The body of digital governance law is a layer cake: personal data, platforms, AI, cybersecurity, crypto, the cloud, institutions and oversight mechanisms.
3.1Personal data
The GDPR is the template: lawfulness of processing, individuals' rights, accountability, DPOs, impact assessments and fines of up to 4% of global turnover. In France, the amended 1978 law and the CNIL remain the historical landmarks.
3.2Platforms and content
The DSA imposes transparency, systemic risk management and audits on very large platforms. The DMA disciplines gatekeepers. In France, Arcom (the audiovisual and digital regulator) deals with content; elsewhere, the US Section 230 and the UK Online Safety Act strike other balances.
3.3Artificial intelligence
The AI Act rests on a pyramid of risks: prohibited practices, high-risk systems, transparency obligations and rules for general-purpose models. Around it gravitate the European AI Office, the Council of Europe Convention, the OECD principles, UNESCO, the NIST AI RMF and the ISO/IEC 42001 standard.
3.4Cyber, industrial data, crypto
NIS2, DORA, the CRA, the Data Act, the Data Governance Act, SecNumCloud and MiCA make up Europe's digital rulebook. Taken together, these texts outline an ambitious but complex regulatory architecture.
3.5The institutions
- France: CNIL, ANSSI, Arcom, the Competition Authority, DINUM, CNNum and PEReN.
- Europe: the Commission, the AI Office, DG CONNECT, the European Data Protection Board and ENISA.
- International: the Council of Europe, the OECD, the UN, the ITU, UNESCO, ICANN and the IGF.
3.6Everyday mechanisms
Governance is practised through impact assessments, records of processing, audits, sandboxes, standardisation, strategic litigation, legislative impact studies and researchers' access to data.
How to find your way?
Three questions for any problem: which layer? infrastructure, platform or content; which risk?; which territory? Extraterritoriality often makes several legal systems coexist.
Sources
Official texts on EUR-Lex; Covington and Hogan Lovells on the AI Act and the Omnibus; websites of the CNIL, ANSSI and the European Commission.
Finished this module?
Your progress is saved on this device.