not only signal to states but also to companies (and among them, especially big tech) as the ones creating risks and bearing responsibility for preventing them in order to achieve the said goals. In this manner, the digital regulations reach private law.

The building of the digital society through market regulation resorts to transactional private rules. However, by incorporating non-economic interests and redefining the parties of the transactional relationship, the new digital laws deviate from the bits and pieces of EU private law. The EU regulations cannot be treated as a sectorial regulation anymore, nor can private law be directly ‘top-upped’ with EU digital law.

Against this backdrop, the seminar will address key transformations in private law tools and institutions. It will tackle the impact of the EU digital regulations at three levels: transactional, EU fundamental market freedoms, and fundamental rights. Participants will interact with horizontal instruments such as the Unfair Contract Terms Directive, the Unfair Commercial Practices Directive, and the GDPR, in addition to the digital regulations. In doing so, the seminar will assess co-regulation in the new digital framework and the tension between automation and the rule of law.

Workshop 2

EU Data Law: early policy recommendations and future research trajectory

Prof. Federico Ferretti - Jean Monnet Module in EU Data Law, University of Bologna, Italy

Monday, 4 May 2026, 3:30 p.m. - TalTech - Tallinn University of Technology

Rethinking the Consumer Standard in EU Digital Markets: Bounded Rationality and Dispositional Vulnerability as a Policy Lens
The European Union has adopted an ambitious regulatory agenda for digital markets, introducing new instruments aimed at competition, transparency, and consumer empowerment. At the same time, EU consumer protection law continues to rely on the benchmark of the “average consumer” as a reasonably well-informed and attentive market participant.
Evidence from behavioural research, recent policy reports, and enforcement experience suggests that this benchmark is increasingly misaligned with the realities of digital markets. Algorithmic personalisation, opaque choice architectures, data-driven profiling, and information overload systematically constrain consumers’ ability to make informed and autonomous decisions.
This paper argues that consumer vulnerability in digital markets should not be treated as an exceptional condition affecting specific groups, but as a structural and dispositional feature of digital consumption. Rather than advocating a radical overhaul of EU consumer law or extensive ex-ante licensing regimes, the paper proposes a pragmatic reinterpretation of existing rules.
Recognising the average digital consumer as characterised by bounded rationality and dispositional vulnerability would allow existing legal tools—particularly unfair commercial practices and unfair contract terms—to operate more effectively, while preserving regulatory coherence and feasibility.

GDPR Compliance as a Competitive Parameter: Why Data Protection Breaches Are Now a Matter of Market Fairness

Personal data are not only a fundamental-rights concern but also a key competitive asset in digital markets. The Court of Justice of the European Union’s judgment in Lindenapotheke (Case C-21/23) confirms that EU law does not prevent national legislation from allowing competitors to challenge GDPR infringements through unfair competition proceedings. This development substantially broadens the practical consequences of non-compliance.

Until now, GDPR enforcement has largely depended on supervisory authorities, claims by data subjects and representative actions. Lindenapotheke adds another potential enforcement channel: competitors may invoke unlawful data-processing practices where national unfair competition law permits them to do so. GDPR compliance can therefore affect not only regulatory exposure and reputation, but also a company’s competitive position.

The judgment is particularly significant for data-driven markets. Businesses that reduce costs, accelerate market entry or expand their customer base through unlawful processing may obtain an unfair advantage over compliant competitors. Practices involving profiling, targeted advertising, data sharing and database reuse may consequently generate overlapping regulatory, commercial and litigation risks.

This closer connection between data protection and market fairness can strengthen deterrence and promote more responsible business models. It also reflects the economic reality that privacy, transparency and lawful data governance increasingly influence service quality, consumer choice and trust. At the same time, competitor-led enforcement creates risks of opportunistic litigation and inconsistent application across Member States.

EU and national authorities should therefore clarify when GDPR infringements may amount to unfair competition, improve cooperation between data protection and competition authorities, and monitor emerging litigation. Clear safeguards are also needed to ensure that private enforcement supports genuine market fairness rather than strategic attempts to exclude rivals.

The central message for businesses is clear: GDPR compliance can no longer be treated solely as a regulatory obligation. In data-driven markets, it is increasingly a condition of fair competition and a component of long-term competitiveness.