What could possibly go wrong? - Dariusz Kloza; Thibaut D'hulst; Malik Aouadi (Technology and Regulation)
The risk-based approach is a pillar of EU data protection law, mandating data controllers to adapt their obligations to the risks to the rights and freedoms of natural persons. Despite aiming to strengthen data protection and provide flexibility, it presents conceptual and practical challenges, such as comprehending and assessing risk. This paper seeks to elucidate these issues to enhance legal compliance and safeguard fundamental rights. Section 2 scrutinizes the nature of risk and its assessment, examines related concepts like damage, and explores inherent problems. Section 3, after illustrating such risks, expands their understanding by introducing ‘negative consequences’ and proposing their typology. Section 4 presents a method for efficiently identifying these consequences, i.e., an inventory with a complimentary classification criteria.