For years, the legal profession has moved steadily towards greater specialisation. The more senior the lawyer, the more narrowly defined their area of expertise often becomes. There is good reason for that. Complex questions call for deep expertise, and no one should pretend to know everything.
Clients, however, do not experience their business through neat legal categories. A single business issue often cuts across several areas of law, and it rarely makes sense to break it down according to the legal profession’s own internal boundaries. This is especially true in areas such as technology projects and M&A, where different legal questions quickly become intertwined.
That is why depth needs to be matched by the ability to see how different issues connect with one another and with the client’s business. Expertise in a single area of law will not, on its own, solve the whole problem. At Folks, we have been deliberately building around that idea.
The generalist may be making a comeback
Although professional work has long been moving towards ever greater specialisation, AI appears to be creating a parallel trend in the other direction. In its 2026 AI predictions, for example, PwC talks about the rise of the generalist. The idea is that as AI takes on more narrowly defined expert tasks, human roles may become broader.
Less value is tied to carrying out a narrowly defined task, and more to working across functions, exercising judgement and keeping sight of the outcome. PwC’s 2026 Global AI Jobs Barometer points in the same direction. Based on more than one billion job postings, the report finds that roles heavily exposed to AI increasingly call for judgement and leadership alongside technical skills, with even junior roles requiring capabilities traditionally associated with more experienced professionals.
The shift is easy to recognise in legal work. Research, first-pass analysis and drafting are becoming faster, while the importance of the lawyer’s own judgement increases. A lawyer’s value lies less and less in finding information, and more in putting that information into context and using it well.
What does a good generalist actually do?
Talking about generalists can sound like a return to a time when one corporate lawyer was expected to handle everything. That is not the idea. A modern generalist does not try to master every area of law personally; they understand business and law broadly enough to make sense of the whole situation.
A single client issue may cut across several areas of law. From the client’s perspective, however, these are not separate assignments but one problem that needs to be solved. A good generalist identifies what really matters, what can be dealt with quickly and where deeper specialist expertise is needed.
The Harvard Law School Center on the Legal Profession has highlighted the same point. Complex situations require the ability to bring several perspectives together, rather than simply ever narrower specialisation. General Counsel, in particular, operate at the intersection of law, business, risk and strategy. KPMG’s 2026 Global General Counsel Outlook reflects the same shift in practice. According to the report, 75% of General Counsel are regularly or continuously asked for views on matters that go beyond purely legal questions. Senior management also places a premium on the ability to balance risk against opportunity.
This way of working is familiar to us at Folks, because most of our lawyers have spent part of their careers in in-house legal teams. In-house, you cannot simply say that an issue falls outside your area and leave it there. You first need to understand what the real issue is, and then work out what should be done about it.
Knowing the client makes that judgement much better. When a lawyer understands the business model, the people, the way decisions are made and the organisation’s risk appetite, it becomes easier to judge the right level of legal input. A EUR 1,000 issue should not usually be handled with EUR 100,000 precision. That is what we mean when we talk about right-sized legal support and an in-house mindset.
Breadth only works if there is real depth behind it
A generalist model only works if it is backed by genuine specialist expertise. For us, expertise is not about titles and certificates on a website, but about having handled demanding issues repeatedly and in practice over a long period of time. Depth comes from experience, difficult situations and solving similar problems across different organisations.
We have, for example, built data protection programmes for some of Finland’s largest companies, but in practice that work reaches far beyond the GDPR. You need to understand how data moves through the organisation, how systems and supplier chains work, what the business is trying to achieve through technology and how digitally mature the organisation is. Legal expertise has to connect with an understanding of how the organisation actually works.
Media is a slightly different example. For us, it is first and foremost an industry, and years of working at its core have built deep expertise across several areas of law: from copyright to marketing, technology procurement to data protection, and competition law to freedom of expression. Working deeply within one industry also teaches you more than its sector-specific legal rules. You learn to see how different areas of law and business models connect in practice. The same underlying structures appear in different forms in other industries as well. Strong sector knowledge can therefore make a lawyer better even when the business environment changes.
Sometimes the issue becomes a project
A legal issue can also grow from a single question into a broader project. In larger projects, getting the individual legal answers right is no longer enough. Someone needs to see the whole picture, identify the critical points and keep the work moving together with the client organisation and other advisers.
Legal is no longer a separate workstream running alongside the project; it is part of the project itself. Alongside substantive legal expertise, this calls for project management skills and the ability to get the whole thing over the line. The lawyer’s role is not only to answer the legal questions, but to help make sure the project actually progresses.
We have advised on hundreds of M&A transactions and corporate restructurings. Transactions are often the most visible examples externally, but the same kind of project capability is needed when a company builds a new data protection or compliance model, restructures a key contract framework, carries out an outsourcing or rolls out new technology. Ideally, the client should not need to change advisers simply because an individual legal question has grown into a larger project.
Three layers, one way of working
The Folks model is built around three layers: a generalist who knows the client, specialist expertise where it is needed, and the ability to take responsibility for larger projects when an individual issue grows into something bigger. Sometimes a quick call is enough, sometimes you need a specialist, and sometimes the right answer is a full team. The point is that the way we work should flex with the client’s needs, without the client having to assemble a new group of advisers every time.
This is the kind of law firm we want to build at Folks. Not a generalist firm instead of a specialist firm, and not a collection of disconnected specialists, but a legal team where breadth, depth and project capability reinforce one another. The idea is ultimately simple: clients should get the right kind of legal support at the right scale.
Two new lawyers will be joining that set-up in November, by the way. More on them soon!
Anna Paimela
Partner
+358 40 1648626
“Environmentally friendly”, “carbon neutral” and “responsible” have become established terms in marketing. Environmental claims have not been allowed to be misleading before either, but from 27 September 2026 the rules will become more specific and certain practices will be prohibited in all circumstances. The new rules on green claims mean that companies should review their consumer-facing environmental claims, sustainability labels, climate targets and product information.
What rules are changing?
The reform is based on Directive (EU) 2024/825, which amends the EU directives on unfair commercial practices and consumer rights. In Finland, the Directive has been implemented through an amendment to the Consumer Protection Act and a new Government Decree. The reform applies to consumer-facing marketing and practices in customer relationships, regardless of the size of the company. The rules may apply to websites, advertising, commercial content on social media, packaging, product information in online stores and other sustainability communications aimed at consumers.
The Directive should not be confused with the separate Green Claims Directive proposal. Its legislative process is currently stalled, and the proposal has neither been adopted nor formally withdrawn.
When will the new rules apply?
The new provisions will apply from 27 September 2026. A limited transitional rule applies to marketing included on goods, or on their packaging, that were placed on the market before that date. Certain prohibitions concerning sustainability labels, generic environmental claims and the scope of environmental claims will only apply to such marketing from 27 March 2027. This is not a general extension for all green claims. The transitional rule does not apply, for example, to online advertising, new packaging or other practices prohibited under the new rules.
What kinds of environmental claims can be used?
Generic expressions such as “environmentally friendly”, “green”, “ecological” and “climate friendly” will generally be prohibited unless the company can demonstrate recognised excellent environmental performance that is relevant to the claim. Such performance may be based, for example, on the EU Ecolabel or an officially recognised Type I ecolabel compliant with EN ISO 14024.
A generic claim can be made more specific by clearly explaining, in the same communication, which characteristic or part of the product the claim relates to. Even a specific claim must be truthful, up to date and verifiable. A company must not market an entire product or business as environmentally better if the claimed benefit relates only to the packaging or to one particular function.
The assessment of the term “responsible” depends on the overall impression created by the communication, as the term may refer not only to environmental impacts but also to social characteristics. If it creates the impression of a positive environmental impact, the rules on environmental claims may apply.
What about carbon neutrality and offsetting?
A product or service must not be marketed as having a neutral, reduced or positive environmental impact if the claim is based on greenhouse gas emissions offsetting. For example, offsetting-based claims such as “carbon-neutral product”, “carbon-neutral delivery” and “climate compensated” will be prohibited.
A company may still communicate genuine emissions reductions and the financing of climate projects, provided that the information is presented accurately and without misleading consumers. Offsetting must not, however, be presented as an environmental characteristic of the product itself or as a way of cancelling out the emissions caused by the product.
What is required for sustainability labels and climate targets?
A sustainability label may only be used if it is based on a qualifying third-party certification scheme or has been established by a public authority. The scheme’s conditions must be publicly available, transparent and non-discriminatory, and compliance with the requirements must be independently monitored. A company’s own assessment or internal scoring system is not, on its own, sufficient to support a “Green Choice”-type label.
A future-looking environmental claim, such as “we will be carbon neutral by 2030”, requires public and verifiable commitments as well as a detailed and realistic implementation plan.
The plan must include a measurable timeline, an assessment of the resources needed and regular monitoring by an independent expert. The expert’s findings must also be made available to consumers.
What else does the reform cover?
The new prohibitions also concern product durability, software updates and repairability. For example, it is prohibited to market goods if the company has information about a feature that limits their durability, or to claim that goods are repairable when they cannot be repaired. A software update that merely enhances functionality must not be presented as necessary.
Before a contract is concluded, consumers must be provided with new information, including information about the statutory liability for defects. Where the conditions laid down by law are met, information must also be provided about a producer’s free-of-charge durability guarantee lasting more than two years, the minimum period for software updates, the repairability score, and the availability of spare parts and repair instructions.
What can happen if the rules are breached?
Compliance with the rules is supervised by the Finnish Consumer Ombudsman.
Non-compliant practices may be prohibited, and the prohibition may be reinforced with a conditional fine. A penalty payment may also be imposed for breaches of the rules. In certain situations, the Market Court may require a company to correct its marketing.
A consumer may also be entitled to a reasonable price reduction if an unfair commercial practice can be assumed to have influenced the purchasing decision. An intentional or negligent breach may also result in liability for damages.
What should companies do now?
Before 27 September 2026, companies should:
review environmental claims used on websites, in campaigns, on social media and on packaging;
specify which product, characteristic or stage of the product life cycle each claim relates to;
compile up-to-date evidence supporting the claims and document the calculation methods used;
review offsetting claims, proprietary sustainability labels and future environmental targets;
ensure that product information flows properly from manufacturers to sellers and online stores; and
assign clear responsibility for approving and monitoring environmental claims.
The reform does not mean the end of sustainability communications. However, broad promises will increasingly need to be replaced with specific, understandable and verifiable information.
Folks helps companies identify risks related to environmental claims and packaging labels and build practical processes for marketing that complies with the new rules.
Anna Paimela
Partner
+358 40 1648626
If you would like to receive our articles directly in your inbox, subscribe to the Folks newsletter here.
Updated: Aug 5
The EU General Data Protection Regulation (GDPR) and its future: striking a balance between innovation and privacy
The GDPR is known as one of the strictest data protection laws in the world. It is an ambitious project that strengthens fundamental rights and gives individuals greater control over their personal data. At the same time, it has introduced a new culture of enforcement. Supervisory authorities have adopted a strict approach to assessing the lawfulness of personal data processing.
The landscape is now changing. The European Commission’s Digital Omnibus package aims to simplify and clarify the EU’s digital regulatory framework, including the GDPR. Reform is needed, as the current framework is widely regarded as overly burdensome and as an obstacle to innovation. This raises an important question. Are we moving from a fundamental-rights-based culture of caution to the opposite extreme, where competitiveness takes precedence over data protection? Or are we finally finding a balance in which innovation and privacy can coexist?
Strict interpretations have limited opportunities for innovation
The interpretation of the definition of personal data is central to determining whether the GDPR applies. In the Court of Justice of the European Union’s judgment in Breyer v Federal Republic of Germany (C-582/14), the Court considered whether dynamic IP addresses stored in a website’s log files constituted personal data. The service provider could not identify the user without additional information held by the telecommunications operator. The Court found that information may constitute personal data even where the additional information required for identification is held by a third party.
The key consideration was whether the controller had means reasonably likely to be used to obtain the additional information. Although the judgment itself leaves room for a case-by-case assessment of whether the controller has reasonable and lawful means of identification, the approach adopted by authorities and businesses has become increasingly cautious. Identification does not need to be likely. It is often considered sufficient that identification cannot be entirely ruled out. As a result, all GDPR obligations may become applicable unnecessarily broadly. This shifts attention away from situations involving a genuine risk to privacy.
This cautious approach has led many organisations to abandon potentially beneficial data projects. They have been reluctant, for example, to interpret the available legal bases for processing flexibly. According to the Research Institute of the Finnish Economy, Etla, strict data protection regulation has significantly reduced research and development investment by pharmaceutical and biotechnology companies. When businesses consider whether patient data, customer data or Internet of Things data can be used to develop new services and products, caution driven by the fear of sanctions often prevails. This is not solely the result of the wording of data protection legislation. It is largely a consequence of how the legislation has been interpreted by the authorities.
European policymakers have become increasingly aware that, while the EU has built the world’s strongest data protection regime, it has fallen behind the United States and China in data-driven business and artificial intelligence development. Mario Draghi’s report on European competitiveness has highlighted this issue. The Commission has therefore faced growing pressure to soften digital regulation.
Can the Omnibus bring us happiness?
The Digital Omnibus package published by the Commission on 19 November 2025 aims to simplify regulation, reduce costs and improve the EU’s competitiveness. In practice, this can be seen, for example, in proposed changes to cookie practices. The objective is to reduce the constant need to click consent banners. Users could set broader consent preferences at browser level or provide consent that remains valid for a longer period.
Another visible proposal is to postpone the application of the strictest obligations under the AI Act. This would give companies more time to bring high-risk AI systems into compliance.
Targeted amendments have also been proposed to the core of the GDPR, including changes that would narrow the definition of personal data. This would create more room for the use of personal data in training AI models, including on the basis of legitimate interests. The desire to clarify the rules and remove regulatory overlap is understandable. The current digital regulatory framework, comprising the GDPR, the Data Act, the Digital Services Act, the Digital Markets Act, the NIS2 Directive and the AI Act, has grown into a complex mosaic. Managing it is difficult even for large organisations, let alone smaller businesses.
The proposals have nevertheless attracted vocal criticism. Civil society organisations and data protection experts have described the proposed amendments as a strategy of “a thousand small cuts”. The reforms may not dismantle the GDPR as a whole, but they could weaken its effectiveness in critical areas, such as the legal bases for processing personal data used to train AI models. The key question is the extent to which the problem lies in the wording of the GDPR itself and the extent to which it lies in the culture surrounding its application.
Even before the Digital Omnibus initiative, the European Data Protection Board, or EDPB, had recognised the need for practical simplification. In the so-called Helsinki Statement, the EDPB stated that it aims to make it easier for small and medium-sized enterprises in particular to comply with the GDPR in practice. The objective is to increase dialogue with stakeholders and improve the consistency of regulation without weakening individuals’ fundamental rights. This indicates that the supervisory authorities also recognise that the application of the GDPR has become unnecessarily burdensome. Companies’ compliance work should be facilitated through measures such as practical tools and templates.
A more pragmatic approach to the definition of personal data had also begun to emerge before the Digital Omnibus proposal. In EDPS v SRB (C-413/23 P), it was confirmed that pseudonymised data generally remains personal data from the perspective of an organisation that can obtain additional information and identify the data subject using means reasonably likely to be used, in accordance with the criteria established in Breyer.
At the same time, the judgment opened the possibility that the same data may constitute personal data for one organisation but be anonymous for another organisation that has no realistic means of re-identifying the data subject. The Omnibus proposal consolidates this approach and expressly rejects the position taken by the European Data Protection Supervisor, or EDPS, in the SRB case referred to above. Pseudonymised data is not always personal data for every organisation.
Conclusion
It is clear that data protection legislation has reached a crossroads. Most of the current problems do not arise because the GDPR’s fundamental principles are inherently too strict. They arise because those principles are translated into absolute prohibitions in day-to-day practice instead of being applied through a risk-based approach. From this perspective, amendments to the GDPR’s fundamental concepts may not have been necessary. A stronger culture of interpretation based on risk would have been the more appropriate response.
It is nevertheless difficult to oppose objectives such as removing overlapping regulation, making cookie practices more sensible and reducing the administrative burden on small and medium-sized enterprises. The coming years will determine whether the EU can modernise its data protection framework in a way that preserves its normative strength while enabling innovation.
The central question is whether reform can be achieved without weakening privacy protection or deepening existing competitive imbalances. Such an imbalance could arise if negotiating power is shifted away from individuals and European small and medium-sized businesses towards global technology companies.
Considering the criticism directed at the Digital Omnibus proposal, the political process required to implement the reforms is likely to be challenging. At Folks, we will continue to monitor the progress of the legislative initiative closely.
Anna Paimela
Partner
+358 40 1648626
To receive our articles directly by email, subscribe to the Folks newsletter here.