Governing the shadow of hierarchy: enhanced self-regulation in European data protection codes and certifications

This paper process-traces how European policymakers have delegated regulatory responsibilities to private certification and monitoring bodies acting as regulatory intermediaries. It explores how regulators can constrain or incentivise self-regulation that exists in their shadow via intermediaries, instead of using direct modes of regulation.