1 “Risk” in Arts 24 and 25(1)

As noted by Hustinx and Lynskey, the risk-based approach brings in the notion of risk to trigger a more extensive application of data protection law or to temper its application.Footnote ³⁶ Articles 24 and 25(1) are meta-obligations in the sense that they regulate how controllers should interpret and apply other norms in the GDPR. They require controllers to calibrate the requirements put in place by the legislature. The idea, in the words of Gellert, is “to combine the use of risk management tools with a calibration of the controllers’ obligations according to the level of risk at stake”.Footnote ³⁷ CIPL introduced the verb “to calibrate” in this context.Footnote ³⁸ A relevant definition of “to calibrate” is “to determine the correct range for (an artillery gun, mortar, etc) by observing where the fired projectile hits”.Footnote ³⁹ Controllers are to gauge the risks posed by their processing operation to the rights and freedoms of data subjects, and use this to determine “the correct range” of their legal obligations, so as to ensure that they hit the mark on the ground. In short, under the risk-based approach, “risk” functions as a reference point for the calibration of legal norms by controllers.

2 Risk regulation

The function of “risk” under risk regulation is different, as this notion is then used to determine whether a particular activity should be subject to government regulation, legal or otherwise, to start with. Hood, Rothstein and Baldwin define risk regulation as “governmental interference with market or social processes to control potential adverse consequences”.Footnote ⁴⁰ Governmental interference thus qualifies as “risk regulation” if the aim of the regulatory intervention is to control some kind of risk. Confusion can arise because risk regulation is often accompanied by risk assessment, risk management and risk communication. Existing risk regulation instruments in the EU, for example, often require regulatory intervention to be based on scientific risk assessments as well as on regulatory impact assessments.Footnote ⁴¹ To make matters more confusing, this type of regulation has also been called risk-based regulation.Footnote ⁴²

Data protection law can be characterised as risk regulation, eg as regulation meant to address the risks posed by the introduction of ICTs into society.Footnote ⁴³ The GDPR can be understood as such insofar as it seeks to prevent a range of unwanted events or outcomes: it seeks to protect, at least in part, the rights and freedoms of data subjects in the context of the processing of personal data through rules which apply ex ante. As noted by Grafenstein, this contrasts to a view of data protection as bringing about “a control of that data per se”.Footnote ⁴⁴ Data protection law has long subjected specific types of data processing scenarios to (more stringent) regulation because of their riskiness. For example, the processing of special categories of data is subject to a more stringent regime because of the possibility of discriminatory effects and other undesirable consequences,Footnote ⁴⁵ while the processing of data that is not automated or part of a filing system falls outside the scope of the GDPR, for it is less easily accessible and therefore less susceptible to data breaches or misuse.Footnote ⁴⁶ Irion and Luchetta emphasise this role of “risk” in data protection, noting that data protection law “borrows from” the type of risk regulation described above, targeting legislative interventions where they are most needed.Footnote ⁴⁷ Once the risk-oriented aim of data protection law is placed in the foreground, the notion of risk can be used to fill in all kinds of gaps. In his thesis on purpose limitation, for example, Grafenstein proposes that we rely on changes in the level of risk to determine whether personal data can be repurposed.Footnote ⁴⁸ The risk-based approach discussed in this article also relies on this characterisation of data protection as risk regulation, as the notion of risk guides the way in which controllers should implement data protection law so as to achieve its aim.

3 Risk-based regulation

In another sense of the word, “risk-based regulation” or “a risk-based approach to regulation” concerns the way in which so-called regulatory agencies prioritise action. Under such an approach, the government agencies tasked with oversight and enforcement score the risks posed by organisations so as to target enforcement action on those areas that are most problematic.Footnote ⁴⁹ This helps them to regard the bigger picture, acting on the basis of the risks posed by an organisation rather than on the basis of a momentary compliance assessment.Footnote ⁵⁰ This approach to enforcement allows regulatory resources to be used in an efficient manner.Footnote ⁵¹ The risk-based enforcement style is recommended by the WP29, which asks supervisory authorities to “[target] compliance action and enforcement activity on areas of greatest risk”.Footnote ⁵² Data protection officers are also explicitly instructed to “have due regard to the risk associated with the processing operations” in the performance of their tasks, which enables them, for example, to provide internal training activities where this is most useful.Footnote ⁵³ The difference with the true risk-based approach of the GDPR, is that risk-based regulation typically refers to a strategy employed by the government agencies tasked with supervision and enforcement.Footnote ⁵⁴ There might be confusion about this point because, under a decentred understanding of regulation,Footnote ⁵⁵ it is possible to conflate controllers with governmental risk regulators.Footnote ⁵⁶ This is further discussed in Section III.4.

At first sight, the risk-based approach is nothing but a deregulatory or meta-regulatory take on risk-based regulation by government agencies, embodied by the mandatory data protection impact assessment. I have previously argued that the DPIA and the subsequent prior consultation of Arts 35 and 36 permit supervisory authorities to enforce the law in a risk-based manner, while “outsourcing” the laborious task of risk assessment to the controller.Footnote ⁵⁷ The Data Protection Directive still relied on a system of notification to and prior checking by the supervisory authorities. These “indiscriminate general notification obligations” were removed so as to rely on “procedures and mechanisms which focus instead on those types of processing operations which are likely to result in a high risk to the rights and freedoms of natural persons”.Footnote ⁵⁸ The idea appears to be that, rather than sifting through endless notifications, supervisory authorities can sit back and wait until controllers start a prior consultation – as is mandatory for processing operations which the DPIA reveals to be too risky – of their own accord.Footnote ⁵⁹ The lack of direct oversight is made up for by regulating how controllers assess risks, as they have to follow the procedure of the data protection impact assessment under the watchful eye of the mandatory data protection officer. In this sense, the data protection impact assessment can be characterised as (part of) a meta-regulatory approach.Footnote ⁶⁰ This deregulatory or meta-regulatory take on prior checking goes hand in hand with risk-based enforcement methods, as supervisory authorities can use the prior consultation to focus on enforcing the GDPR in high-risk cases. The data protection impact assessment should, however, be understood in light of the responsibility of controllers for the risks to the rights and freedoms of data subjects articulated in Art 24. To see the risk-based approach only as a “key enforcement method”, as does Gonçalves, does not acknowledge the role of “risk” in articulating compliance 2.0.Footnote ⁶¹

4 Risk management and compliance assessments

The risk-based approach has a complicated relation to risk analysis and risk management on the side of the controller. In “Rights-Based and Risk-Based Approaches to Data Protection”, Gellert sketches what a pure risk management approach would look like. Under this ideal type, the data protection principles are replaced with “risk analysis tools” which enable controllers “to determine what the most appropriate safeguards are for each processing operation” and “to manage the risk, that is, to take a decision whether or not to undertake the processing at stake”.Footnote ⁶² Indeed, if all the GDPR had was Art 35, requiring controllers to conduct a data protection impact assessment, this is what the risk-based approach would be. In fact, however, the GDPR combines risk management with the traditional rules and principles of data protection. A proper description of the risk-based approach under the GDPR has to account for the way in which these two relate to one another.

Gellert appears to imply that data protection law can be collapsed into risk management on the ground, and vice versa. He has argued that the structure of data protection law bears resemblance to risk regulation and risk management frameworks.Footnote ⁶³ He has also emphasised that data protection law and risk management both require the controller to engage in balancing acts.Footnote ⁶⁴ Indeed, like risk regulators, controllers have to set their own norms or standards, gather relevant information, and change their behaviour accordingly. This is part of the numerous balancing acts which data protection law requires controllers to make, and is further discussed in Section IV.1. It could even be said that, by requiring them to engage in risk management, the risk-based approach turns controllers into risk regulators which should adopt the method of risk-based regulation. But this is not the full story. The risk-based approach does not replace the principles and rules of data protection. Instead, it requires controllers to calibrate what it means, according to the law, to protect the rights and freedoms of data subjects. In other words, the risk-based approach, as we know it, does not reduce data protection law to risk analysis. Instead, it uses the notion of risk to regulate how controllers should implement the law in practice.

Risk management does not fully collapse into data protection law, either. In “Understanding the notion of risk in the General Data Protection Regulation”, Gellert approaches the matter from the opposite direction. He argues that risk management under the GDPR is in fact about compliance with data protection law, as the very risks that controllers have to assess pertain to data protection issues. It is only indirectly, through management of the “compliance risks”, that the rights and freedoms of data subjects are protected.Footnote ⁶⁵ The point is not simply that the data protection impact assessment is a “mere” compliance check.Footnote ⁶⁶ It would be fairer to say that, under this account, the data protection impact assessment digs into the reserves of data protection law so as to enhance compliance and protect rights and freedoms.Footnote ⁶⁷ Still, this account fails to acknowledge the way in which data protection law relates to fundamental rights. As a statutory law, the GDPR articulates what it means to protect these rights, but does not exhaust them. It is for this reason that Art 35 requires controllers to assess the impact on the protection of personal data, but also includes a direct assessment of the risks to the rights and freedoms of data subjects and of the proportionality of the processing.Footnote ⁶⁸ Compliance is enhanced by opening the GDPR up to fundamental rights protection. Risks to the rights and freedoms of data subjects are undoubtedly relevant for the rules and principles in the GDPR. It is only for this overlap that the focus on risks to rights and freedoms can contribute to the development of the data protection principles, permitting supervisory authorities and courts to enforce them with reference to the risks that arise in the case at hand (see Sections IV.1 and IV.4). We must acknowledge, however, that the GDPR is enhanced not because of some treasure hidden in its depths, but by virtue of the fundamental rights that it seeks to protect.

5 Harm-based approaches

Finally, we should distinguish the risk-based approach from harm-based approaches, under which it is up to controllers to decide how to prevent harm. While a pure risk management approach would focus only on the procedures taken to assess and mitigate risks, a pure harm-based approach attaches legal consequences only to the outcome that is achieved. Harm-based approaches are about abolishing “design” or “output” obligations in favour of a more ex post, outcome-oriented review.Footnote ⁶⁹ DIGITALEUROPE and the RAND Corporation have both advocated in favour of a harm-based approach. DIGITALEUROPE, a lobby group for the digital industry, has suggested that controllers should be accountable for materialised harm, but that any rules which specify how to prevent harms from arising are disproportionately burdensome. It is in favour of an “outcome-based organisational accountability obligation” which grants controllers full discretion over the means that are chosen to manage risk. This proposal rests on the assumption that industry is best placed, at least epistemically, to determine how to assess and address potential harms.Footnote ⁷⁰ The RAND Corporation proposed a more sophisticated, and less deregulatory, take on the harm-based approach. It envisions the principles of data protection as ways to meet a set of outcomes, namely individual choice, the free use of data, and enforcement. Data protection law, in short, posits the principles as goals in themselves. There should be no generally binding obligations, at the EU level, on how to meet them; data protection practices should be assessed on the basis of their compliance with the principles, rather than on the basis of a “process orientated review”.Footnote ⁷¹ Both proposals seek to get rid of generally applicable, mandatory processes such as the data protection impact assessment.

The risk-based approach is similar to harm-based approaches in that it shifts attention to the possible outcomes of data processing operations. The WP29 has held with respect to accountability that it “puts emphasis on certain outcomes to be achieved in terms of good data protection governance”.Footnote ⁷² The difference is that the risk-based approach, as adopted in the GDPR, sees to the measures that controllers should take. It makes sense to focus also on the how, rather than on the outcome alone: the “harms” we are concerned with are interferences with the rights and freedoms of data subjects, so they are not always easily measured and demonstrated when things go wrong. Under the GDPR, the occurrence of damage only plays a role when it comes to the level of fines that can be imposed, as well as with respect to compensation of the damage suffered by individual data subjects.Footnote ⁷³

In sum, the risk-based approach should be distinguished from a number of other ways in which “risk” or “harm” play a role in data protection law. The main point of confusion regards the connection between the notion of risk and the legal norms in the GDPR. The risk-based approach is not a choice internal to the controller in favour of risk-oriented compliance practices, nor does it require controllers to manage risks instead of “ticking the boxes” of purpose limitation, data minimisation, transparency and consent. It is a legal requirement for controllers to calibrate their legal obligations in light of the risks to the rights and freedoms of data subjects.

1 “Enhancing” data protection law

A number of data protection principles are indeed more or less prohibitive, or more or less permissive, depending on the foreseeable consequences of the processing operation. In these cases, the risk-based approach can most clearly enhance their application, although we cannot deny that their meaning is thereby changed. The principle of fairness is potentially the broadest of these principles, requiring controllers to take the interests and reasonable expectations of data subjects into account.Footnote ⁷⁵ This can require the controller to take measures to address risks to rights and freedoms in the case at hand, as is clarified by recital 71.Footnote ⁷⁶ The principle of purpose limitation is also more or less stringent depending on the impact that may arise if the processing takes place, as the permissibility of processing for a new purpose depends on, inter alia, “the consequences of the intended further processing for data subjects” and “the existence of appropriate safeguards”.Footnote ⁷⁷ More specifically, according to the WP29, “the more negative or uncertain the impact of further processing might be, the more unlikely it is to be considered as compatible use”.Footnote ⁷⁸ Other factors include the context of collection and the nature of the personal data – factors that are also relevant under the risk-based approach.Footnote ⁷⁹

A similar situation arises with respect to the principle of lawfulness. The processing of personal data is only lawful if the controller can rely on one of the grounds of Art 6. Under Art 6(1)(f), the controller is permitted to process personal data on the basis of its legitimate interest, or that of a third party, unless this interest is “overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data”.Footnote ⁸⁰ This test takes into account, according to the WP29, “the various ways in which an individual may be affected – positively or negatively – by the processing of his or her personal data”. It is thereby important “to focus on prevention and ensuring that data processing activities may only be carried out, provided they carry no risk or a very low risk of undue negative impact on the data subjects’ interests or fundamental rights and freedoms”.Footnote ⁸¹ Again, the WP29 looks at the impact of the processing, and in particular whether the consequences are likely and whether they are unduly negative, considering the safeguards taken to address the risks.

While these principles are, in some sense, risk-oriented, the risk-based approach does require controllers to implement them in an altered manner. There are discrepancies between the tests carried out under Arts 5(1)(a), 5(1)(b) and 6(1)(f) and the one carried out under Arts 24 and 25(1). For example, the Court of Justice of the European Union (CJEU) has ruled that the balancing test of Art 6(f) should look specifically to the rights arising from Arts 7 and 8 of the Charter.Footnote ⁸² Under the risk-based approach, on the other hand, potential interferences with other rights should also factor in. Moreover, this approach permits controllers to take fewer measures with respect to processing operations that can reasonably be estimated to be of low-risk, meaning that they do not need to gather as much relevant knowledge of the risks, nor take as much time to assess and evaluate them.

Other rules or principles make no reference to “risks”, but still seek to attain rights-related outcomes. The information requirements of Arts 13 and 14, for example, require controllers to provide a number of categories of information regarding the processing operation to data subjects. These provisions are quite detailed as to the information that must be shared, but controllers may also need to provide other types of information in light of the principle of transparency of Art 5. The risk-based approach forms yet another test on the basis of which the controller should assess what information should be shared. Indeed, on the basis of Arts 24 and 25(1), the information that is provided, and, more generally, the transparency towards data subjects that is brought about, should be such that data subjects can exercise control over their personal data and enjoy a proportionate protection of other rights and freedoms, as well.Footnote ⁸³

The fact that the risk-based approach alters what is required of controllers, is even clearer – and more worrisome – with respect to the provisions of Chapter III, containing the subjective rights of data subjects. This approach is most clearly at odds with data subject rights that impose an obligation de résultat.Footnote ⁸⁴ The right of access, for example, is absolute; the controller must give a data subject access to her data if she puts in a request to this end. This means that, under a rule-based approach, controllers have to take all the measures necessary to be able to respect this right when it is exercised. To be able to give a data subject the required insight into the processing, controllers have to maintain documentation regarding the purposes for which data is processed, the recipients of the data, the logic and the effects of any automated decision-making which is used, as well as all the other information that data subjects have a right to receive. If a less extensive records management and access request system is put in place by controllers of relatively harmless operations, they simply may not be able to provide data subjects with the information to which they are entitled under Art 15.Footnote ⁸⁵ The risk-based approach can legitimise such a situation if the right to exercise control, mentioned in recital 75, can be outweighed by other considerations, such as the fact that a processing operation almost certainly has very little impact on our right to privacy and freedom from discrimination.

Other data subject rights contain exceptions that change their nature to an obligation de moyens. This category includes the duty to provide information to the data subject even though the data has not been obtained from her directly (no disproportionate effort required) and the duty of a controller to inform other controllers when the data subject invokes her right to erasure (only reasonable steps, taking into account the available technology and the cost of implementation).Footnote ⁸⁶ It might be assumed that these exceptions render the provisions compatible with the risk-based approach. They do not, however, make reference to the same factors as Arts 24 and 25(1). Under these provisions, the likelihood and severity of risks are to be assessed in light of the nature, context, purpose and scope of the processing, and to be considered in relation to the cost of the measures and the state of the art. Article 14(5)(b) refers to the disproportionality of providing information to the data subject, but specifies a number of situations in which this exception applies, leaving much less room for a balancing act on the side of the controller. Article 17(2) refers to the cost and the state of the art, but not to the risks posed by the processing, meaning that controllers can avoid taking costly measures even though the risk posed to the data subject is high. The risk-based approach does not do away with these tests, but it does open them up to other considerations.

In sum, the risk-based approach renders the GDPR more prohibitive of risky processing operations and requires more of controllers when this is appropriate in light of the rights, but may also give rise to further limitations of the rights of data subjects than Chapter III provides for. These alterations all serve to enhance compliance. It should be emphasised that the risk-based approach does not do away with the checks and safeguards in data protection law. Data protection law does not collapse into one big balancing act. Nonetheless, by opening the legal norms up to calibration, controllers are able to tone down their obligations in light of the risks and the other factors specified in Art 25(1). They can argue, in other words, that implementation is not technically feasible or is not worth the cost in light of the low level of risk to the rights and freedoms of individuals. It is not clear yet which rights or interests factor in, and what the appropriate weight is of the factors provided in Arts 24 and 25(1).

2 Safeguarding legal requirements

In an attempt to address concerns about the role of controllers under the risk-based approach, the WP29 issued the “Statement on the role of a risk-based approach in data protection legal frameworks”. The main purpose of this statement is to “set the record straight”, as, according to the WP29, “the risk-based approach is increasingly and wrongly presented as an alternative to well-established data protection rights and principles, rather than as a scalable and proportionate approach to compliance”.Footnote ⁸⁷ This ties in to their earlier opinion on the principle of accountability, which portrays accountability not as a replacement of prescriptive rules, but rather as a way to make “the substantive principles of data protection … work better”.Footnote ⁸⁸ CIPL similarly argues that the risk-based approach is only about the implementation of abstract legal principles.Footnote ⁸⁹ It should be clear by now that Arts 24 and 25(1) alter what the controller is required to do so as to respect the rules and principles of data protection. This meta-regulatory layer functions as an extra tier, readjusting the more prescriptive first-tier rules and principles of data protection.Footnote ⁹⁰ There is no real difference between the calibration of implementation measures, and the calibration of the controller’s obligations.Footnote ⁹¹ We cannot regulate the way in which the legal norms of data protection are to be applied, as well as maintain that these norms have an independent meaning which should be complied with regardless of whether the implementation measures were deemed appropriate. It would be incoherent to dismiss the effect of the risk-based approach on what it means to abide by the GDPR.

Nonetheless, there is a real concern that the risk-based approach will eat away at data protection, rather than enhance its application. Gonçalves argues that controllers can only do “more” than might otherwise be required, or at least that controllers cannot escape strict compliance in certain situations.Footnote ⁹² The WP29 is particularly keen to safeguard the Chapter III rights of data subjects, holding that they “should be respected regardless of the level of the risks which the [data subjects] incur through the data processing involved”.Footnote ⁹³ The idea seems to be that risk-based approach should enhance the rules and principles of data protection principles without exposing the rights in Chapter III to “riskification”.

A cap on the “riskification” of data protection law is not necessarily incompatible with the risk-based approach. However, if Art 24 is indeed decisive of the controller’s responsibility, such a cap must be based on risk-based reasoning. An arbitrary limit can turn out to be disproportionate. The measures that even the low-risk controller should take, should, under a risk-based approach, be dependent on whether they make sense to address the risks of the processing operation at hand. The risk-based approach therefore requires us to decide which aspects of data protection are strictly necessary in what kind of situation – and the rights of data subjects of Chapter III are a prime candidate. It is imaginable, however, that some access requests are so pointless when it comes to the rights and freedoms of natural persons (useful though they may be for the data subject who, for example, neglected to file the information for her own purposes),Footnote ⁹⁴ that it would be disproportionate to require the controller to be able to respond to them. In Google Spain, the CJEU created a duty for search engine operators to “adopt the measures necessary to withdraw personal data” whenever a data subject rightly exercises her right to be delisted, but it is only because the search engine’s activities were “liable to significantly affect the fundamental rights to privacy and the protection of personal data” and “in light of the potential seriousness of that interference” that this duty is justified in light of its economic impact.Footnote ⁹⁵ The right to be delisted by search engine operators would not be required if it weren’t for its importance for the protection of Arts 7 and 8 of the Charter. We need to decide whether it makes sense, from a fundamental rights perspective, to require controllers to respect the Chapter III rights of data subjects in any situation.

3 Managing risks for compliance 2.0

If the risk-based approach might permit controllers to get away with less, can we at least require them to do more? The following sections discuss whether the risk-based approach can make controllers legally accountable towards supervisory authorities for implementing the law in such a way that they go beyond “normal” compliance. When it comes to sanctioning, the main question remains whether the GDPR has been violated.Footnote ⁹⁶ This section discusses, therefore, whether the impact assessment requires controllers to manage risks to the rights and freedoms of data subjects when they implement the GDPR. Article 35 has the most potential to actually require compliance 2.0. To avoid confusion, the question is not whether controllers have to manage risks insofar as this is necessary to respect the principles of data protection or the data security obligation of Art 32, but whether they can also be required to go further. In their DPIA guidelines, the WP29 finds that there is “a general obligation to appropriately manage risks”, but appears to focus on risk management as far as is necessary and proportionate to respect the legal obligations in the GDPR.Footnote ⁹⁷

The impact assessment process mandated under Art 35 should, ideally, lead to proper management of the risks to the rights and freedoms of data subjects. Following Art 35(7)(b), the controllers of high-risk processing operations have to assess “the necessity and proportionality of the processing operations in relation to the purposes”. The question here is not only whether the envisaged processing is necessary in relation to the purpose and to the legal ground that is relied upon, but also whether it would be excessive in relation to the impact on the rights and freedoms of data subjects (proportionality stricto sensu).Footnote ⁹⁸ In the words of CIPL, “[o]rganisations will have to make a reasoned and evidenced decision whether to proceed with processing in light of any residual risks, taking into account ‘proportionality’ vis-à-vis purposes, interests and/or benefits”.Footnote ⁹⁹ The DPIA requires controllers to draw a “thin red line” between competing rights and interests.Footnote ¹⁰⁰ This key risk management decision is supported by the case-specific knowledge that is gathered through the other three components of the data protection impact assessment: the description of the processing, the “assessment of the risks to the rights and freedoms of data subjects”, and the safeguards, security measures and other mechanisms that the controller devises to address the risks to the rights and freedoms of data subjects.Footnote ¹⁰¹ The decision must, furthermore, make sense in light of the factors specified in the GDPR. Controllers must assess the high risks subject to a DPIA in light of their likelihood and severity, meaning that they must have regard for the nature, scope, context and purposes of the processing.Footnote ¹⁰² The decision on how to handle these risks must, then, be made on the basis of the origin, nature, particularity and severity of each risk.Footnote ¹⁰³ Guidance on how to apply these factors can be provided in approved codes of conduct, by the data protection officer, in all kinds of guidelines,Footnote ¹⁰⁴ and when the views of data subjects are sought in accordance with Art 35(9).Footnote ¹⁰⁵

What can be done if the controller goes through the motions but does not actually make proper risk management decisions? A first complication is that the duty of the controller to actually take mitigating measures is in need of some further affirmation. Article 35(7)(d) does not contain a verb to indicate what the controller must do with respect to “the measures envisaged to address the risks”.Footnote ¹⁰⁶ The text of the law does not tell us whether it must use them only as needed to fulfil another obligation in the GDPR, or whether it must implement identified measures anyhow. In their opinion on accountability, the WP29 envisaged a system in which the controller uses the accountability mechanisms to make “representations” in “binding internal policies”.Footnote ¹⁰⁷ In this vein, Art 35 contains the duty to review, where necessary, whether the DPIA is complied with.Footnote ¹⁰⁸ Recital 95 even speaks of “obligations deriving from the carrying out of data protection impact assessments”. It is not clear, however, under what circumstances a DPIA leads to binding obligations with respect to the measures that were identified. What if not all the identified measures were recorded, or if they turn out to be infeasible?

Most importantly, even where there is a duty to take the measures identified under Art 35, there is no specification of what it means to take good measures or when the controller should abandon the operation due to its risks. During the prior consultation of Art 36, supervisory authorities can ban or limit processing operations that are deemed to pose high risks to the rights and freedoms of data subjects. But here is the bottleneck: the text of the GDPR is quite ambiguous as to whether this is permitted if there is no clear infringement of the GDPR. The competent supervisory authority can make use of its powers if it “is of the opinion that the intended processing referred to in paragraph 1 would infringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk”.Footnote ¹⁰⁹ The WP29 perpetuates the ambiguity, stating that supervisory authorities should carry out “enforcement procedures in case of non-compliance of controllers, which may imply challenging risk analysis, impact assessments as well as any other measures carried out by data controllers”.Footnote ¹¹⁰ But what if there is “a mismatch between the rules and the risks”?Footnote ¹¹¹ What if the controller has failed to achieve compliance 2.0, but cannot be regarded as non-compliant?

The risk-based approach presents us with the dilemma faced by meta-regulation for corporate social responsibility. By regulating how controllers manage the risks posed by their processing operation, the GDPR also sees to “grey areas”, with respect to which there are no clear democratically formulated rules to determine how to act.Footnote ¹¹² The legal responsibility of controllers extends to these areas, but their legal accountability lags behind. Parker phrases the problem succinctly by asking: “how is it possible for the law to make companies accountable for going beyond the law”?Footnote ¹¹³ She finds that the substantive goals that corporations should achieve, will have to be “adequately specified and enforced external to the company”.Footnote ¹¹⁴ At the moment, EU data protection law suffers from a lack of clarity regarding its overarching policy goals. Kuner et al rightly identify this as a serious omission that should be addressed in a timely fashion, hoping that the risk-based approach can “expand our collective thinking” about the risks that we would like to address “in a world of nearly ubiquitous surveillance, big data, cloud computing, and an onslaught of Internet-connected devices”.Footnote ¹¹⁵ What are these data protection “harms” that we should protect against? How crucial is the monitoring function of data subjects? By appealing to the aim of the GDPR – the protection of rights and freedoms of data subjects in the context of the processing of personal data-, the risk-based approach attempts to supplement and enhance the data protection requirements. Ultimately, however, the relevant risks must be articulated by a legal authority of some sort if we want recalcitrant or sceptical controllers to address them.

4 The potential for a substantive turn in data protection law

The only way to make controllers legally accountable for compliance 2.0 is by updating “normal” compliance. The data protection impact assessment, in particular, can function as an impetus for the development of data protection principles, enabling supervisory authorities and courts to focus more and more on the impact of the processing of personal data on the rights and freedoms of data subjects.

Traditionally, the principles of data protection carry little substance. Data protection law largely regulates through procedural norms, in an “implicit” or indirect manner, rather than formulating “a criterion of social justification”.Footnote ¹¹⁶ This can be illustrated through Burkert’s distinction between the material and the procedural components of data protection law. The material component of the GDPR relates to the quality of “electronic information-handling”. These principles guard against over-collection, the use of inaccurate data, and problems with the integrity of the data, but they are not typically understood as addressing “the material normative issue of what is acceptable to be processed for which purpose”.Footnote ¹¹⁷ Rather than imposing strict substantive limitations, data protection law traditionally relies on procedures to legitimise processing operations, such as the inform-and-consent procedure, the legislative process, and notification and prior checking by supervisory authorities. It is no wonder that data protection compliance checks are seen as “mere “tick box” exercises”.Footnote ¹¹⁸ Nonetheless, these procedures serve a purpose, for they permit the actors involved to decide whether a processing operation is legitimate. In other words, they accord decisional competence with respect to “the normative issue”.Footnote ¹¹⁹

As discussed in Section IV.1, a number of data protection principles could accommodate concerns about potential interferences with the rights and freedoms of data subjects. The risk-based approach and the data protection impact assessment create a context within which this substantive side of data protection law can be formulated more extensively, contributing to a rights-friendly implementation of the GDPR. The DPIA directs attention towards issues relating to surveillance, profiling and discrimination.Footnote ¹²⁰ In the past, the European Court of Human Rights has turned to the proceduralisation of human rights in response to the risk-right encounter.Footnote ¹²¹ However, perhaps counter-intuitively, the risk-based approach and the DPIA may well carry a substantive turn in data protection law.

To elucidate how the data protection principles and the focus on risks to the rights and freedoms relate to each other, it is helpful to consider a controversial example: that of the personalisation of news feeds. News personalisation can impact the privacy of the individual, as well as his or her right to receive information.Footnote ¹²² Spina mentions the adverse effects of filter bubbles as one of the risks presented by new digital services fuelled by personal data.Footnote ¹²³ At the moment, however, it is safe to say that news personalisation is quite readily permitted under the GDPR, particularly if explicit consent has been obtained.Footnote ¹²⁴ If it is the case that the GDPR should bring about protection against filter bubbles and the like, it could be argued that the principle of fairness of Art 5(1)(a) requires controllers to keep the impact of their processing operations on the rights and freedoms of data subjects to an acceptable level, also in the case of news personalisation. Nonetheless, as with any norm that is formulated in broad, general terms (also known as a “principle” or “principles-based regulation”), the problem from the perspective of effectiveness is that controllers can easily misunderstand or contest the meaning that is ascribed to them. As put succinctly by Black, “debates can always be had about their interpretation”.Footnote ¹²⁵ If a supervisory authority suddenly decided to tackle rights issues surrounding news personalisation through the principle of fairness, this is likely to come as a shock to controllers. Needless to say, they will not have been able to establish “compliance”. Legal uncertainty also renders enforcement action against big data companies less effective, as they are likely to start costly and lengthy court proceedings before changing their conduct.Footnote ¹²⁶ Indeed, Baldwin, Cave and Lodge find that, under a pessimistic view, the use of principles-based regulation allows controllers “to do what they want without fear of breaching strict rules”.Footnote ¹²⁷

How does principles-based regulation handle the indeterminacy of the legal norms? One way to clarify the meaning of principles is for supervisory authorities to, in the words of Black and Braithwaite, engage in “regulatory conversations” so as to foster “shared sensibilities”.Footnote ¹²⁸ The term “conversation” is a bit of a misnomer because it also includes one-sided or unilateral statements, such as guidance documents. Supervisory authorities can, for example, issue guidelines on the legal norms in the GDPR and (refuse to) approve codes of conduct.Footnote ¹²⁹ They can specify what the principle of fairness entails, explaining whether or in what way it affects the permissibility of news personalisation. The data protection impact assessment and the prior consultation foster another track of conversation, not about the principle of fairness, but about the risks that controllers are responsible for. As argued by Binns, DPIA’s “can add an additional layer that brings responsibility for considering and deliberating on risky and complex data protection issues”.Footnote ¹³⁰ This separate track attempts to avoid legal battles about the meaning of the data protection principles. It does so by steering controllers to adopt proper risk management practices in a meta-regulatory manner, ie by regulating how they comply with the GDPR.

This meta-regulatory layer also has consequences for the range of acceptable interpretations of data protection law. The focus on risks to the rights and freedoms of data subjects makes it less acceptable for controllers to hide behind the indeterminacy of the data protection principles to justify box-ticking exercises or “creative compliance”, ie compliance that is technically sufficient, but fails to achieve the objective of the legal norm in a meaningful way.Footnote ¹³¹ This is particularly the case if relevant regulatory conversations have taken place. One might say that the risk-based approach makes it more difficult for controllers to implement the GDPR “against the spirit of the regulation”.Footnote ¹³² This is because the risk-based approach and the data protection impact assessment render it more acceptable when the data protection principles are stretched a little so as to protect against new risks to the rights and freedoms of data subjects. They render a substantive interpretation of the data protection principles more predictable, as a concern for risks to the rights and freedoms of data subjects slowly becomes part of data protection policy and practice. The focus on risk can help to absorb the shock of a substantive turn of the GDPR, should it indeed take place.

5 The risk of the risk-based approach

Articles 24 and 25(1) require controllers to act in light of a number of difficult decisions. Which rights should be taken into consideration, and what do they require in the case at hand? How to factor in the cost of implementation? Is the control of data subjects always of overriding importance? Does this processing operation pose disproportionate residual risks, or can I move forward? The DPIA may help “decision-making concerning the processing”, as noted by the WP29,Footnote ¹³³ but it hardly specifies any right answers. In this regard, the verb “to calibrate” discussed in Section III.1 is not wholly suitable, as the reference point of risks to rights and freedoms requires significant specification on the side of the controller. The responsibility of controllers is no longer to simply interpret and apply data protection law; they also have to make decisions about how to assess and evaluate the risks to the rights and freedoms of data subjects posed by the processing operation, and take compliance measures in light of these decisions. Here, the risk is that controllers have too much regard for their own interests, rather than interpreting what it means to protect the fundamental rights and freedoms of data subjects in line with the common good.Footnote ¹³⁴ The d.pia.lab warns that impact assessments are liable to be used as “lip service”, legitimising intrusive processing operations without actually offering the substantive protection that we would like to see.Footnote ¹³⁵ The question is whether controllers can be held to account for such bad decisions, or whether the risk-based approach means that controllers have “a decisive power over compliance with personal data protection principles and rights”, as deplored by Gonçalves.Footnote ¹³⁶

Since the notification and prior checking mechanism of the Data Protection Directive has been replaced with the DPIA and the prior consultation, the role of supervisory authorities is subsidiary.Footnote ¹³⁷ Rather than deciding whether the processing is ultimately too risky to be acceptable, the authorities are to assess whether the controller could reasonably have come to its own risk management decision. As discussed above, supervisory authorities can cap the risk-based approach or engage in regulatory conversations regarding risk management under the GDPR. They can clarify, for example, that the Chapter III rights of data subjects should always be respected, or that the risks posed by news personalisation should actually be addressed – but this takes time. Even under a meta-regulatory approach, it takes time for principles-based legislation to concretise into standards that can be enforced in a deterrent manner so as to counter “creative compliance”. Moreover, the key risk management decision will ultimately have to be made by controllers themselves. It is often impossible to specify an acceptable level of residual risk upfront. We cannot say, for example, that the highest permissible impact on privacy is 2.5 “mg” per data subject per year. Supervisory authorities cannot readily rule against reasonable assessments and decisions of controllers, especially if there was little to guide them. It would be contrary to the rule of law to sanction controllers for their risk management practices in an unforeseeable manner, when the law is not at all clear yet. In the meantime, it is for controllers to decide what it means to enhance data protection law in light of the risks that it has identified. When it comes to compliance 2.0, the ball is in their court.Footnote ¹³⁸ This means that controllers enjoy “a large margin of judgment and autonomous decision-making”.Footnote ¹³⁹ They cannot blatantly ignore data protection requirements, but the risk-based approach does accord them the competence to decide, within reason, what it means to do data protection law properly in the case at hand.

The risk-based approach stands in stark contrast to the rule based approach, under which only the law can formulate what it means to protect fundamental rights and freedoms in a proportionate manner.Footnote ¹⁴⁰ The discretion of controllers raises questions regarding the way in which the rights and freedoms can be articulated. Article 52(1) of the Charter requires limitations on the exercise of its rights and freedoms to be provided by law. Article 23 of the GDPR provides a more specific formulation of this requirement, requiring limitations on the data protection principles and the data subject rights to be prescribed by law in quite a precise manner. By shifting to a more decentred, accountability-oriented approach, the safeguards offered by legality are partially sacrificed. Supporters of precaution be warned: it remains to be seen whether the potential for substantive rights protection will outweigh the risk.