1 Risk regulation in the EU

Risk regulation has been particularly visible across the policies of the EU, albeit not equally, such as in the environmental, agro/food and financial sectors. An increasing number of regulatory activities have been framed in terms of risk, with risk providing justification for regulation. Regulation of human health and safety in the EU, for example, is clearly defined in terms of risk. One of the policy aims in the EU food safety area is to prevent, eliminate or reduce to an acceptable level risks to humans and animals.Footnote ³³ Thus, as noted by Alemanno, risks to human health and safety not only constitute an object for regulation, but also “one of the rationales for the EU regulatory action”.Footnote ³⁴ Indeed, it is claimed that we could see an emerging European risk regulation model, even if in its embryonic stage, which not only uses the classical risk analysis framework (risk assessment, management, communication), but also has its own particular features, such as regulatory impact assessments, reliance on precautionary and proportionality principles, consideration of legitimate (non-scientific) factors in the risk management stage, and a general tension between the rational, evidence-based and flexible, precautionary decision-making.Footnote ³⁵ Although there is no uniform analytical approach to risk and scientific risk assessments in the EU are conducted by various EU bodies following different, often diverging, methodologies, a number of EU laws include risk assessment procedures. For example, Regulation 178/2002 protecting human health and consumers’ interest in relation to food, establishes the principle that food law is based on risk analysis, comprising three interconnected processes: risk assessment; risk management; and risk communication.Footnote ³⁶ In the same vein, risk assessment plays an important role in the area of chemicals and products. The Regulation on chemicals,Footnote ³⁷ the Plant Protection RegulationFootnote ³⁸ and the Cosmetics RegulationFootnote ³⁹ require the assessment of the risks of chemicals and products based on their specific hazardous properties and exposure to them in two steps: first, hazard identification and characterisation (the potential to cause harm) and then risk assessment (the likelihood of harm). The extent to which in practice regulatory decisions rely on both steps (classification of hazards and assessment of risks), however, seems to be questionable.Footnote ⁴⁰ The Medical Product DirectiveFootnote ⁴¹ makes medical product authorisation subject to a favorable risk-benefit balance and requires the setting up of a risk management system, ie a set of activities designed to identify, characterise, prevent or minimise risks relating to a medicinal product.

2 Risk-based approach to regulation

The essence of risk-based regulation is providing a model to achieve a proportionate and adaptive strategy for regulatory enforcement.Footnote ⁴² It allows the regulatory bodies to set priorities and explicitly explain their selective decisions based on the assessment of the risk that the regulated actors (companies or individuals) present.Footnote ⁴³ Although risk-based regulatory models can vary depending on the policy domain, the particular country and in their complexity, they all start from the basic premise that it is impossible and costly to entirely eliminate all hazards and risks.Footnote ⁴⁴ Therefore, the focus is on identifying the risks that the regulators want to manage instead of enforcing all existing rules on all regulated entities.Footnote ⁴⁵ Black and Baldwin distinguish five main features shared by the majority of risk-based frameworks that can be summarised as follows.Footnote ⁴⁶ First, the regulators that use these frameworks define their own objectives and the risks to their achievement. Second, regulators determine the acceptance threshold for specific risks and their level (risk appetite). Third, they assess the risks that the regulated actors present in terms of negative impact and probability or likelihood. The terminology (in human safety the focus is on hazards and exposure, while in the financial sector it is on impact and probability) and methodology (qualitative or quantitative) differ depending on the policy area. Fourth, regulators use the assigned numerical scores or categories in order to rank and prioritise the actors, their activities or policy issues. Finally, they allocate resources for supervisions, inspection and enforcement based on the rankings mentioned above.

As the regulators following a risk-based approach focus their regulatory activities and resources on the most risky and harmful policy outcomes, this allows them to solve their wider legitimacy and accountability problems. It is claimed that reliance on risk and emphasis on rational decisions can help bureaucracies to justify their decisions in terms of technocratic legitimacy regardless of the real methodological value of such decisions.Footnote ⁴⁷ Thus, risk-based frameworks may also be seen as techniques used by regulators “to shift or dissipate blame”Footnote ⁴⁸ or even to set forth when blame should fall on them in the first place.Footnote ⁴⁹ Risks that are defined as tolerable by regulators are thus considered to be politically acceptable, and should not be expected to result in blame once they occur.Footnote ⁵⁰ In a rapidly changing and technologically complex environment, such a defensive stance based on risk is ever more important for regulators of new technologies, as they are inevitably lagging behind in terms of intervention.

In practice, in the UK, an EU Member State that paved the way for European developments in risk-based approach to regulation, since 2005 risk has been shaping policies far beyond human health and safety or environmental protection, ie the areas that are traditionally associated with risk. Risk has also been defining a wide range of policy processes, like information gathering, policy making, service delivery, implementation and enforcement. UK public administration has endorsed the risk-based approach and has been trying to achieve effective inspection and enforcement using risk assessments to determine enforcement actions.Footnote ⁵¹ Public institutions are required to base their regulatory activities on risk when determining priorities in their area of competence and the allocating scarce resources. They are also expected to take into account risk at every stage of their decision-making processes, such as in selecting the most appropriate type of intervention, performing checks on compliance, and the taking of enforcement actions.Footnote ⁵²

The risk-based approach to regulation has had much more limited application in other Member States, where risk was incorporated into regulation principally because of international and EU constraints.Footnote ⁵³ In France and Germany, for example, risk is still mainly used in policy domains traditionally concerned with risk, such as nuclear or food safety, the environment, or financial services. Risk in these Member States has also a more restricted role in framing regulatory processes, mainly only so far as such processes relate to obligatory risk assessments.Footnote ⁵⁴

3 Aligning risk-based regulation literature with data protection

The risk-based regulation literature discussed above deals with risk-based regulation as a regulatory strategy used by the governments and regulatory agencies to deal with societal and institutional risks in a risk-based manner. However, the GDPR in comparison, mainly relies on private entities, the data controllers, and to a large extent entrusts them with a detailed definition, assessment and management of societal risks related to their data processing activities. Nonetheless, the two at first sight diverging theoretical and practical perspectives on risk-based regulation can be aligned. On the one hand, as stated by Quelle, “under a decentred understanding of regulation, it is possible to see controllers themselves as regulators engaged in risk-based regulation as well as risk regulation”.Footnote ⁵⁵ On the other hand, a regulator in the GDPR has arguably already prioritised some risks by establishing general criteria of high risk data processing operations and subjecting risky or highly risky processing operations to specific requirements, such as a representative in the EU, notification of supervisory authorities and data subjects about a data breach, maintenance of records, data protection impact assessments and the prior consultation. Regulatory agencies, the national data protection authorities, can provide guidelines on impact assessments and further select and define risks to be prioritised and assessed by deciding on the detailed list of the processing that presents high risks. A part of the risk regulatory process, the actual risk assessment, a task which costs considerable time and effort, is “outsourced” to data controllers.Footnote ⁵⁶ In practice, however, this outsourcing raises serious fears: data protection authorities become secondary and weaker players while the scope and the necessity of the private impact assessments is uncertain.Footnote ⁵⁷ In addition, if the impact assessment reveals that data processing can result in high risk that the taken measures cannot mitigate, data controllers need to turn to data protection authorities for a prior consultation. This GDPR requirement follows a reversed logic from the general notification obligation present in its predecessor, as “the idea appears to be that, rather than sifting through endless notifications, supervisory authorities can sit back and wait until controllers start a prior consultation (…) on their own accord”.Footnote ⁵⁸ As a consequence, the GDPR risk-based provisions, even if imposed directly on the data controllers, as an end result allows the supervisory authorities to enforce the GDPR compliance in a risk-based manner, save resources and prioritise their enforcement activities.

1 The emergence of the idea

The idea to protect individuals based on potential risk and negative impact instead of considering all personal data inherently worthy of protection had emerged in the EU prior to the launch of data protection reform. It can be traced back to the RAND Europe Review of the Data Protection Directive, a key report in the data protection reform process, commissioned by the UK Information Commissioner’s Office (ICO) in 2009.Footnote ⁵⁹ The report underlined a missing clear link between the concept of personal data and real privacy risks, showing that not all data processing acts covered by Directive 95/46/EC have a noticeable privacy impact on individuals.Footnote ⁶⁰ To create more effective protection in the future that focuses on the exchange and use of large amounts of personal data globally, the report suggested to look into the impact on privacy as a relevant criterion to determine the applicability of the data protection rules. In this sense, the RAND proposal is closer to a harm-based rather than a risk-based approach, which concentrates on the regulatory outcome (damage prevention) and does not extend to the potential and actual adverse impacts.Footnote ⁶¹ Procedurally, the limited regulatory outcome of damage prevention is to be achieved largely by the data controllers themselves rather than through the ex ante process and obligations established by the regulatory framework. The GDPR did not take the harm-based approach, but if it had, risk analysis and management carried out by data controllers at their own discretion would dominate in the legal framework.Footnote ⁶²

Unsurprisingly, the idea of risk-based data protection has increasingly found support among different stakeholders. First, reliance on risk envisioned more effective and contextualised data protection instead of merely a compliance-based prescriptive framework. In other words, risk would enable to shift data protection from a box-ticking exercise to protection on the ground by nuancing obligations for data controllers according to the risk involved. Kuner denotes the new obligation to evaluate risks using Data Protection Impact Assessments as part of a shift from “paper-based bureaucratic requirements” towards “compliance in practice”.Footnote ⁶³ Second, the risk-based approach can be expected to enhance accountability, transparency and foster the data protection culture among data controllers. The European Commission perceives the evaluation of risks through Data Protection Impact Assessments as a way to force the data controllers to assume more responsibility vis-à-vis data subjects.Footnote ⁶⁴ The approach could even steer the data controllers “towards the least risky processing possible if this is rewarded by fewer and more appropriate obligations (scaled and proportionate to the risk involved)”.Footnote ⁶⁵ One more benefit of this approach is flexibility as regards the future technological advancements. The risk-based approach may provide a solution to the current data protection practices such as big data analytics or Internet of Things where the traditional compliance based approach does not work.Footnote ⁶⁶ Application of the core principles, such as purpose limitation (purpose specification and compatible data use) and data minimisation, or reliance on the data subject’s consent, has become increasingly difficult when dealing with big data.Footnote ⁶⁷ Finally, the turn to a more flexible risk-based legislation has been driven by economic argumentation – the internal market can be enhanced through reduction of administrative and compliance costs for companies. The discontent of the industry representatives with high financial and administrative burdens that data protection compliance causes and little actual protection for individuals brought by such formal compliance featured in responses to the European Commission’s public consultations.Footnote ⁶⁸

The rhetoric of “regulatory burdens”, in particular for micro, small and medium-sized enterprises (SMEs) is not something completely new in the European regulatory arena. It has shaped a number of other legislative acts across various EU policy areas. Several different tactics have been used to shield SMEs from regulatory burdens, such as exemptions from legal obligations, reduced record keeping duties, simplified inspection procedures, and obligations proportionate to risk.Footnote ⁶⁹ For example, SMEs with fewer than 250 employees are not obliged to follow the neutral selection requirements in relation to women on company boardsFootnote ⁷⁰ and micro non-toxic pesticide distributors by national derogations can be exempted from the provisions of Directive 2009/128/EC.Footnote ⁷¹ An example of the implemented risk-based approach are Regulations 852/2004 and 853/2004, which require food producers to implement hygiene procedures based on risk, and take measures in relation to identifiable hazards. As a result, the main underlying idea, at least of the Commission, has been to foresee lighter touch regulation to small-scale, low-risk data processing operations and, where possible, to lower the administrative and compliance burden for companies processing ‘ordinary’ personal data in today’s information society. Similar examples of this so-called ‘risk-burden balance model’ can be found in several countries outside the EU, such as Japan and Australia, which exempt entities that are considered as presenting no danger for individuals (eg small entities, holders of limited amounts of personal data for short time periods) from data protection regulation activities.Footnote ⁷²

Being new and still emerging in its meaning, the risk-based approach has been advocated by various stakeholders in distinct interpretations. The narrowest interpretation, the most closely reflected in the adopted GDPR text, views risk as a yardstick to tailor data controllers’ obligations.Footnote ⁷³ In this sense, the risk-based approach means ‘a scalable and proportionate approach to compliance’.Footnote ⁷⁴ A broader version of the risk-based approach promulgated risk as an organising concept not only for compliance but also for data protection enforcement. In this respect policing and enforcement carried out by data protection authorities should target risky rather than all data processing activities.Footnote ⁷⁵ Those following the broadest interpretation have viewed the risk-based approach as eliminating core data protection principles or even data subjects’ rights.Footnote ⁷⁶ For example, industry representatives DigitalEurope proposed to keep data controllers responsible only for materialised privacy harms caused by the data processing and fully allow them to choose means to assess and mitigate the risks. As the regulatory outcome dominates over the process, according to the proposal, regulation and detailed rules on procedures and obligations for privacy harm prevention are burdensome and unnecessary.Footnote ⁷⁷ The DigitalEurope proposal in essence aligns with the APEC Privacy Framework and its controversial primary principle to prevent harm to individuals,Footnote ⁷⁸ which considerably lowers the European data protection standards.

2 Risk and risk-based approach in Directive 95/46/EC and the GDPR

Although the risk-based approach has been the subject of intense interest in recent years, in essence, reliance on risk as a concept cannot be considered a novelty in the area of personal data protection.Footnote ⁷⁹ Indeed, the Data Protection Directive of 1995 referred to risk in five articles long before the term “risk-based approach” entered the parlance of EU policy makers during the discussions at the European Parliament and at the Council on the proposed General Data Protection Regulation.Footnote ⁸⁰ Also, many national data protection laws already foresaw risk management as an explicit requirement.Footnote ⁸¹ Although the concept of risk does not entail radical changes, the functional role assigned to risk in the GDPR is novel compared to its predecessor. Starting with an overview of the roots of risk in the Directive 95/46/EC, the new functions of the risk concept in the GDPR are discussed below.

3 General Data Protection Regulation (2016/679)

In the General Data Protection Regulation, an increased number of data protection provisions have been built around the concept of risk. This risk-based turn, to a large extent, can be explained not only by the aim of compliance cost reduction and efficiency, but also by the need to ensure greater harmonisation and greater consistency of data protection across the EU. The Regulation as a directly applicable legal instrument can no longer declare that risk should be used as a yardstick to adjust data controllers’ obligation by Member States, as did the Directive, but actually has to specify the calibrated obligations in its text itself.Footnote ¹¹⁹

1 System for assessing and scoring risks

In the risk regulatory frameworks regulators develop a system that allows them to measure and score identified risks.Footnote ¹²⁶ In such risk-scoring systems, risk typically is viewed as “the product of the gravity of a potential harm or impact and the probability of its occurrence”.Footnote ¹²⁷ There may be various ways of measurement, in some countries predominantly qualitative or quantitative, but in essence the measurements will be based on the elements of quantum and probability.Footnote ¹²⁸ Most often numerical scores would be assigned and categorisation such as “high”, “medium”, “low” risks would be used.

If we look to data protection law, except for the national guidelines adopted by the UK, French and Spanish data protection authorities,Footnote ¹²⁹ there are no uniform risk measurement and scoring systems.

The situation has changed somewhat with the General Data Protection Regulation. Severity and probability as important risk measurement elements receive more intentional focus in the Regulation. Recital 76 states that the likelihood and severity of a risk “should be determined by reference to the nature, scope, context and purposes of the processing” on the basis of an objective assessment. The assessment should establish whether a risk or a high risk exists to the rights and freedoms of natural persons. The Article 29 Working Party has also recently recognised that the severity of risk and the likelihood of negative impact should be taken into account while evaluating the risks for individuals’ privacy.Footnote ¹³⁰ Although there is not yet a uniform system for assessing and scoring risks to the rights and freedoms of data subjects, there is a clear tendency to subject risk in the area of data protection law to quantification and measurement. The Article 29 Working Party in its recent guidelines has recognised that various methodologies can be used by data controllers to assess risks as long as they meet the standards of the GDPR, ie provide a description of the processing operations and their purposes, assess the necessity, proportionality, and the risks to the rights and freedoms of data subjects, foresee the measures to address the risks.Footnote ¹³¹

One further step which is often made by regulators in relation to the seriousness assigned to risks, is the prioritisation of the higher risk producers for attention and intervention.Footnote ¹³² This is not yet reflected in the legal data protection framework, or at least officially the enforcement of data protection law is not related to risk in the General Data Protection Regulation. In practice, though, on a national data protection authority (DPA) level, risk has already been shaping the way in which public supervisory functions are performed. The risk-based approach in some Member States is seen as providing a more effective and efficient way to handle data subjects’ complaints, check compliance with data protection law and, as a result, to better use the limited resources assigned to the DPAs. Risk as a driving factor to prioritise and select complaints to be handled is already present in the working practice of several DPAs to a certain extent. For example, the Dutch DPA selects complaints to be handled on the basis of five criteria: (1) serious violations; (2) structural violations; (3) violations that concern many people; (4) violations where the Dutch DPA can effectively intervene with its enforcement instruments; (5) violations that occur within the (annual) focus.Footnote ¹³³ Similarly, the ICO in the UK has recently taken a new approach and started focusing on systematic issues and patterns of poor behaviour of organisations rather than on each and every individual case.Footnote ¹³⁴

Although the current European data protection system does not have a uniform framework to measure and score identified privacy risks, some changes in this respect are happening. Severity and probability are inserted into the General Data Protection Regulation as important risk measurement elements. There is an EU-level agreement between the DPAs that different types of risk assessment frameworks can be used by data controllers, given that they satisfy the main GDPR standards. Yet, as is discussed below, some of the risk assessment frameworks can arguably be better equipped to assess risks than others.

2 Institutional arrangements

In traditional risk regulation domains, a well-established division between risk assessment, a scientific process, and risk management, a purely political process, exists.Footnote ¹³⁵ Since the 1990s, the EU also has tried to separate the scientific risk assessment and the political process of risk management in regulation of risks to human health, safety and the environment. This effort has led to a process of institutionalising risk assessment tasks and the so called ‘mushrooming’ of specialised European agencies.Footnote ¹³⁶ Risk assessment in relation to the environment, chemicals, pharmaceuticals and food is formally dedicated to the respective regulatory agencies, namely the European Environment Agency, the European Chemicals Agency, the European Medicines Agency, and the European Food Safety Agency.

Decisions about risk management remain within the discretion of the European Commission and other EU institutions. This is a way to “disentangle scientific risks assessment from political risk management”Footnote ¹³⁷ and to grant more legitimacy to the EU policy-making, even if in the daily practice the separation the two aspects is not so clear cut.Footnote ¹³⁸ Normally, a regulatory agency is defined as an independent “administrative organization with a distinct, formal identity, an internal hierarchy, functional capacities, and, most important, at least one principal”.Footnote ¹³⁹ Attributed with special, less political, but more technical and scientific tasks, such specialised agencies differ from the EU institutions.

A similar tendency to “depoliticise” risk assessment processes assigning this role to an independent and technical body can be noticed in the GDPR. The main expert body under the Data Protection Directive is a Working Party on the Protection of Individuals with regard to the Processing of Personal Data (hereinafter – the Article 29 Working Party). It acts independently based on its own rules of procedure and has an advisory status. It is a formal network composed of established independent national data protection authorities, the European Data Protection Supervisor and the European Commission. The Article 29 Working Party elects its temporal Chair and two Vice-Chairs by means of a secret ballot for a term of two years.Footnote ¹⁴⁰ The main functions of the Working Party are: to examine any question related to the uniform application and amendments of the Data Protection Directive, to advise the European Commission on the level of data protection in the EU and in third countries, and to issue opinions on European codes of conduct.Footnote ¹⁴¹ The Article 29 Working Party has already started providing guidelines on high-risk data processing operations, ie defining and partially assessing risks to the data subjects stemming from data processing operations.Footnote ¹⁴²

The General Data Protection Regulation transformed the Article 29 Working Party into an independent European Data Protection Board. There are at least three new aspects in relation to its formation, structure, and tasks that are worth noting. First, the composition of the group changes slightly but significantly. The European Data Protection Board formally consists of a head of a supervisory authority of each Member State and of the European Data Protection Supervisor. Differently from the Article 29 Working Party, the Commission can only participate in the Data Protection Board’s activities without a voting right (Article 68.5). This participatory right totally disappeared in the amendments of the European Parliament, but has been restored in the final text of the Regulation. This shows a clear will of the Parliament members to eliminate any political “flavour” and to create a specialised, independent, knowledge-based entity.

Second, the secretariat previously provided by the European Commission has now been placed within the European Data Protection Supervisor (EDPS) (Article 75). The Commission justified this change with the aim “to provide a strong basis for cooperation among data protection authorities, including the European Data Protection Supervisor” and “to enhance synergies and effectiveness”.Footnote ¹⁴³ In order to fully understand the implications of this change, the status and role of the EDPS should be first clarified. The EDPS, unlike the European Commission, is a specialised and politically independent EU office, with its main objective being to ensure that EU institutions and bodies respect the right to privacy while processing personal data and developing new policy instruments, rules laid down in Regulation (EC) No 45/2001.Footnote ¹⁴⁴ Among other functions, the EDPS monitors the processing of personal data in the EU administration and ensures compliance with the data protection rules, advises the EU institutions on new legislative proposals, and cooperates with other data protection authorities through the Article 29 Working Party. As a result, this change means that the Article 29 Working Party from being politically imbedded, even if composed of independent national data protection authorities, becomes increasingly institutionalised and formalised, with its own distinct legal personality. The European Commission loses the right to formally be a member of this new structure and have any influence through hosting its activities.

Third, with the GDPR the decision-making power of the European Data Protection Board increases and becomes binding. Like its predecessor, the Board maintains the consultative role. From advising the Commission to adopting guidelines for the purpose of specifying a high number of articles in the Regulation or encouraging consistent application of any other relevant GDPR provision on its own initiative. These wide powers are the result of the Parliament’s decision to diminish the discretion that the European Commission granted to itself in 26 instances to supplement the GDPR by delegating acts and represent the shift of power away from the Commission to a politically independent body.

Even more importantly, the role of the Board is made central and decisions binding in the consistency mechanism. Before a DPA adopts an important decision, it must first obtain an opinion of the Board (Article 64). One of these decisions is the list of the processing operations subject to the requirement for a data protection impact assessment, ie definition of the high-risk data processing operations.Footnote ¹⁴⁵ The DPA should “take utmost account of the opinion of the Board” and inform how it is reflected in the draft decision (Article 64.7). When the DPA does not follow the opinion of the Board, in order to ensure the correct and consistent application of the GDPR, the Board adopts a binding decision (Article 65). In the same vein, the Board acquires binding decision-making power in case of disagreement between the DPAs, as opposed to the non-binding merely authoritative nature of the Article 29 Working Party opinions. In applying the consistency mechanism, the European Data Protection Board is empowered to issue an opinion or to adopt legally-binding decisions in clearly specified cases where there are conflicting views or disputes among supervisory authorities by a two-thirds majority of its members, in particular deciding whether there is an infringement of the GDPR. The Board thus becomes “the highest executive data protection monitoring party in the EU”, that is “capable of deciding on itself and enforcing its opinions”.Footnote ¹⁴⁶

In sum, the General Data Protection Regulation introduces major changes in relation to the formation, tasks and structure of the main European data protection expert body – the Article 29 Working Party. The European Data Protection Board, compared to its predecessor, is completely “depoliticised”, institutionalised and its functions are extended to include binding decision making. Creation of this specialised, independent, knowledge-based entity partially denotes a shift toward independent, scientific risk assessment in data protection.

3 Public engagement in risk regulation

Engaging stakeholders and the general public in the risk management process is a well acknowledged necessity in risk regulation. The mere fact that the aim of the risk-based regulation is to manage contestable risks, opens the door for society to participate in the understanding and formulation of risks.Footnote ¹⁴⁷ This is not the case in relation to the regulation defined in terms of the market or human rights.

There is a wide acknowledgment of the benefits that public participation can have to risk identification and management. These include the help of the stakeholders to discover risks that otherwise may “fly under the radar” of the assessor, provide input on the perceptions of the severity of risks and on possible ways to mitigate them.Footnote ¹⁴⁸ If the data protection impact assessment (DPIA) is meant to be more than a mere compliance check with the data protection rules, it should engage stakeholders in identifying and assessing risks and impacts.Footnote ¹⁴⁹ The ICO PIA Handbook recommends stakeholder engagement and consultation.Footnote ¹⁵⁰ It also states that wider consultation of affected individuals is important not only because “it enables an organisation to understand the concerns of those individuals” but also it “improve(s) transparency by making people aware of how information about them is being used.”Footnote ¹⁵¹ As Roger Clarke noted, wider consultation of affected individuals is important not only because “it enables an organisation to understand the concerns of those individuals” but also it “improve(s) transparency by making people aware of how information about them is being used.”Footnote ¹⁵² In the same vein, Wright and Mordini claim that given the right to good administration enshrined in Article 41 of the Charter of Fundamental Rights of the European Union, consultation with stakeholders in the process of the DPIA “is not only desirable but necessary”.Footnote ¹⁵³

For the first time the Regulation makes an effort to involve the stakeholders and the public at large in the actual process of risk evaluation. Article 35.9 of the General Data Protection Regulation requires data controllers, where appropriate, to “seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations”. One would, indeed, expect those who are to be affected, ie the end users, to be in the best position to articulate their fears and negative possible effects of the particular technologies or systems. In practice, however, this requirements is a soft obligation. As public engagement might be related to individualised risks assessment and high costs for companies, it is not surprising that the obligation to take individual views into account is seen as hardly achievable in all the cases and thus applicable only “where appropriate”. The “appropriateness” standard is not defined in the Regulation and thus is left to the discretion of the data controllers. Moreover, data controllers are exempted from the obligation to consult with data subjects when there is a need to protect their commercial interests. This need might be less pressing and obvious for the projects and systems in the public sector, but private companies might try to retain business secrets from the beginning of the development of their new products and services in order to gain competitive advantage.Footnote ¹⁵⁴ Therefore, it is questionable to what extent they will be willing to disclose detailed information about data collection practices and projects and involve a wide range of relevant stakeholders. In addition, the Regulation requires the views of the data subjects to be heard but does not oblige controllers to take these views into account or to implement changes following data subjects’ suggestions. Thus, ultimately stakeholder consultation is purely of an informational nature and neither provides assurances of comprehensive risk identification nor guarantees a full-pledged protection from risks.

Besides the DPIA, there is also an additional tendency in the Regulation to engage with the public concerning risks. Education, training and communication is seen as a core aspect of the regulatory function. Risks are to be made intelligible to non-specialists as, according to the General Data Protection Regulation, each supervisory authority shall “promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing” (Article 57.1.b).

In sum, the effort to include data subjects and their representatives in the risk management process proposing a separate article on this in the General Data Protection Regulation would provide a possibility for external stakeholders and the public to participate in defining risks and deciding on their impact in data protection law. On a practical level, however, there are debates on how data subjects and other stakeholders could have a say in the related data protection risk assessments. First emerging considerations demonstrate not only the early stage of reflections on the public involvement in the privacy impact assessments, but also possible difficulties in achieving such involvement in practice. For example, as queried by the Centre for Information Policy Leadership: (1) should data subjects be allowed to participate directly in the risk assessment or just get access to its findings?; (2) should (and if so how should) companies can take into account individuals’ perception of risk and harm in practice, eg through monitoring their opinions via social media?Footnote ¹⁵⁵ It has been suggested that risk assessment should be based on objective characteristics of harm and examine “harm imposed on the reasonable man or woman” in a particular context: “in the same way as tort law ignores the ‘egg shell skull’, the test is not and cannot be, concerned with the impact on each particular individual, let alone an individual with particular sensibilities.”Footnote ¹⁵⁶ Similar positions appear to be delineated in the Regulation (Recital 76), which requires data controllers to carry out an “objective” risk assessment.

1 Data protection law and its foundations

Historically, risk regulation is known as regulation that tackles the risks related to human safety, health and the environment. Several main elements of risk regulation have been distilled in the regulatory literature. First, the ultimate aim of risk regulation is “to control relevant risks, not to secure compliance with sets of rules”.Footnote ¹⁵⁷ Thus, regulators should establish clear objectives and the risks that those regulated pose for the achievement of these objectives.Footnote ¹⁵⁸ In the mid-1990s, European data protection legislation emerged as a regulatory effort aiming to protect individuals with regard to the processing of personal data while at the same time allowing free data flows. In essence, the regulatory goal was to protect individuals against the misuse of their personal data, and thus against violations of their privacy and other rights, which initially revolved mainly around data security-related concerns.Footnote ¹⁵⁹ Such protection of human rights was envisioned through securing compliance with specific data protection principles and provisions rather than through the control of data processing-related risks. Directive 95/46/EC does not even refer to concrete risks to privacy and personal data protection and avoids explicit references to three classical steps of the risk analysis framework (risk assessment, management and communication). The General Data Protection Regulation comes closer to the classical risk regulation concept, as it names a number of specific risky data processing activities (Article 35(3)) and possible damages to individuals (Recital 85). The latter include physical, material or non-material damage, such as loss of control over one’s personal data or limitation of one’s rights, discrimination, identity theft or fraud, financial loss, damage to reputation. Yet, the risks remain defined in a flexible and abstract way and need to be specified and assessed by data controllers depending on the particularities and specificities of each data processing case.

Second, and even more importantly, risk regulation is focused on (potential) “harm” and “negative consequences” to individuals or to the environment. For example, the stated aim of much modern environmental law is “to prevent harm to the environment before it occurs, with an implementation structure that includes prior approvals, permits that embody standards to be met, and the monitoring of compliance, all with that goal in mind.”Footnote ¹⁶⁰ Data protection law has a broader aim than just protecting an individual from harm through risk control and mitigation. The right to data protection is safeguarded regardless of harms or possible adverse effects on individuals.Footnote ¹⁶¹ Lynskey claims that “there is a general interest in conferring control over personal data to individuals even in the absence of tangible or intangible harm” and it can be comparable to the protection of other general interests, such as the protection of liberty.Footnote ¹⁶²

Also, several normative values underlie the fundamental right to data protection: autonomy, informational self-determination, balance of powers, integrity and dignity.Footnote ¹⁶³ The majority of data protection laws identify privacy as the main justification for their adoption.Footnote ¹⁶⁴ Privacy plays an instrumental role in protecting individual’s interests, such as autonomy, welfare, equality, justice, dignity, status, tranquillity, Footnote ¹⁶⁵ and freedoms, such as freedom of expression, and violations of privacy can harm their enjoyment.Footnote ¹⁶⁶

European data protection law, therefore, being a fundamental rights (sui generis) regulation, is built on different foundations than risk regulation. The possibility to reconcile or align the risk with rights regulation is contested and presents complex questions, which fall outside the scope of this article. A pure risk regulation and risk-based approach would not sufficiently protect the right to data protection because “it would presuppose the legality of data processing activities regardless of individuals” fundamental rights’.Footnote ¹⁶⁷

2 Shifts towards risk as a response to a regulatory crisis

Reliance of risk in regulation can be seen as a way to bridge the gap between law and technological developments. Data protection law is known for the disconnect between law in the books and law in action.Footnote ¹⁶⁸ It is not able to catch up with the rapidly-evolving technologies and ubiquitous data collection. It can no longer give control over their personal data to individuals in the era of profiling, and Big Data, and address all the negative impacts stemming from the collection and use of data on data subjects.Footnote ¹⁶⁹ Any regulatory response to the new socio-technological challenges has its clear limits. On the one hand, the reliance on high-level principles renders it difficult to address and solve the actual problems, ie to focus on the objectives of data protection.Footnote ¹⁷⁰ On the other hand, including more and more concrete types of data processing into data protection law leads to artificial expansion of its scope and to the “framing [of] Internet-related problems as data protection problems”.Footnote ¹⁷¹

The use of risk and reliance on risk assessments as a regulatory tool demonstrates the “ongoing crisis of policy-making”. Footnote ¹⁷² Potential risks and their impact are too complex to be caught by “comprehensive regulatory instruments such as the law or political decision-making processes”.Footnote ¹⁷³ Therefore, ex ante focus on enforced self-regulation, and in particular a new obligation on data controllers to conduct Data Protection Impact Assessments (DPIAs), allows for a shift in the responsibility and blame from policy makers to data controllers.

Yet, it is questionable whether the GDPR has “too much faith in controller actions” and their capacity and position to assess risks and prevent unnecessary data processing.Footnote ¹⁷⁴ Data “controllers do not intend to restrict data processing to the bare minimum” and can easily accommodate their practices into what is “necessary” for the purposes they define themselves until, in rare situations, they are checked by the data protection authorities.Footnote ¹⁷⁵ Also, due to the absence of legislative rules and responsibility on their behalf, data controllers are likely to use “upstream adjudication”: anticipate court opinion on a specific risky processing and interferences with the rights and freedoms of data subjects and obligations to use certain procedures, such as stakeholder consultations.Footnote ¹⁷⁶ The risk-based approach as “the key enforcement method (…) leaving data protection issues mainly to data controllers to decide” is certainly debatable as regards its effectiveness.Footnote ¹⁷⁷

3 Undefinable and unmeasurable risk as a core element of the shifts

Risk regulation and the risk-based approach first and foremost requires a clear understanding and definition of risk. However, both in theory and in practice privacy risks do not yield an easy definition. Theoretically, risk as a concept can be studied from various disciplines, ranging from philosophy, to natural sciences and economics, and across those different fields acquire diverse connotations.Footnote ¹⁷⁸ In fact, in the risk literature, the concept of risk can refer to an expected value, a probability or a cause of an unwanted event, which may or may not occur, as much as to the unwanted event or uncertainty as such.Footnote ¹⁷⁹ Without aiming to provide an exhaustive summary of these definitions, a brief look at the main risk features in several selected fields is provided below.

Natural scientists, in disciplines such as engineering, toxicology, epidemiology, adopt a rationalist approach to risk and generally treat risk as an objective, measurable phenomenon. They focus on the identification of risks, their causes, predictive models of risks and individual responses to risks, or proposals on how to limit the effects of risks. Expert knowledge and scientific calculations dominate in this, so called technico-scientific, approach to risk.Footnote ¹⁸⁰ The natural science perspective is useful to “anticipate potential physical harm to human being or ecosystems, average these events over time and space, and use relative frequencies (observed or modeled) as a means to specify probabilities”.Footnote ¹⁸¹

In contrast to technico-scientific approach, sociologists refer to risk as a socio-cultural phenomenon.Footnote ¹⁸² Risk is seen as a cultural and social construction undertaken by humans rather as a taken-for-granted objective, material condition, which can be quantified and measured.Footnote ¹⁸³ Despite their nuanced theoretical assumptions of social and cultural theories, and competing positions on risk ranging from a weak social constructionist to relativist, social scientists generally tend to emphasise the broader social, cultural and political context from which risk gains its meaning.Footnote ¹⁸⁴ The understanding of risk is created through social interpretation and is always linked to group values and interests.Footnote ¹⁸⁵ Sociologists are therefore less interested in the nature of risk itself, but rather “the forms of knowledge, the dominant discourses and expert techniques and institutions that serve to render risk calculable and knowable, bringing it into being”.Footnote ¹⁸⁶

Data protection law does not seem to systematically follow one of the above-mentioned understandings of risk. From the inception of the Data Protection Directive the understanding of the concept of risk seems to fit at least in two perspectives: technico-scientific and sociological. Risk first entered the data protection domain as an objective, measurable phenomenon.The travaux préparatoires of the Data Protection Directive demonstrate that risk as a term initially was used only in a purely technical, data security-related context. Risk referred to the security measures that were needed in the assessment of the potential security risks.Footnote ¹⁸⁷ This technical reference to risk is not surprising, considering the fact that the Proposal for the Directive was submitted together with two other highly technical legislative acts: a Directive related to the protection of personal data and privacy in the context of public digital telecommunications network and a Decision concerning the field of information security.Footnote ¹⁸⁸ Later, more subjective, individual-centered references to risk, ie risk as negative impact on a data subject’s rights and freedoms, were added after the amendments to the Data Protection Directive proposed by the Parliament. However, in this sense risk as a term was used erratically and equated to danger and threat.Footnote ¹⁸⁹ The latter terms are used interchangeably with risk in the Commentary attached to the Amended Proposal for a Directive.Footnote ¹⁹⁰ Yet, risk is conceptually different and should not be conflated with danger.Footnote ¹⁹¹

The debate around the General Data Protection Regulation in the Council once again revealed diverging perception and understanding of risk in the area of personal data protection. It demonstrated a high level of uncertainty among the Member States as to how risk as a term should be understood and categorised. It has been claimed that the definition of risk is problematic or non-achievable as: (1) the level of risk is highly context-dependent; (2) it is difficult to arrive at a risk definition that would stand the test of time; (3) law cannot take into account all current risks, but even less regulate future risks, famously called “unknown unknowns” (“things we don’t know that we don’t know”).Footnote ¹⁹²

Although risk assessment and measurement were not of a paramount importance before, with the General Data Protection Regulation, which relies on risk in the context of obligations for data controllers, data protection authorities and data controllers will be asked to assess and measure the risks to individuals. The value of risk in quantitative or qualitative terms in the information security area can be objectively defined and established through the undesirable events and threats that make such events possible. Numerous methodologies in this field can help to identify, measure (establish probability and severity), score and mitigate security risks.Footnote ¹⁹³

Risk evaluation seems to be much more problematic as far as the negative impact on a data subject’s rights and freedoms (sociological perspective) is concerned. Some academics have tried to articulate the harms of privacy violations,Footnote ¹⁹⁴ but there is still no consensus around what constitutes such harms and it is hardly possible to develop an exhaustive list of harms resulting from data processing. Regulators and companies have equally failed to identify a comprehensive list of privacy harms and negative impacts on data subjects.Footnote ¹⁹⁵ It should be mentioned, however, that the Council in the General Data Protection Regulation tried to articulate an indicative list of harms in the context of the DPIA referring to “discrimination, identity theft or fraud, financial loss, damage to the reputation, unauthorised reversal of pseudonymisation, loss of confidentiality of data protected by professional secrecy or any other significant economic or social disadvantage” (Article 33.2a). Nonetheless, the list is more illustrative than comprehensive and cannot be easily transferred into operational risk management methodologies. The full understanding of the harms and potential as well as actual negative impacts on individuals is a starting point for the discussion on risk assessment in data protection.

Not less importantly, data driven-technologies and applications can have a negative impact not only to the rights of individuals but also to their groups and society at large. The GDPR acknowledges the group and societal dimension of privacy risks, but remains unclear about their assessment and measurement in practice. As noted by Spina, “(t)he new digital service and products, in fact, present risks that cannot be easily measured or quantified in accordance with a mere technocratic paradigm; they do not only affect the individuals that use them, but transform the collective fabric of our society; they concern the cognitive rather than the physical integrity of human beings.”Footnote ¹⁹⁶

However even if better conceptualised, negative impact on individuals (damage) will often be non-physical and intangible, such as discrimination, reputational and moral damage or any other social disadvantage. Therefore, in practice it will not easily yield to quantification and measurement. Negative impact can also be very subjective, vary from one individual to another or from group to group and cannot be easily known by the data controller. On an individual level, the perception of something as being risky is often based on one’s own previous experience, age and understanding. Also, many collective factors, such as education system, cultural values or regulatory framework, may determine that something is being seen as a risk by particular people or nations. For example, as regards children’s activities online, their perception of privacy risks, among many other factors, could be shaped by the mediating practices of parents and teachers, influence of school and peers, and individual usage of the Internet.Footnote ¹⁹⁷ As a result, individuals exposed to the same risks will not experience the same harm. Some will be able to cope with risks while others not. Are the general DPIA frameworks then adequate to fully address the risks to vulnerable data subjects, such as children, or should they be tailored to specific data subjects’ needs and vulnerabilities? As the harm is non-physical, and thus hardly measurable, and is subjective (best known to the individuals themselves), it is questionable if the burden for evaluating risks and preventing harm is rightly placed on the data controllers. Can they be expected to foresee and adequately assess all potential negative impacts (harm) on individuals of their proposed data uses and device appropriate protection measures? How to guarantee that their assessments ensure an even level of protection across the EU when there are different risk assessment methodologies used?Footnote ¹⁹⁸ How can data controllers be liable for the methodological choices and subjective risk perceptions?Footnote ¹⁹⁹ These questions underline the challenges that the reliance on risks and risk management in data protection has brought, that require further guidance and clarification from the EDPB and the courts. In the meantime, if risk to individuals cannot be adequately defined and evaluated, the shift towards risk regulation can lead to lowering the data protection level from the perspective of the data subjects. As noted by Lynskey, a concern exists that “data controllers, processors, and DPAs will underestimate the risks entailed by certain personal data processing, leading to an under-enforcement of rules”.Footnote ²⁰⁰

The General Data Protection Regulation heavily relies on risk management through Data Protection Impact Assessments. In order to manage privacy risks, they have to be simplified, operationalised and measured according to a chosen methodology. Given the ambiguous nature of risk as a concept, uncertainty and limited knowledge of risks, risk assessment techniques have been criticised due to the lack of objectivity, the unclear methodological assumptions and choices and the limits of scientific knowledge.Footnote ²⁰¹ As Power notes, too much manageability of risks according to “well tried, incrementally adjusted, linear frameworks of understanding” can lead to a pretence of control and rather than effective mechanisms.Footnote ²⁰² Thus, when risks are integrated into formalised risk management frameworks, they may lose substance and meaning.Footnote ²⁰³

Existing privacy risk management methodologies and guidelines try to express data protection concepts and principles in risk management terminology, but face epistemic challenges.Footnote ²⁰⁴ For example, in the CNIL’s methodology, risk means a “scenario describing a feared event and all threats that make it possible”.Footnote ²⁰⁵ Thus, risk is expressed through two measurable components: undesirable events (what do we fear?) and threats (how can this occur?), both evaluated in terms of probability and severity according to the scale of “negligible, limited, significant or maximum” risks.Footnote ²⁰⁶ Feared events (eg unavailability of legal processes, excessive or unfair data collection, illegitimate access to personal data) are essentially violations of the data protection principles. The majority of threats through which risks may happen are framed in data security terms. They involve function creep, espionage, exceeded limits of operation or damage of supporting assets, property losses. Although this methodology is highly operational and provides a formalised risk management tool, its validity and effectiveness are limited. It fails not only to take into account all the possible threats, but also more generally does not provide much insight regarding the level of data protection within an organisationFootnote ²⁰⁷ or indeed adequately consider the actual impact on individuals.

The epistemic problem outlined above is expected to be applicable to other privacy risk management tools and methodologies. While managing privacy risks, they can easily be reduced to void and meaningless statistical expressions of probabilities, focusing on process rather than on content.