mikolajbarczentewicz

Mikolaj Barczentewicz

Tech & privacy regulation / digital-platform law expert.

Voice: Operator perspective; mixes growth tactics with product thinking.

Frameworks

• To assess an 'appropriate fee' in 'pay or OK' models, evaluate across five distinct methodological approaches: cost-plus, foregone revenue, willingness to pay, capacity to pay, and price benchmarking against comparable services.
• When evaluating emerging technologies under rights-based regulation, the maturity stage at which judicial scrutiny occurs dramatically affects whether the technology can be recognized as protected expression versus dismissed as a disposable novelty that 'must comply' with legacy interpretations.
• Effective regulatory reform requires addressing structural institutional bias rather than superficial compliance burden ('red tape'). Privacy absolutism embedded in enforcement mechanisms creates more fundamental problems than administrative overhead.
• Credible privacy-preserving AI requires combining hardware-backed confidential computing (TEEs) with voluntary technical self-restraint by providers, which together enable both frontier capabilities and data safety while strengthening the case for legal protections.
• When advising on or regulating complex platform issues, practitioners must simultaneously address all applicable legal regimes (privacy, competition, etc.) rather than optimizing for a single perspective, as tensions between frameworks are real and cannot be magicked away.

Principles

• Proportionality in regulation requires rigorous evidence that laws do not impose disproportionate costs or restrict fundamental rights; lack of such rigor constitutes 'proportionality-washing'.
• When regulators require a free alternative to paid consent (FAWBA), it logically nullifies any pricing constraints on premium tiers—since the free alternative already removes coercion, businesses can charge arbitrarily for ad-free options.
• Enforcement accountability should extend beyond single-objective metrics to encompass all downstream effects on market structure and business model viability.
• Regulatory proposals cannot succeed without accompanying enforcement reform; policy design must account for implementation capacity.
• Regulatory guidance that imposes costs without clarifying risk reduction creates a compliance theater that disadvantages regional players against foreign competitors who face no enforcement.
• In adequacy assessments for data transfers, 'adequate' or 'essentially equivalent' does not require identical safeguards—third-country measures may differ in form so long as they are effective in practice and provide meaningful controls and ex post judicial review.
• Regulatory frameworks designed for centralized services become misapplied and ineffective when applied to open-source/open-weights technology where the model runs on user infrastructure with no data transfer to developers.
• High consent rates in privacy choices may reflect genuine user indifference to pseudonymous data sharing rather than evidence of dark patterns or coercion.
• Legal interpretation of emerging technology should account for not-yet-realized potential and analogize to how law accommodated similar precedents, rather than applying absolutist readings that would ban the technology.
• Revealed preference (willingness to pay) is a more valid measure of user choice than stated preference (survey responses); legal frameworks that ignore this distinction create entitlement to services without corresponding burden.
• When assessing general-purpose technologies for regulation, seek out high-impact niche use cases (not just popular consumer uses) to build accurate mental models of value, because public perception of 'trivial' use can bias risk-benefit analysis in law.
• Using GDPR urgency procedures to undermine ongoing lead supervisory authority proceedings constitutes procedural abuse when the urgency argument is weak or artificially constructed.
• When evaluating the legitimacy of business practices under privacy law, comparison must account for economic fundamentals like market context and innovation returns, not superficial margin differences or expense categories.
• In privacy regulation, the private sphere should be limited to data that must be requested by scripts running on the user's device, not extended to information the device actively broadcasts (HTTP headers, IP addresses, URL parameters).
• Maximalist regulatory interpretations that stretch beyond strong legal grounds are tactically counterproductive because they're more likely to be ignored than enforced.
• When advocating for regulatory flexibility, defensive argumentation (educating policymakers) is insufficient; proponents must proactively design concrete technical and compliance alternatives that achieve the regulator's goals without sacrificing core product benefits.
• Product disclaimers and user expectations should matter for GDPR accuracy requirements—legal interpretations that ignore how a product is actually presented and used risk becoming absurd and disproportionate.
• Regulatory bodies should provide evidence-based justification for policy interpretations that create downstream costs on non-targeted market participants, rather than relying on stated aims to justify implementation choices.