Shaping Europe’s digital and data landscape
Digital and data policy lies at the heart of the European Union (EU)’s ambition to establish a competitive, secure and human-centric Digital Single Market. As digital technologies continue to shape economic activity, public administration and the world of work, the EU has developed a comprehensive regulatory framework that fosters innovation while safeguarding fundamental rights, fair competition and consumer protection. Key legislative pillars, including the Digital Services Act (DSA), the Digital Markets Act (DMA), the Data Act, the Data Governance Act, the General Data Protection Regulation (GDPR), the Artificial Intelligence (AI) Act and the Cybersecurity Act, establish rules relating to online platforms, data sharing, use of AI, digital infrastructure and the protection of personal data. Together, these instruments aim to promote trust in digital ecosystems, hold powerful intermediaries accountable, enable secure cross-border data flows, and strengthen Europe’s digital sovereignty.
Milieu provides legal, policy and socioeconomic expertise across the full spectrum of EU digital regulation. We support the European Commission (notably the Directorates-General for Communications Networks, Content and Technology (DG CNECT), Justice and Consumer Affairs (DG JUST) and Employment, Social Affairs and Inclusion (DG EMPL)), the European Parliament, and EU agencies and bodies by conducting conformity assessments, impact assessments, comparative legal analyses, case-law reviews and forward-looking studies on emerging technologies. Our work covers platform regulation, AI governance, data protection and governance, cloud computing, the digital transformation of public services and the regulatory implications of algorithmic systems in the workplace. We assist clients to assess implementation and enforcement challenges and develop evidence-based solutions that can help to ensure that Europe’s digital framework remains coherent, effective and fit for the future.
OUR Our areas of expertise and selected projects
Explore the digital policy areas in which we work, from digital transformation, data governance and data protection to artificial intelligence, intellectual property and emerging technologies, through a selection of projects delivered for EU institutions and agencies.
Digital Transformation
Digital transformation is reshaping Europe’s economy, public administration and labour markets. Through the Digital Decade Policy Programme 2030, the EU has set ambitious targets for digital infrastructure, digital skills, the digitalisation of businesses and public services. Key legislative instruments supporting this transformation include the DSA, which enhances the accountability and transparency of online platforms, the AI Act, which establishes a risk-based framework for AI systems, and the Cybersecurity Act, which strengthens trust in digital infrastructure.
Cloud computing plays a central role in this transition by enabling scalable public services, secure data storage and cross-border digital solutions. However, it also raises questions about interoperability, resilience and digital sovereignty. Meanwhile, the growing use of algorithmic management tools in the workplace, including AI-driven recruitment, performance monitoring and task allocation systems, is changing employment relations and prompting regulatory consideration of the intersection between digital, labour and fundamental rights law.
Milieu supports EU institutions, including DG CNECT and the European Parliament, as well as EU agencies and bodies such as the European Union Agency for Fundamental Rights (FRA) and the European Labour Authority (ELA), by providing legal and policy analysis on digital infrastructure, platform regulation, AI governance and emerging workplace technologies. Our services include impact assessments, comparative legal analysis, governance studies, workshops and research on the regulatory implications of digital innovation. We help clients to ensure that their digital transformation initiatives foster competitiveness and innovation while remaining aligned with EU values and fundamental rights.
Study on digitalisation, AI and algorithmic management in the workplace – shaping the future of work — European Parliamentary Research Service (EPRS)
Study on digitalisation, AI and algorithmic management in the workplace – shaping the future of work — European Parliamentary Research Service (EPRS)
The growing adoption of algorithmic management (AM) tools in conventional workplaces, including systems for recruitment, task allocation, performance monitoring and workforce analytics, is reshaping employment relations throughout the EU. While these technologies can boost efficiency and productivity, they also raise concerns about transparency, working conditions, occupational health and safety (OSH), data protection and workers’ rights.
This study supported the preparation of a legislative own-initiative (INL) report by the European Parliament, examining the opportunities and challenges associated with using AM in the workplace. It assessed the extent and nature of AM use through case studies, analysing its impact on employment relations and working conditions via stakeholder interviews, and reviewing existing EU and national regulatory frameworks in six Member States. The study also developed and assessed policy options in line with the Cost of Non-Europe methodology.
We led the review of regulatory frameworks, examining the interaction between digital legislation — including the GDPR and the AI Act — and EU labour and OSH directives. This analysis identified existing safeguards and regulatory gaps, as well as potential ways to strengthen worker protection in the context of AM.
Our legal and economic expertise combined with qualitative and quantitative research methods contributed to the European Parliament’s deliberations on the future regulatory framework for digitalisation in the workplace.
Read the study report here.
Ethical issues in the application of AI and algorithms in risk assessment — European Labour Authority (ELA)
Ethical issues in the application of AI and algorithms in risk assessment — European Labour Authority (ELA)
Growing reliance on AI, machine learning and algorithmic systems for labour enforcement and social security risk assessment offers opportunities to enhance compliance monitoring and cross-border collaboration. However, these tools also raise important legal and ethical questions relating to bias, discrimination, transparency and compliance with EU fundamental rights.
Milieu prepared training materials and delivered specialised training to national authorities, as well as drafting a concise manual summarising key legal and practical considerations. The programme focused on identifying and mitigating algorithmic bias, understanding applicable EU equal treatment and data protection rules, and ensuring the lawful and responsible use of AI in labour mobility and social security enforcement. We also developed and delivered several workshops examining concrete national use cases through structured legal and ethical analyses.
This project strengthened the capacity of national authorities to deploy AI responsibly while safeguarding compliance with EU law.
The ELA Handbook on artificial intelligence and algorithms in risk assessment (addressing bias, discrimination and other legal and ethical issues) is available here.
Workshop: robots in healthcare: a solution or a problem? — European Parliament (EP)
Workshop: robots in healthcare: a solution or a problem? — European Parliament (EP)
Milieu supported the European Parliament to organise the workshop, ‘Robots in healthcare: A solution or a problem?’ on 19 February 2019. The workshop provided background information and advice for members of the Parliament’s Committee on Environment, Climate and Food Safety (ENVI Committee) on the status and prospects of applying robotic- and AI-based technologies in healthcare. The workshop comprised presentations and an exchange of views with experts from the health sector and academia.
Challenges discussed included ethical, legal and socioeconomic implications of the deployment of AI and robotic technologies for healthcare.
We identified and contacted experts with extensive experience in AI, robotics and healthcare, drafted the press releases for the workshop (pre- and post-workshop), and compiled the final workshop report.
The workshop proceedings can be read here.
Data Governance and Data Protection
In an increasingly data-driven society, robust data governance and the protection of personal data are essential to safeguard fundamental rights and ensure trust in the digital economy. Data protection is a fundamental right enshrined in the EU Charter of Fundamental Rights.
The adoption of the GDPR marked a major milestone in strengthening individuals’ control over their personal data, harmonising rules across the EU, and supporting the functioning of the Digital Single Market. Alongside the GDPR, the Law Enforcement Directive regulates the processing of personal data for law enforcement purposes, striking a balance between privacy rights and the fight against crime and terrorism. Regulation (EU) 2018/1725 establishes equivalent data protection rules for EU institutions, bodies, and agencies. Beyond personal data, the EU has developed a broader data governance framework, including the Data Governance Act and the Data Act, to facilitate secure data sharing, enhance data availability and foster innovation, while maintaining high standards of protection and accountability.
Milieu provides extensive legal and policy support to EU institutions, bodies, and agencies in this field, including drafting handbooks, delivering specialised training on data protection and governance, conducting legal analyses on specific data processing issues and performing compliance checks on national transpositions..
Legal studies on the implication of several GDPR provisions, case laws and other laws having an impact on data protection — European Data Protection Board (EDPB)
Legal studies on the implication of several GDPR provisions, case laws and other laws having an impact on data protection — European Data Protection Board (EDPB)
The EDPB is an independent European body responsible for ensuring consistent application of data protection rules throughout the EU. Established by the GDPR, it is composed of representatives of the national data protection authorities (DPAs) of EU/European Economic Area (EEA) countries, as well as the European Data Protection Supervisor (EDPS).
Under a framework contract with the EDPB/EDPS, Milieu and our academic partners provided over 15 studies on the implications of data protection rules. These studies included the reuse of public sector data, processing data in different professional contexts (e.g. law enforcement or scientific research), enforcing the GDPR against third-country importers, data localisation requirements, data brokers, data stored in apps, and the interaction of data protection with other legal areas (e.g. anti-money laundering).
Our studies on government access to data in third countries aimed to provide DPAs with objective, reliable and up-to-date background information on legislation and practice in several third countries,
Some of these legal studies can be read on the EDPB website.
Study on access to administrative data for ESF+ purposes in compliance with data protection rules — European Commission, Directorate-General for Employment, Social Affairs and Inclusion (DG EMPL)
Study on access to administrative data for ESF+ purposes in compliance with data protection rules — European Commission, Directorate-General for Employment, Social Affairs and Inclusion (DG EMPL)
The European Social Fund Plus (ESF+) is a publicly funded programme, the oldest and one of the largest European Structural and Investment Funds. Monitoring and evaluation are key elements in ensuring accountability and performance.
The study assessed the practical and legal challenges associated with accessing and reusing administrative data for the purposes of monitoring and evaluation of ESF and ESF+ programmes. It also examined how administrative data can be made more accessible to support ESF+ monitoring and evaluation, with the aim of advising managing and other relevant authorities on how to process personal data, including administrative data, while complying with the data protection rules of the GDPR.
The report can be read here.
Compliance assessment of the Law Enforcement Directive — European Commission, Directorate-General for Justice and Consumers (DG JUST)
Compliance assessment of the Law Enforcement Directive — European Commission, Directorate-General for Justice and Consumers (DG JUST)
The Law Enforcement Directive (LED) entered into force on 5 May 2016 and repealed Framework Decision 2008/977/JHA. It covers the processing of personal data by national competent authorities for law enforcement purposes, an area that falls outside the scope of the GDPR.
Milieu provided DG JUST with a compliance assessment study on the transposition of the LED into national legislation in Germany, Slovenia and Spain. As these Member States failed to transpose the LED by 6 May 2018, infringement proceedings were initiated.
iNTELLECTUAL PROPERTY (IP)
A robust IP framework is crucial for stimulating innovation, creativity and competitiveness within the EU. EU legislation on copyright, trademarks, designs, patents and trade secrets supports the protection and enforcement of IP rights across the single market while adapting to digitalisation and technological change.
Milieu provides the European Commission (notably DG CNECT) and the European Union Intellectual Property Office (EUIPO) with legal and policy expertise on EU/international/national copyright legislation and IP enforcement. Services include comparative legal analysis, legal mapping, gap analysis, thematic studies and reviewing and collecting national IP enforcement judgements.
Collection of national key enforcement judgements related to IP rights — European Union Intellectual Property Office (EUIPO)
Collection of national key enforcement judgements related to IP rights — European Union Intellectual Property Office (EUIPO)
Enforcing IP rights across the EU requires accessible and comparable national case-law. Improving transparency and knowledge sharing is essential to promoting the consistent application of IP enforcement rules across the EU.
Since 2020, Milieu has worked with the EUIPO to identify, analyse and summarise key national enforcement judgements on IP rights for inclusion in the EUIPO eSearch Case Law database. In collaboration with Bournemouth University’s Centre for Intellectual Property Policy and Management (CIPPM), we select significant rulings from EU Member States, prepares structured summaries, and integrates them into the database. Almost 1 200 judgments will be delivered over the course of two consecutive four-year contracts.
Study on contractual practices affecting the transfer of copyright and related rights and the creators and producers’ ability to exploit their rights — European Commission, Directorate-General for Communications Networks, Content and Technology (DG CNECT)
Study on contractual practices affecting the transfer of copyright and related rights and the creators and producers’ ability to exploit their rights — European Commission, Directorate-General for Communications Networks, Content and Technology (DG CNECT)
In recent years, concerns have grown about the increasing use of buy-out clauses, work-for-hire arrangements, and choice of law and jurisdiction clauses, which may circumvent EU copyright safeguards introduced by the Directive on Copyright in the Digital Single Market (DSM Directive). Despite the existence of mechanisms such as the principle of appropriate and proportionate remuneration, the contract adjustment mechanism, alternative dispute resolution (ADR) procedures, and the right of revocation, certain practices (including the retention of rights by predominantly non-EU platforms) may present challenges in remuneration for authors and performers, and may affect the cultural diversity of EU works.
This study examined contractual practices used to transfer copyright and related rights from authors and performers to producers, and from producers to broadcasters and streamers.
By providing a comprehensive, comparative legal assessment at EU and international levels, and across all Member States, the project contributed to a deeper understanding of the effectiveness of EU copyright rules in ensuring fair remuneration and balanced contractual relationships in the creative sector.
Read the study report here
Study on the application of the Orphan Works Directive — European Commission, Directorate-General for Communications Networks, Content and Technology (DG CNECT)
Study on the application of the Orphan Works Directive — European Commission, Directorate-General for Communications Networks, Content and Technology (DG CNECT)
‘Orphan works’ are works that are protected by copyright or related rights, but for which no rights holder can be identified or located, and they make up a large part of the collections held by Europe’s cultural heritage institutions. Digitising them presents legal challenges, as obtaining prior consent from rightholders is often impossible. In 2012, the EU adopted the Orphan Works Directive to facilitate access to such works
This study supported DG CNECT to prepare the review of the Directive by collecting and analysing factual evidence on its practical application. Milieu assessed the implementation of Articles 1 to 7 of the directive across Member States, taking into account developments in digital libraries and digitisation practices. The study provided a quantitative and qualitative analysis of the effectiveness and efficiency of the directive and examined possible policy options to improve its application and impact.
By providing an evidence-based evaluation, the project helped to ensure that the EU copyright framework continues to support the digitisation of cultural heritage effectively.
Read the full study here.