Norwegian version of this page

Lee Andrew Bygrave

Professor - Department of Private Law

Email l.a.bygrave@jus.uio.no

Phone +47 22 85 93 39

Room 119

Username

Visiting address Karl Johans gt. 47 Domus Academica

Postal address Postboks 6706 St. Olavs plass 0130 Oslo

Press photo Download business card

Background

Lee A. Bygrave was born in 1963. He was awarded a Doctorate of Laws (dr. juris) at the University of Oslo in 2000. Prior to this, he was awarded the degrees of Bachelor of Arts (Honours) in 1985 and Bachelor of Laws (Honours) in 1989 – both from the Australian National University, Canberra. He is currently Professor at the Department of Private Law, University of Oslo.

Within the Department of Private Law, Lee is currently Director of the Norwegian Research Center for Computers and Law. He is additionally an honorary professor at the College of Law, Australian National University, an academic affiliate of the Centre for Health, Law and Emerging Technologies (HeLEX) at the University of Oxford, and Senior Research Affiliate at the Centre for Digital Law, Singapore Management University.

His teaching appointments range across numerous institutions, including the universities of Vienna, Stockholm, Tilburg, Tartu, Tel Aviv, New South Wales and Oslo. At the latter, Lee is one of the principal teachers of the LL.M. program in Information and Communications Technology (ICT) Law. He has also been in charge of teaching English law of contract.

He currently heads a major research project at the NRCCL: VIROS (‘Vulnerability in the Robot Society’), which canvasses legal and ethical implications of AI-empowered robotics. The project is funded by the Research Council of Norway.

Lee has published extensively within the field of data protection law where his two principal books on the subject – Data Protection Law: Approaching Its Rationale, Logic and Limits (Kluwer 2002) and Data Privacy Law: An International Perspective (Oxford University Press 2014) – are widely acknowledged as standard international texts. He is additionally co-editor and co-author of a comprehensive article-by-article analysis of the EU General Data Protection Regulation – The EU General Data Protection Regulation (GDPR): A Commentary (Oxford University Press 2020). His data protection scholarship has been cited with approval by Advocates General of the Court of Justice of the European Union.

Lee has also conducted pioneering analyses of:

the ways in which information concepts are (mis)understood and (mis)used in law,
the use of contract as a tool for governing internet infrastructure and online transactions,
the legal-regulatory framework for automated decision-making,
cognitive sovereignty as a key interest threatened by the opacity of machine-learning processes,
the privacy implications of digital rights management systems,
the use of ‘design-based’ regulatory techniques for integrating legal values into information systems architecture, and
legal rules on cybersecurity.

Lee was founding co-editor of Oslo Law Review, and sits on the editorial boards of Cambridge Forum on AI: Law and Governance (Cambridge University Press), International Review of Law, Computers, and Technology (Taylor & Francis), Computer Law & Security Review (Elsevier), Internet Policy Review (Humboldt Institute for Internet and Society) and International Data Privacy Law (Oxford University Press).

Special fields

• Privacy and data protection law
• Internet governance
• Information security
• Computer crime
• Intellectual property law
• Private international law
• Alternative dispute resolution

Tags: China, USA, Brazil, Russia

Tørresen, Jim; Lindblom, Diana Saplacan; Baselizadeh, Adel; Mahler, Tobias & Bygrave, Lee Andrew (2026). Reducing Robot Vulnerabilities Through Joint Regulatory Assessment and User-Centered Development and Testing. In Weng, Yueh-Hsuan (Eds.), Social Robots and Ethical Design. Springer. ISSN 9789819225156. Full text in Research Archive Show summary
This book chapter introduces research examples from a unique collaboration between legal scholars and technology scholars who have together endeavored to make progress in safe and privacy-preserving robot assistant development and deployment. This collaboration has taken place within the “Vulnerability in the Robot Society” (VIROS) research project at the University of Oslo, Norway (VIROS 2025). Institutionally, this is a joint research project between the Norwegian Research Center for Computers and Law (NRCCL) at the Department of Private Law and the Robotics and Intelligent Systems (ROBIN) research group at the Department of Informatics. The project explores challenges regarding digital vulnerabilities that the adoption of robots in human environments poses, particularly as regards privacy, safety, and security, and how these challenges can be met from legal and technical perspectives. We have been particularly interested in exploring assistant and healthcare robots since this domain imposes high demands on the technology to be used. As part of the project, we have analyzed various European Union (EU) regulations that have been introduced in recent years, with a view to assessing their impact in the domain. The TIAGo robot from PAL Robotics has been the main robot platform for technical work and experimental studies in the project. A number of novel methods for robot sensing and control have been implemented. Further, several of them have been assessed through human–robot interaction studies. This chapter introduces the VIROS project and outlines some of our regulatory and technological research. We also highlight several of the conflicting trade-offs seen in the domain of HRI (Torresen et al. 2023).
Earls, Davis, Peter Alexander; Mateo, Aboy,; Bygrave, Lee Andrew; Timo, Minssen,; Urs, Gasser, & Corrales, Compagnucci, Marcelo (2026). EU Cybersecurity Regulation in the Quantum Age. In Aboy, Mateo; Compagnucci, Marcelo Corrales & Minssen, Timo (Ed.), Quantum Technology Governance I: Law and Regulation. Springer Nature. ISSN 9789819583713. p. 149–179. doi: 10.1007/978-981-95-8371-3_5. Full text in Research Archive Show summary
This chapter explores the intersection of quantum computing and European Union (EU) cybersecurity law. It examines to what extent cybersecurity regulation in the EU is fit-for-purpose to deal with the challenges of quantum computing. Two key challenges are identified: (i) harvest now, decrypt later (HNDL) attacks, and (ii) the accelerated development of quantum computers outpacing current cybersecurity measures. The chapter argues that concepts like “state of the art” and “appropriate technical and organizational measures” characteristic of EU cybersecurity law fail to sufficiently account for cybersecurity threats anticipated to materialize in the future, but impacting networks and information systems today. Proposed solutions include enhancing judicial clarity of technical cybersecurity requirements, increasing policy focus on post-quantum cryptography, adopting firmer cybersecurity requirements in hard law, and shifting towards alternative terms that properly account for future cybersecurity uncertainties. The chapter concludes by advocating for proactive regulatory approaches anchored in anticipatory governance and multi-layered strategies to safeguard against the quantum threat.
Zhang, Shiliang; Maharjan, Sabita; Bygrave, Lee Andrew & Yu, Shui (2025). Data Sharing, Privacy and Security Considerations in the Energy Sector: A Review from Technical Landscape to Regulatory Specifications. arXiv.org. ISSN 2331-8422. doi: 10.48550/ARXIV.2503.03539. Full text in Research Archive Show summary
Decarbonization, decentralization and digitalization are the three key elements driving the twin energy transition. The energy system is evolving to a more data driven ecosystem, leading to the need of communication and storage of large amount of data of different resolution from the prosumers and other stakeholders in the energy ecosystem. While the energy system is certainly advancing, this paradigm shift is bringing in new privacy and security issues related to collection, processing and storage of data - not only from the technical dimension, but also from the regulatory perspective. Understanding data privacy and security in the evolving energy system, regarding regulatory compliance, is an immature field of research. Contextualized knowledge of how related issues are regulated is still in its infancy, and the practical and technical basis for the regulatory framework for data privacy and security is not clear. To fill this gap, this paper conducts a comprehensive review of the data-related issues for the energy system by integrating both technical and regulatory dimensions. We start by reviewing open-access data, data communication and data-processing techniques for the energy system, and use it as the basis to connect the analysis of data-related issues from the integrated perspective. We classify the issues into three categories: (i) data-sharing among energy end users and stakeholders (ii) privacy of end users, and (iii) cyber security, and then explore these issues from a regulatory perspective. We analyze the evolution of related regulations, and introduce the relevant regulatory initiatives for the categorized issues in terms of regulatory definitions, concepts, principles, rights and obligations in the context of energy systems. Finally, we provide reflections on the gaps that still exist, and guidelines for regulatory frameworks for a truly participatory energy system.
Bygrave, Lee Andrew & Schmidt, Rebecca (2025). Regulating Non-High-Risk AI Systems Under the EU’s Artificial Intelligence Act, with Special Focus on the Role of Soft Law. In Raposo, Vera (Eds.), The European Artificial Intelligence Act: Promises and Perils? | SpringerLink. Springer Nature. ISSN 9783031984068. p. 181–210. Full text in Research Archive Show summary
The remit of this chapter is twofold. First, it provides a concise overview of how the EU’s Artificial Intelligence Act regulates non-high-risk AI systems. Second, the chapter elucidates the role that the Act assigns to codes of practice and codes of conduct for governing these systems.
Bygrave, Lee Andrew (2025). Privacy and Data Protection. In Kaufmann, Mareile & Lomell, Heidi Mork (Ed.), De Gruyter Handbook of Digital Criminology. De Gruyter Brill. ISSN 9783111061931. p. 381–388. doi: 10.1515/9783111062037-044. Full text in Research Archive Show summary
The chapter elucidates the semantics of privacy and data protection, taking account of transnational variations in how they are understood. Their interrelationship is also explained as is their relationship to closely linked concepts, such as data security and bio-privacy. Finally, the chapter briefly canvasses legal and social norms for safeguarding privacy and personal data.
Khaksar, Weria; Saplacan, Diana; Bygrave, Lee Andrew & Tørresen, Jim (2025). Robotics in Elderly Healthcare: A Qualitative Analysis of 20 Recent European Research Projects. ACM Transactions on Human-Robot Interaction. 14(2). doi: 10.1145/3711936. Full text in Research Archive
Bygrave, Lee Andrew (2024). The Emergence of EU Cybersecurity Law: A Tale of Lemons, Angst, Turf, Surf and Grey Boxes. Computer Law and Security Review. ISSN 0267-3649. 56. doi: 10.1016/j.clsr.2024.106071. Full text in Research Archive Show summary
Using a series of metaphors, this opinion piece charts patterns, trends and obstacles shaping the development of EU cybersecurity law over the last three decades. It shows that this development is more than simply a function of the EU's increasing regulatory capacity. It argues that, to a large degree, the development has been a reactive, gap-filling process, which is partly due to the piecemeal character of the regulatory areas in which the EU legislates, combined with smouldering ‘turf wars’ over regulatory competence. An overarching point is that EU cybersecurity law is far from reminiscent of a well-kempt forest; rather, it resembles a sprawling jungle of regulatory instruments interacting in complex, confusing and sometimes disjointed ways. Thus, this field of regulation underlines the fact that increased regulatory capacity does not necessarily beget optimal regulatory coherence. Nonetheless, the paper also identifies multiple positive traits in the legislative development—traits that signal Brussels’ ability to learn from weaknesses with previous regulatory instruments.
Bygrave, Lee Andrew (2023). The Predilection for Contract in Governing Digital Networks: Micro-Management’s Face Off with Accountability. In Clifford, Damian; Lau, Kwan Ho & Paterson, Jeannie Marie (Ed.), Data and Private Law. Hart Publishing Ltd. ISSN 9781509966028. p. 51–66. doi: 10.5040/9781509966059.ch-004. Full text in Research Archive Show summary
The point of departure for this chapter is the popularity of contractually based transnational private regulation in governing digital networks. The main matters discussed are the causes and consequences of this popularity, particularly in light of the various functions that contract plays. The chapter also explores the persisting tension between contractually facilitated private autonomy in the running of digital networks and efforts to enhance the accountability of the governance mechanisms in play, using Meta’s Oversight Board as a case study. The overarching argument advanced in the chapter is threefold. First, the popularity of contractually based transnational private regulation of digital networks is primarily rooted in its ability to manage the complexity of these networks in a relatively efficient, agile and flexible manner. Second, there is a tendency to exploit this capacity in aggressive pursuit of micro-management. Third, the attendant accountability mechanisms are often weak, thus deepening legitimacy deficits that are challenging for self-regulation or the court system to correct....
Bygrave, Lee Andrew (2023). Data Protection by Design and by Default. In Garben, Sacha & Gormley, Laurence W. (Ed.), Oxford Encyclopedia of EU Law. Oxford University Press. ISSN 9780191877025. Full text in Research Archive
Bygrave, Lee Andrew & Tosoni, Luca (2023). Article 3: Definitions. In Kosta, Eleni & Boehm, Franziska (Ed.), The EU Law Enforcement Directive (LED): A Commentary. Oxford University Press. ISSN 9780192855220. p. 79–134. Full text in Research Archive
Bygrave, Lee Andrew (2022). Cyber Resilience versus Cybersecurity as Legal Aspiration. In Jančárková, Tat’ána; Visky, Gabor & Winther, Ingrid (Ed.), 2022 14th International Conference on Cyber Conflict: Keep Moving. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9789916978900. p. 27–44. Full text in Research Archive
Bygrave, Lee Andrew (2022). Machine Learning, Cognitive Sovereignty and Data Protection Rights with Respect to Automated Decisions. In Ienca, Marcello; Pollicino, Oreste; Liguori, Laura; Stefanini, Elisa & Andorno, Roberto (Ed.), The Cambridge Handbook of Life Science, Information Technology and Human Rights. Cambridge University Press. ISSN 9781108775038. p. 166–188. doi: 10.1017/9781108775038.016. Full text in Research Archive Show summary
Human behaviour is increasingly governed by automated decisional systems based on machine learning (ML) and ‘Big Data’. While these systems promise a range of benefits, they also throw up a congeries of challenges, not least for our ability as humans to understand their logic and ramifications. This chapter maps the basic mechanics of such systems, the concerns they raise, and the degree to which these concerns may be remedied by data protection law, particularly those provisions of the EU General Data Protection Regulation that specifically target automated decision-making. Drawing upon the work of Ulrich Beck, the chapter employs the notion of ‘cognitive sovereignty’ to provide an overarching conceptual framing of the subject matter. Cognitive sovereignty essentially denotes our moral and legal interest in being able to comprehend our environs and ourselves. Focus on this interest, the chapter argues, fills a blind spot in scholarship and policy discourse on ML-enhanced decisional systems, and is vital for grounding claims for greater explicability of machine processes.
Bygrave, Lee Andrew & Yeung, Karen (2021). Demystifying the modernized European data protection regime: Cross-disciplinary insights from legal and regulatory governance scholarship. Regulation & Governance. ISSN 1748-5983. doi: 10.1111/rego.12401. Full text in Research Archive Show summary
This article critically examines fundamental aspects of the recently reformed European regime for protection of personal data, focusing on the General Data Protection Regulation (GDPR) adopted by the European Union (EU) in 2016. Although the GDPR is now a central concern for many organizations across multiple sectors, many complain that it is arcane, confusing, and complex. By combining knowledge from two disciplinary perspectives – from regulatory governance scholarship, on the one hand, with legal scholarship from the fields of data protection law, constitutional law, and fundamental rights, on the other hand – this article seeks to “demystify” the key elements of the regime's architecture and approach in light of the significant uncertainties concerning the nature of its requirements. In particular, this article examines the tension between the regime's pronounced “risk-based” approach to compliance and its basic objective of safeguarding fundamental rights, and the challenges facing data protection authorities in providing timely clarifications of the regime's norms. We argue that, despite its complex and arcane character and continuing uncertainty about the precise scope of its requirements, the regime is an innovative hybrid with a significant degree of in-built “future-proofing” that should help render it more resistant to being rapidly overtaken or outpaced by organizational–technological developments. The secondary aim of this article is to demonstrate how academic insights from two distinct but related disciplinary perspectives – legal scholarship and regulatory governance studies – offer a potentially fruitful approach to enrich understandings of the European data protection regime in particular, and of the mechanics, efficacy, and legitimacy of regulatory governance regimes more generally.
Bygrave, Lee Andrew (2021). Security by Design: Aspirations and Realities in a Regulatory Context. Oslo Law Review. 8(3), p. 126–177. doi: 10.18261/olr.8.3.2. Full text in Research Archive Show summary
Recently, ‘security by design’ has surfaced as an aspirational mantra in cybersecurity regulation and policy. It urges those involved in building information systems to consider the systems’ security needs before they are built and integrate these needs in the systems’ subsequent design and construction. The mantra joins a design-focused discourse on the integration of various values into technology development processes. However, critical scholarship on the roots, meaning(s) and regulatory dimensions of ‘security by design’ is scarce. This article aims to fill this gap. It examines the nascent discourse on ‘security by design’ with a view to assessing the mantra’s utility as a regulatory principle in the context of information systems development. An argument advanced in the article is that while the mantra is a valuable addition to cybersecurity law and policy, realising its aspirations is likely to be hindered by its nebulous semantics and particular characteristics of computer engineering culture. The article warns that the legitimacy of ‘security by design’ as a regulatory principle could be weakened if it is used to further authoritarian or corporate interests at the expense of civil liberties or consumer protection.
Bygrave, Lee Andrew (2021). The ‘Strasbourg Effect’ on data protection in light of the ‘Brussels Effect’: Logic, mechanics and prospects. Computer Law and Security Review. ISSN 0267-3649. 40. doi: 10.1016/j.clsr.2020.105460. Full text in Research Archive Show summary
This article considers various factors that will shape the potential effect of the Council of Europe's modernised Convention on data protection (Convention 108+) on non-European states’ regulatory policy. It does so by elucidating the logic and mechanics of this effect in light of the ‘Brussels Effect’ that is commonly attributed, in part, to EU data protection law. The central arguments advanced in the article are that the impact of Convention 108+ beyond Europe will rest primarily on the Council of Europe's ideational power tempered by processes of acculturation, and secondarily on the degree to which the EU is willing to use the ‘Brussels Effect’ as a vehicle for promoting non-European states’ accession to the Convention.
Bygrave, Lee Andrew & Tosoni, Luca (2020). Article 4(13): Genetic data. In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 196–206. Full text in Research Archive
Bygrave, Lee Andrew & Tosoni, Luca (2020). Article 4(11): Consent. In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 174–187. Full text in Research Archive
Bygrave, Lee Andrew & Tosoni, Luca (2020). Article 4(14): Biometric data. In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 207–216. Full text in Research Archive
Bygrave, Lee Andrew & Tosoni, Luca (2020). Article 4(15): Data concerning health. In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 217–224. Full text in Research Archive
Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (2020). Background and Evolution of the EU General Data Protection Regulation (GDPR). In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 1–47. Full text in Research Archive
Bygrave, Lee Andrew & Tosoni, Luca (2020). Article 4(1): Personal Data. In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 103–115. Full text in Research Archive
Bygrave, Lee Andrew (2020). Article 22: Automated individual decision-making, including profiling. In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 522–542. Full text in Research Archive
Bygrave, Lee Andrew (2020). Article 4(4): Profiling. In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 127–131. Full text in Research Archive
Bygrave, Lee Andrew & Tosoni, Luca (2020). Article 4(26): International organisation. In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 303–308. Full text in Research Archive
Tosoni, Luca & Bygrave, Lee Andrew (2020). Article 4(2): Processing. In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 116–122. Full text in Research Archive
Bygrave, Lee Andrew (2020). Article 4(21): Supervisory authority. In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 265–271. Full text in Research Archive
Bygrave, Lee Andrew & Tosoni, Luca (2020). Article 4(8): Processor. In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 157–162. Full text in Research Archive
Bygrave, Lee Andrew & Tosoni, Luca (2020). Article 4(7): Controller. In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 145–156. Full text in Research Archive
Bygrave, Lee Andrew & Tosoni, Luca (2020). Article 4(18): Enterprise. In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 246–252. Full text in Research Archive
Bygrave, Lee Andrew (2020). Article 25: Data protection by design and by default. In Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (Ed.), The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISSN 9780198826491. p. 571–581. Full text in Research Archive

View all works in NVA

Kuner, Christopher; Bygrave, Lee Andrew & Docksey, Christopher (2020). The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. ISBN 9780198826491. 1393 p. Full text in Research Archive

View all works in NVA

Bygrave, Lee Andrew (2026). Mapping the Maze of EU Cybersecurity Regulation. Full text in Research Archive
Bygrave, Lee Andrew (2025). Design Norms in Law: Just a Passing Fad? doi: https:/cdl.smu.edu.sg/events/research-seminar-prof-lee-andrew-bygrave-design-norms-law-just-passing-fad. Full text in Research Archive
Bygrave, Lee Andrew (2025). Cognitive Sovereignty in an Era of Obscure Intelligence. doi: https:/bond.edu.au/event/9801/faculty-of-law-twilight-seminar-cognitive-sovereignty-an-era-of-obscure-intelligence. Full text in Research Archive
Bygrave, Lee Andrew (2025). Design in Law: Rhetoric, Rationale, Reach and Realities. doi: https:/events.unimelb.edu.au/ADMS/event/49619-design-in-law-rhetoric-rationale-reach-and. Full text in Research Archive
Bygrave, Lee Andrew (2025). The Utility of Treating "the Mediterranean" as a Regulatory Region. Full text in Research Archive
Bygrave, Lee Andrew (2025). Fremveksten av EUs cybersikkerhetslovgivning: En fortelling om sitroner, angst, revirkrig, bølger og grå bokser. Full text in Research Archive
Bygrave, Lee Andrew (2025). Sårbarhet i robot-samfunnet. Full text in Research Archive
Bygrave, Lee Andrew (2025). Fairness as Crowd-Pleaser. doi: https:/policyreview.info/articles/news/fairness-crowd-pleaser/2020. Full text in Research Archive
Bygrave, Lee Andrew (2024). EU Regulation of Smart Robotics: Too Much, Too Soon? Full text in Research Archive
Bygrave, Lee Andrew (2024). AI and Cognitive Sovereignty. Full text in Research Archive
Bygrave, Lee Andrew (2024). Low-Risk AI and the AI Act. Full text in Research Archive
Bygrave, Lee Andrew (2024). Law and AI: The Pacing Problem(s) as Exemplified by the EU’s AI Act. Full text in Research Archive
Bygrave, Lee Andrew (2024). AI and Regulation: Talking the Talk, Walking the Walk, Boxing the Boxes. Full text in Research Archive
Fagerlund, Annette; Hunsbedt, Christiane; Bygrave, Lee Andrew & Langsrud, Solveig (2024). Legal perspectives and challenges for use of WGS for Listeria control in the food industry. Full text in Research Archive
Fagerlund, Annette; Hunsbedt, Christiane; Bygrave, Lee Andrew & Langsrud, Solveig (2024). Legal challenges for sharing of WGS data from a food industry perspective. Full text in Research Archive
Tørresen, Jim; Baselizadeh, Adel; Mahler, Tobias & Bygrave, Lee Andrew (2024). Machine Performance Tradeoffs to Ethical and Legal Perspectives. Full text in Research Archive
Bygrave, Lee Andrew (2024). Legal Challenges of AI and Security. Full text in Research Archive
Bygrave, Lee Andrew (2024). Information / Data Quality Norms in the AI-Medical Context. Full text in Research Archive
Bygrave, Lee Andrew (2024). A (Metaphorical) Introduction to the GDPR, its Background and Prospects. Full text in Research Archive
Bygrave, Lee Andrew (2024). Social Media and Human Rights: Is the Rule of Law Failing? Full text in Research Archive
Bygrave, Lee Andrew (2024). Krav til transparens for KI-systemer som interagerer direkte med mennesker. Full text in Research Archive
Bygrave, Lee Andrew (2024). Fairness as Legitimising Reference. Full text in Research Archive
Bygrave, Lee Andrew (2024). Utviklingstrekk ved EUs datasikkerhetsrett. Full text in Research Archive
Fagerlund, Annette; Hunsbedt, Christiane; Bygrave, Lee Andrew & Langsrud, Solveig (2024). Perspektiv og utfordringer med å dele og bruke helgenomsekvenseringsdata (WGS) for kontroll av Listeria i matindustrien. Full text in Research Archive
Bygrave, Lee Andrew (2024). Long-term trends in EU cybersecurity legislation: lessons for other jurisdictions? Full text in Research Archive
Bygrave, Lee Andrew (2024). Fra "fake news" til "fake demokrati": Hvor står jussen? Full text in Research Archive
Bygrave, Lee Andrew (2024). Cybersikkerhet: Fremdeles et "lemons market"? Full text in Research Archive
Bygrave, Lee Andrew (2023). EU Legislative Initiatives on Data Sharing. Full text in Research Archive
Jakobsen, Hanne Østli & Bygrave, Lee Andrew (2023). Dette er en type teknologi som ikke bør finnes. [Journal]. Morgenbladet. Full text in Research Archive
Bygrave, Lee Andrew (2023). Norges handlingsrom i møte med overfloden av tek-relaterte reguleringer i EU. Full text in Research Archive
Bygrave, Lee Andrew & Davis, Peter Alexander Earls (2023). Fairness in EU Law: GDPR, DMA, DSA, AIA. Full text in Research Archive
Holter, Katrine; Bygrave, Lee Andrew & Judin, Tobias (2023). Rett og Slett #59: Datatilsynet i strupen på Facebook: Hvem vinner personvernkampen? [Radio]. Alle podkastspillere. Full text in Research Archive
Bygrave, Lee Andrew (2023). Regulatoriske utfordringer knyttet til manglende ansvarlighet ved tverrnasjonale private styringsformer for internett-baserte tjenester. Full text in Research Archive
Bygrave, Lee Andrew (2023). Core Principles of the General Data Protection Regulation in Light of Artificial Intelligence. Full text in Research Archive
Bygrave, Lee Andrew (2023). Utfordringer knyttet til EUs datalovgivning. Full text in Research Archive
Bygrave, Lee Andrew (2023). Accountability in Transnational Private Regulation: The Case of Meta's Oversight Board. Full text in Research Archive
Bygrave, Lee Andrew (2022). The Legal Regulation of Automated Decision Making. Full text in Research Archive
Bygrave, Lee Andrew (2022). Google, Amazon, Facebook ... Har personvernet på nettet en sjanse? Full text in Research Archive
Bygrave, Lee Andrew (2022). Methodological Challenges in Research on the Interaction of Technology and Human Rights. Full text in Research Archive
Bygrave, Lee Andrew (2022). Grunnleggende innføring i "common law". Full text in Research Archive
Bygrave, Lee Andrew (2022). Security by Design or Disaster? [Internet]. Tech Mirror podcast series. Full text in Research Archive
Bygrave, Lee Andrew (2022). Vulnerability in the Robot Society (VIROS) -- and some remarks about silos, law and "regulatory conversations". Full text in Research Archive
Bygrave, Lee Andrew (2022). Cognitive Sovereignty, Machine Learning and Data Protection Rights. Full text in Research Archive
Bygrave, Lee Andrew (2022). Data Protection by Design and Security by Design: A Tale of Two Siblings. Full text in Research Archive
Bygrave, Lee Andrew (2022). What is a 'legimate interest' for processing personal data pursuant to Article 6(1)(f) GDPR? Full text in Research Archive
Bygrave, Lee Andrew (2022). Cyber Resilience versus Cybersecurity as Regulatory Aspiration: A Case of the Hare and the Tortoise? Full text in Research Archive
Bygrave, Lee Andrew (2022). When Privacy and Data Protection Rule, What and Who loses Out? Full text in Research Archive
Bygrave, Lee Andrew; Mahler, Tobias & Lintvedt, Mona Naomi (2022). AI Act og Norges handlingsrom. Full text in Research Archive
Bygrave, Lee Andrew (2022). EU Regulatory Policy on "Smart Devices" and the "Internet of Things". Full text in Research Archive
Bygrave, Lee Andrew (2022). 'By Design' as Regulatory Mantra. Full text in Research Archive
Bygrave, Lee Andrew (2022). Challenges of human rights in the digital domain: critical queries. Full text in Research Archive
Bygrave, Lee Andrew (2022). The Design Turn in Law: A Sensible Answer to Regulatory Failure? Full text in Research Archive Show summary
In recent years, the concept of design has become increasingly prominent in law and public policy discourse. This trend is particularly pronounced in European legislative instruments which flag various 'by design' mantras, including 'data protection by design', 'privacy by design' and 'security by design". In Australia, we see regulatory agencies flagging similar mantras, such as 'safety by design' and 'open by design'. However, authoritative guidance on the meaning and weight of these norms remains scant, and critical legal scholarship on point is still in its infancy. What are the catalysts of the design turn in law? What is its agenda? Is it just a passing fad or a more permanent development? These are some of the questions that the lecture seeks to answer. It pays special attention to the new European rules on 'security by design' which, in the wake of the Optus data breach, ought to have a heightened resonance in Australia. The central argument advanced in the lecture is that the design turn is an intuitively sensible response to the frequent failure of 'law in books' to gain widespread practical traction, particularly in technology development. Yet, the rollout of design-focused rules in law and public policy discourse ought not to be regarded as a 'silver bullet' solution to regulatory failure: real-world design processes are complicated and frequently dogged by conflict and poor communication between the involved actors. These challenges ought to be kept in mind when law makers and others invoke 'by design' mantras.
Bygrave, Lee Andrew (2021). Cognitive Sovereignty in the Era of Machine Learning and 'Big Data'. Full text in Research Archive Show summary
We live in a world where automated decisional systems based on machine learning (ML) and 'Big Data' increasingly govern our behaviour. These systems promise a range of benefits, yet they also throw up a congeries of challenges, not least for our ability as humans to understand their logic and ramifications. This presentation considers such challenges through the prism of 'cognitive sovereignty' – a notion coined by Ulrich Beck in his famous work 'Risikogesellschaft' (1986). For the purposes of the presentation, cognitive sovereignty essentially denotes our moral and legal interest in being able to comprehend our environs and ourselves. The presentation argues that focus on cognitive sovereignty fills a blind spot in scholarship and policy discourse on the challenges arising from increasing use of ML-enhanced decisional systems. Not only is the notion an important constituent for an overarching conceptual framing of these challenges, it is also vital for grounding normative claims for greater explicability of machine processes. Further, the presentation assesses briefly the role of law, focusing on the provisions of data protection law that specifically concern automated decision-making. It shows that data protection law provides considerable but limited support for our cognitive sovereignty. At the same time, the application of legal norms operating with broad-brush criteria of proportionality, balance, and fairness carries a danger of 'grey-box' decision-making whereby the 'black boxes' of ML-enhanced decisional systems are assessed according to woolly, relatively subjective notions of propriety that are also rather opaque.
Bygrave, Lee Andrew (2021). Biometri til besvær? Full text in Research Archive
Bygrave, Lee Andrew (2021). Cognitive Sovereignty and Machine Learning: Challenges for Society and the Law. Full text in Research Archive
Gundersen, Martin & Bygrave, Lee Andrew (2021). Helsenorge lot innbyggere dele sensitive helseopplysninger via facebook. [Internet]. NRK. Full text in Research Archive
Bygrave, Lee Andrew (2021). Data Protection Authorities: Multi-Taskers Under Pressure. Full text in Research Archive
Bygrave, Lee Andrew (2021). Automatiserte avgjørelser. Full text in Research Archive
Bygrave, Lee Andrew (2021). Contract as Regulatory Mechanism in Internet Governance: A Critical Assessment. Full text in Research Archive
Bygrave, Lee Andrew (2021). Rettslige rammer for sikkerhet på Internett. Full text in Research Archive
Bygrave, Lee Andrew (2021). Security Theatre? The Law and Politics of "Security by Design". Full text in Research Archive
Bygrave, Lee Andrew (2021). The Role of Human Oversight under the EU's Proposal for an Act on Artificial Intelligence. Full text in Research Archive
Bygrave, Lee Andrew & Langved, Åshild (2021). Telenor svarer etter Myanmar-kritikk. [Journal]. Dagens Næringsliv. Full text in Research Archive
Bygrave, Lee Andrew (2020). The Schrems II judgment of the EU Court of Justice in Historical Perspective. Full text in Research Archive
Bygrave, Lee Andrew (2020). European Data Protection: Is it Fit for Purpose in an Age of Algorithmic Regulation? Full text in Research Archive
Wagner, Eva; Møretrø, Trond; Moen, Birgitte; Heir, Even; Langsrud, Solveig & Kober-Rychli, Katrin [Show all 9 contributors for this article] (2020). PathoSeq: A multidisciplinary project aiming to materialize the benefits of whole genome sequencing in the food processing industry. Full text in Research Archive
Bygrave, Lee Andrew (2020). GDPR etter ett år: hvilke betydning har den faktisk hatt for private aktørers atferd? Full text in Research Archive
Bygrave, Lee Andrew (2020). Hvordan styrer internettet deg? Jussens rolle. Full text in Research Archive
Hunsbedt, Christiane; Bygrave, Lee Andrew; Fagerlund, Annette & Langsrud, Solveig (2024). Legal Regulation of Whole Genome Sequencing of Listeria monocytogenes in the Food Industry: Challenges, Attitudes, Possibilities. PathoSeq Project Report, WP5. University of Oslo, Faculty of Law. Full text in Research Archive Show summary
This report presents the outcome of legal research conducted under the aegis of the project ‘Food Safety with High Precision—Pathogenomics for the Food Industry’ (short title: PathoSeq). A central objective of the PathoSeq project has been to prepare the Norwegian food industry for challenges accompanying the introduction of whole genome sequencing (WGS) of foodborne bacteria. The report elucidates the legal rules that may affect the implementation of WGS of bacterial pathogens in the food industry, using Listeria monocytogenes (Lm) as a case study. While the report focuses predominantly on the Norwegian context, account is also taken of the experiences and practices of certain other European states, particularly Austria, in light of EU food safety rules. Three key issues are canvassed: (i) the role of WGS data in assessing the safety of food; (ii) access by food safety authorities to WGS data, or to isolates on which to perform WGS, from the food industry; and (iii) food business operators’ ability to receive Lm isolates and sequences held by the authorities. A special feature of the report is that it builds on, and presents, an extensive mapping of stakeholder perspectives on these issues and, more generally, on potentials, hindrances and needs in respect of mitigating Lm-related risk through WGS technology.

View all works in NVA

Published Mar. 26, 2008 11:09 AM - Last modified Mar. 19, 2026 2:07 PM

Lee Andrew Bygrave

Background

Special fields

Publications

Projects

Completed projects

Research groups