SCRIPTed: A Journal of Law, Technology & Society
SCRIPTed is an international, interdisciplinary, open-access journal publishing high-quality scholarship at the intersection of law, technology, and society. The journal publishes peer-reviewed Articles, Analysis Pieces, and Case/Legislation Comments, alongside Book Reviews, Conference Reports, and other scholarly contributions relevant to its scope. SCRIPTed is associated with the SCRIPT Centre, the Centre for Research in Intellectual Property and Technology Law, based within the School of Law at the University of Edinburgh. Since its establishment in 2002, SCRIPT has been a leading centre for research examining the legal, social, ethical, and regulatory implications of technological change. The journal welcomes contributions from researchers and professionals across disciplines and jurisdictions. Its scope encompasses a broad range of topics, including intellectual property, privacy and data protection, digital technologies, artificial intelligence, platform governance, telecommunications, internet regulation, health technologies, biotechnology, genomics, bioethics, access to medicines, and the governance of emerging technologies more generally. Since publishing its first issue in 2004, SCRIPTed has established itself as a leading forum for interdisciplinary scholarship in law and technology. The journal has published more than forty issues featuring contributions from academics, practitioners, policymakers, and researchers from around the world. SCRIPTed is managed by postgraduate researchers at the University of Edinburgh Law School and supported by a team of LLM student Assistant Editors, reflecting the journal's longstanding commitment to developing the next generation of scholars in law and technology.
Data Protection, Privacy and Artificial Intelligence: To Govern or to Be Governed, That Is the Question
Copyright (c) 2025 Anıl Sena Bayındır https://creativecommons.org/licenses/by-nc-nd/4.0
The Digital Mirage: India's Evolving Legal Battle Against Deepfake Technology
The proliferation of deepfake technology in India presents unprecedented challenges to existing legal frameworks, threatening individual dignity, democratic processes, and social harmony. This research conducts a comprehensive analysis of India's legal response to Artificial Intelligence-generated (AI-generated) synthetic media through doctrinal examination, empirical case studies, and comparative jurisprudence. The study reveals critical gaps in India's current legal architecture. While provisions under the Information Technology Act 2000, Indian Penal Code 1860, The Bharatiya Nyaya Sanhita, 2023 (BNS), and emerging data protection laws offer partial protection, they lack specificity for deepfake-related harms. The research examines landmark cases including Arijit Singh v. Codible Ventures LLP and high-profile celebrity deepfake incidents, demonstrating judicial evolution toward protective personality rights jurisprudence despite legislative ambiguity. Through systematic analysis of enforcement mechanisms, the study identifies significant implementation challenges including technical detection limitations, jurisdictional complexities, and inadequate institutional capacity. Empirical assessment of complaint data from the National Crime Records Bureau and state cybercrime cells reveals poor conviction rates and prolonged resolution timelines, highlighting the enforcement-legislation disconnect. The research proposes a comprehensive regulatory framework centred on a dedicated Synthetic Media Regulation Act, incorporating graduated harm-based penalties, platform accountability standards, and victim compensation mechanisms. The proposed multi-stakeholder governance model balances innovation promotion with fundamental rights protection through safe harbour provisions for legitimate uses while criminalizing non-consensual creation and distribution. Key contributions include the first systematic legal analysis of India's deepfake regulatory landscape, evidence-based policy recommendations, and an implementation roadmap addressing short-term enforcement needs and long-term institutional reforms. The study positions India to lead global synthetic media governance while protecting citizens from AI-generated deception in an increasingly digital society.
Copyright (c) 2025 Sommya Kashyap https://creativecommons.org/licenses/by-nc-nd/4.0
Cross-Border Data Transfers and Data Localization Mandate under the Data Protection Regime
The present paper critiques India's approach to cross-border data transfers under the Draft Digital Personal Data Protection Rules 2025. It highlights concerns with Rule 14 and Rule 12(4), which grant the government broad discretion to impose data localization mandates, potentially restricting the transfer of specific data types regardless of the destination country's safety. This "regressive" approach could stifle innovation and create compliance hurdles for businesses, especially social media intermediaries. The paper also points out the ambiguity in defining restrictions and the lack of provisions for "onward transfers" of data, contrasting it with the more comprehensive GDPR. It advocates for a balanced framework with clear criteria for restrictions and safeguards, aligning with international best practices to ensure both national security and economic viability.
Copyright (c) 2025 Khushi Malviya, Eeshaan Singh https://creativecommons.org/licenses/by-nc-nd/4.0
Intellectual Property Rights Protection in International Investment: Legal Risks and Strategic Responses for Multinational Companies
Against the backdrop of ongoing globalisation and the rapid development of the digital economy, the protection of intellectual property rights (IPRs) has become a key factor in the overseas investment decisions of multinational companies (MNCs). This paper first reviews the evolution of international IPR regimes and their essential status in investment agreements. It then takes the Eli Lilly v Canada case as a core example to deeply analyse three significant difficulties currently faced in the protection of IPRs in cross-border investment: first, the uneven enforcement of laws across countries, which leads to inconsistent effectiveness in IPRs protection; second, the vague, outdated, and insufficiently adaptive provisions in existing investment and trade agreements, which fail to cover emerging technological fields effectively; third, the divergence between the application of international agreements and domestic legal systems, which increases legal uncertainty and compliance costs for multinational enterprises. Finally, the paper puts forward recommendations from both state and corporate perspectives, including strengthening international cooperation, improving the dynamic adjustment mechanisms of agreements, and urging enterprises to establish localised IPR strategies and compliance management systems. The article emphasises the need to construct a more coordinated, efficient, and forward-looking international IPR governance system to balance the protection of innovation with national sovereignty and corporate interests.
Copyright (c) 2025 Jingyi Zhang https://creativecommons.org/licenses/by-nc-nd/4.0
Copyright (c) 2025 Mihail Dishev, Aubrey Wasden https://creativecommons.org/licenses/by-nc-nd/4.0
Data Protection, Privacy and Information Law: A Practical Guide
Copyright (c) 2025 Daniela Bincheva https://creativecommons.org/licenses/by-nc-nd/4.0
Artificial Intelligence, Co-Creation and Creativity: The New Frontier for Innovation
Copyright (c) 2025 Damián Palašta https://creativecommons.org/licenses/by-nc-nd/4.0
With the dawn of artificial intelligence (AI), it is only a matter of time before it amplifies or even replaces human decision-making in corporate governance. This threatens to subvert the core concepts of a director as laid down in the Companies Act, 2013, like director duties, accountability, and the nature of corporate leadership. This article delves into the legal ramifications of integrating AI inside the corporate boardrooms, specifically from the statutory lens of Indian corporate laws. This paper focuses on Chapter XI, where it explores the applicability–or the lack thereof, of these provisions when AI systems are engaged in board decisions. The issues revolve around AI’s decision making–the legal status and the allocation of liability for harmful decisions influenced by AI systems–in light of directors’ fiduciary duties. Additionally, it examines the challenges of ensuring transparency, particularly in relation to algorithmic biases and the Black Box Phenomenon. This article concludes by proposing recommendations for a comprehensive regulatory framework governing the ethical use of AI in corporate boards, including, but not limited to–guidelines for algorithmic accountability, regular AI system audits, and enhanced disclosure requirements for companies employing AI in governance. Through this research, the author seeks to advance the emerging field of AI governance and provide insights for policymakers, corporate directors, and AI developers working at the intersection of technology and corporate law.
Copyright (c) 2025 Vydhrithi Reddy https://creativecommons.org/licenses/by-nc-nd/4.0
Ready, Willing, and Able? Challenges Facing the Governance of Generative AI in the UK’s Legal Services Sector
In light of the increasing prominence of generative AI, this paper examines a number of critical challenges facing the stratified policy and governance frameworks shaping the adoption of this technology in the legal services sector. We argue that there are counterproductive tensions within the existing policy and governance framework, and that if we are to make the UK legal sector ‘ready, willing, and able’ to harness the potential of artificial intelligence, it is imperative that we set in place a new governance framework that is capable of setting, promoting, and supporting innovation across the legal sector as a whole. Furthermore, within this policy and governance framework we consider two critical factors that are relevant to state-of-the-art AI systems which present critical challenges to the development of legal AI: (1) data access issues in the domain of law and (2) knowledge, skills, and awareness of capabilities relating to the application of generative AI to legal problems.
Copyright (c) 2025 David Bareham, Katie Atkinson, Jeremy Marshall https://creativecommons.org/licenses/by-nc-nd/4.0
Intent, control and creative freedom in AI- Supported Output: Lessons from Photography
The advancements achieved by generative AI have marked a significant step in creative art, raising copyright law questions, particularly around issues of authorship, originality and the role of AI in the creative process. Copyright law has grappled with similar challenges before, especially with the advent of emerging technologies, as evidenced during the early days of photography. Just as photography was initially viewed as the product of a machine rather than a human creation, so is output created with the support of generative AI often seen as predominantly AI driven. By drawing an analogy with the camera, this article explores how the users’ expression of free and creative choices, a fundamental aspect of originality under EU copyright law, can be identified at various stages in the production process of AI-supported output. It argues that the stage of ‘taking a photograph’ encompasses a series of human decisions rather than being an isolated act of pressing the shutter. Similarly, if the execution stage is seen as a process of converting users’ decisions into a preliminary output—much like ‘shooting a photograph’—those decisions can also serve as an additional element for attributing originality to AI-supported outputs. In analysing the emerging standards of authorial intent and control in assessing originality for AI-supported outputs, the article explores the distinction between semantic and categorial intentions, as well as the interplay between intent, control and the predictability of the outcome. It concludes that since categorial intent is always achieved and therefore infallible, the AI-supported output will consistently align with the author’s conception or fundamental approach to the work. Moreover, while authorial control and intent alone cannot establish originality, they can nonetheless contribute to assessing the originality of AI-supported output when they are evident in the creative process or its outcomes.
Copyright (c) 2025 Adriana Berbec https://creativecommons.org/licenses/by-nc-nd/4.0
Copyright (c) 2025 Mihail Dishev, Claudia González-Márquez https://creativecommons.org/licenses/by-nc-nd/4.0
The Internet, Internet Intermediaries and Hate Speech: Freedom of Expression in Decline?
This paper looks at the developments of hate speech regulation online, specifically its horizontalization, with private companies increasingly ruling on the permissibility levels of speech, placing the right to free speech at peril. To elucidate issues at stake, the paper will look at the meaning of hate speech, the online landscape in terms of the prevalence and removal of hate speech and recent legal and policy developments in the sphere of private regulation in Europe, critically weighing up the pros and cons of this strategy. This paper demonstrates how seeking to tackle all types of hate speech through enhanced pressures on intermediaries to remove content may come with dire effects to both freedom of expression and the right to non-discrimination. At the same time, due attention must be given to speech which may actually lead to real world harm. A perfect solution is not available since, as is the case in the real world, the Internet cannot be expected to be perfect. However, at the very least, the principles and precepts of IHRL and the thresholds attached to Article 20(2) ICCPR, as further interpreted by the Rabat Plan of Action, must inform and guide any effort in enhanced platform liability.
Copyright (c) 2023 The Author(s) https://creativecommons.org/licenses/by-nc-nd/4.0
Regulating Manipulative Artificial Intelligence
AI scientists are rapidly developing new approaches to understanding and exploiting vulnerabilities in human decision-making. As governments around the world grapple with the threat posed by manipulative AI systems, the European Commission (EC) has taken a significant step by proposing a new sui generis legal regime (the AI Act) which prohibits certain systems with the ’significant’ potential to manipulate. Specifically, the EC has proposed prohibitions on AI systems which deploy subliminal techniques and exploit vulnerabilities in specific groups. This article analyses the EC’s proposal, finding that the approach is not tailored to address the capabilities of manipulative AI. The concepts of subliminal techniques, group-level vulnerability, and transparency, which are core to the EC’s proposed response, are inadequate to meet the threat arising from growing capabilities to render individuals susceptible to hidden influence by surfacing and exploiting vulnerabilities in individual decision-making processes. In seeking to secure the benefits of AI while meeting the heightened threat of manipulation, lawmakers must adopt new frameworks better suited to addressing new capabilities for manipulation assisted by advancements in machine learning.
How Will the EU Digital Services Act Affect the Regulation of Disinformation?
This article examines the self-regulatory framework established by the EU Code of Practice on Disinformation and considers how the EU Digital Services Act [DSA] will affect that framework. Firstly, this article argues that the DSA entrenches the opacity of firms’ partnerships with fact-checking organisations and investigations of coordinated inauthentic behaviour, as well as fails to provide adequate transparency of its newly created redress mechanisms. Secondly, this article argues that, overall, the DSA fails to protect European standards of freedom of expression in the regulation of disinformation, reflecting an uncertainty of how public bodies should regulate the private gatekeepers of information. As these public bodies press private actors to address disinformation—lawful if undesirable expression—the question of the effect of informal state pressure on the horizontal application of fundamental rights gains a sense of urgency.
Operationalizing Privacy by Design: an Indian illustration
This article identifies Privacy by Design [“PbD”] as a suitable regulatory approach to address the attack on personal data in the Fourth Industrial Revolution. It proposes Privacy Engineering [“PE”] as a concrete methodology to operationalize the otherwise vague Privacy by Design. Privacy Engineering operationalizes the normative knowledge of privacy into specific use cases through layers of flexible abstract thinking, interconnected through a “web of templates”. This “web of templates” can be constructed by answering the two-fold question of relevancy and extent of data protection required. PE provides regulators with a specific language in which they can communicate with data controllers to establish privacy obligations and undertake prioritized capacity building for resource-deprived data controllers.
A Risk-based Approach to AI Regulation: System Categorisation and Explainable AI Practices
The regulation of artificial intelligence (AI) presents a challenging new legal frontier that is only just beginning to be addressed around the world. This article provides an examination of why regulation of AI is difficult, with a particular focus on understanding the reasoning behind automated decisions. We go on to propose a flexible, risk-based categorisation for AIbased on system inputs and outputs, and incorporate explainable AI (XAI) into our novel categorisation to provide the beginnings of a functional and scalable AI regulatory framework.
The Right to Repair: Patent Law and 3D Printing in Australia
Considering recent litigation in the Australian courts, and an inquiry by the Productivity Commission, this paper calls for patent law reform in respect of the right to repair in Australia. It provides an evaluation of the decision of the Full Court of the Federal Court in Calidad Pty Ltd v Seiko Epson Corporation [2019] FCAFC 115 – as well as the High Court of Australia consideration of the matter in Calidad Pty Ltd v Seiko Epson Corporation [2020] HCA 41. It highlights the divergence between the layers of the Australian legal system on the topic of patent law – between the judicial approach of the Federal Court of Australia and the Full Court of the Federal Court of Australia, and the endorsement of the patent exhaustion doctrine by the majority of the High Court of Australia. In light of this litigation, this paper reviews the policy approach taken by the Productivity Commission in respect of patent law, the right to repair, consumer rights, and competition policy. After the considering the findings of the Productivity Commission, it is recommended that there is a need to provide for greater recognition of the right to repair under patent law. It also calls for the use of compulsory licensing, crown use, competition oversight, and consumer law protection to reinforce the right to repair under patent law. In the spirit of modernising Australia’s regime, this paper makes a number of recommendations for patent law reform – particularly in light of 3D printing, additive manufacturing, and digital fabrication. It calls upon the legal system to embody some of the ideals, which have been embedded in the Maker’s Bill of Rights, and the iFixit Repair Manifesto. The larger argument of the paper is that there needs to be a common approach to the right to repair across the various domains of intellectual property – rather than the current fragmentary treatment of the topic. This paper calls upon the new Albanese Government to make systematic reforms to recognise the right to repair under Australian law.
More on Convening Technology: Blockchain, Fashion, and the Right to Know
For many years mired in its cryptocurrency history, blockchain held little interest to those working outside the financial world. It now offers the fashion industry and its diverse publics the enticing prospect of a transparent value chain for ethical and sustainable fashion, catering to public demands for a right to know data on authenticity and provenance. Whether this is a feasible prospect remains to be seen. Nevertheless, in staking out its position, blockchain appears to be moving into an interesting phase of its short tumultuous existence. In short, it is taking on the character of a “convening technology” – becoming “the focus of a conversation that can [potentially] address issues far beyond what it may ultimately be able to address itself”, and marshalling “resources, institutions and other forms of power”. A difficulty is reconciling this beneficial function with the need for the so-called “technology of trust” to be trustworthy in practice, requiring at least a minimal governance model.
Copyright (c) 2022 The Author(s) https://creativecommons.org/licenses/by-nc-nd/4.0
Copyright in AI-generated works: Lessons from recent developments in patent law
In Thaler v The Comptroller-General of Patents, Designs and Trade Marks (DABUS), Smith J. held that an AI owner can possibly claim patent ownership over an AI-generated invention based on their ownership and control of the AI system. This AI-owner approach reveals a new option to allocate property rights over AI-generated output. While this judgment was primarily about inventorship and ownership of AI-generated invention in patent law, it has important implications for copyright law. After analysing the weaknesses of applying existing judicial approaches to copyright ownership of AI-generated works, this paper examines whether the AI-owner approach is a better option for determining copyright ownership of AI-generated works. The paper argues that while contracts can be used to work around the AI-owner approach in scenarios where users want to commercially exploit the outputs, this approach still provides more certainty and less transaction costs for relevant parties than other approaches proposed so far.
Blockchain-based electronic time stamps and the eIDAS regulation: The best of both worlds
Blockchain technology, introduced in the Bitcoin blockchain in 2009, can be used to ensure the integrity of data using a distributed consensus algorithm, executed by a potentially large number of participants. A variety of blockchain applications have been proposed in recent years. The distributed nature of blockchains is advantageous in many respects but can be challenging from a legal and regulatory perspective. The European eIDAS regulation, for example, regulates trust services—but it assumes these services to be provided by individual trusted entities instead of multiple collaborating parties. We show how a particular eIDAS service, (qualified) electronic time stamps, can be seen as competing with blockchain technology. Both concepts can be used to provide proof of the existence of specific data at a certain point in time. On this basis, we explain to which extent a combination of both concepts is possible and useful in practice. This is founded on both technical and legal arguments. If the combination gains practical relevance, it may endanger a business model of trust service providers, possibly necessitating action by the state.
[Redacted]: This Article Categorised [Harmful] by the Government
In April 2019, the UK Government’s DCMS released its White Paper for ‘Online Harms’, which would establish in law a new duty of care towards users by platforms to be overseen by an independent regulator. Our earlier research outlines how we got to this point, sets out what the White Paper proposes, and criticises its key aspects. Our objections and criticism remain applicable to the UK Government’s Online Safety Bill. The Parliament is now scrutinising the Bill. The House of Lords Report sparked some optimism that the scrutiny could address critical concerns around free speech in particular. The Draft Online Safety Bill Joint Committee Report, however, suggest otherwise. This paper returns to key arguments as to why risk-based regulation and duty of care are not appropriate for policing content and expression online. We focus on the human rights implications of the Bill, in particular, the provider duties to ‘handle’ legal but harmful content. Here, we reemphasise the vague conceptualisation and nature of this harm, as well as the inadequate duties attached to it. We argue that the independence of OFCOM cannot be guaranteed.
Reviving a European Idea: Author’s Right of Withdrawal and the Right to Be Forgotten under the EU’s General Data Protection Regulation (GDPR)
The right of withdrawal allows authors to unilaterally withdraw a copyright contract and retract copyrighted work to disassociate based on moral reasons. Although accepted in some European jurisdictions, the right of withdrawal is mainly theoretical due to the scarcity of case law resulting from its strict requirements. Therefore, it has been perceived as a concept without practical use. However, this right is underpinned by a significant and still valid European idea reflected by the EU’s General Data Protection Regulation, outlined in the data subject’s right to be forgotten. While the right of withdrawal and the right to be forgotten have different characteristics and goals, these two rights share the same reasoning, emphasising that the same European spirit is still alive and very much needed.
Legal Algorithms and Solutionism: Reflections on Two Recidivism Scores
Algorithms have entered courts, e.g. via scores assessing recidivism. At first sight, recent applications appear to be clear cases of solutionism, i.e. attempts at fixing social problems with technological solutions. Deploying thematic analysis on assessments of two of the most prominent and widespread examples of recidivism scores, COMPAS and the PSA, casts doubt on this notion. Crucial problems – as different as “fairness” (COMPAS) and “proper application” (PSA) – are not tackled in a technological manner but rather by installing conversations. It shows that even technorationalists never see the technological solution in isolation but are actively searching for flanking social methods thereby accounting for problems that cannot be eased technologically. Furthermore, we witness social scientists called upon as active parts of such engineering.
Copyright (c) 2021 The Author(s) https://creativecommons.org/licenses/by-nc-nd/4.0
Biomedical Data Identifiability in Canada and the European Union: From Risk Qualification to Risk Quantification?
Data identifiability standards in Canada and the European Union rely on the same concepts to distinguish personal data from non-personal data. However, courts have interpreted the substantive content of such metrics divergently. Interpretive ambiguities can create challenges in determining whether data has been successfully anonymised in one jurisdiction, and whether it would also be considered anonymised in another. These difficulties arise from the law’s assessment of re-identification risk in reliance on qualitative tests of ‘serious risk’ or ‘reasonable likelihood’ as subjectively appreciated by adjudicators. We propose the use of maximum re-identification risk thresholds and quantitative methodologies to assess data identifiability and data anonymisation relative to measurable standards. We propose that separate legislation be adopted to address data-related practices that do not relate to demonstrably identifiable data, such as algorithmic profiling. This would ensure that regulators do not expand the jurisprudential conception of identifiable data purposively to capture such practices.
NISD2: A Common Framework for Information Sharing Among Network Defenders
Sharing information about vulnerabilities and attacks is essential to defend information systems against threats such as malware, phishing and unauthorised access. By identifying this information sharing as a legitimate interest of data controllers, and highlighting the public interests that it serves, the draft Network and Information Security Directive provides a framework to encourage European participation in global information sharing, benefitting all users of the Internet.
We live in a world where technological corporations hold unprecedented power and influence. Technological solutions to social, political, and economic challenges are rampant. In the Global South, technology that is developed with Western perspectives, values, and interests is imported with little regulation or critical scrutiny. This work examines how Western tech monopolies, with their desire to dominate, control and influence social, political, and cultural discourse, share common characteristics with traditional colonialism. However, while traditional colonialism is driven by political and government forces, algorithmic colonialism is driven by corporate agendas. While the former used brute force domination, colonialism in the age of AI takes the form of ‘state-of-the-art algorithms’ and ‘AI driven solutions’ to social problems. Not only is Western-developed AI unfit for African problems, the West’s algorithmic invasion simultaneously impoverishes development of local products while also leaving the continent dependent on Western software and infrastructure. By drawing examples from various parts of the continent, this paper illustrates how the AI invasion of Africa echoes colonial era exploitation. This paper then concludes by outlining a vision of AI rooted in local community needs and interests.
Copyright (c) 2020 The Author(s) https://creativecommons.org/licenses/by-nc-nd/4.0
The Ghost in the Machine – Emotionally Intelligent Conversational Agents and the Failure to Regulate ‘Deception by Design’
Google’s Duplex illustrates the great strides made in AI to provide synthetic agents the capabilities to intuitive and seemingly natural human-machine interaction, fostering a growing acceptance of AI systems as social actors. Following BJ Fogg’s captology framework, we analyse the persuasive and potentially manipulative power of emotionally intelligent conversational agents (EICAs). By definition, human-sounding conversational agents are ‘designed to deceive’. They do so on the basis of vast amounts of information about the individual they are interacting with. We argue that although the current data protection and privacy framework in the EU offers some protection against manipulative conversational agents, the real upcoming issues are not acknowledged in regulation yet.