Article 29 Working Party Publishes Statement on the Risk-Based Approach to Data Protection

On May 30, 2014, the European Union’s Article 29 Data Protection Working Party adopted “Statement on the role of a risk-based approach in data protection legal frameworks” (WP281).  The Working Party, made up of EU member state national data protection authorities, confirmed its support for a risk-based approach in the EU data protection legal framework, particularly in relation to the proposed reform of the current data protection legislation.  However, with a view to “set the record straight,” the Working Party also addresses its concerns as to the interpretation of such an approach and sets out its “key messages” on the issue.

Approaching Risk

In support of the risk-based approach, which broadly calls for increased obligations proportionate to the risks involved in data processing, the Working Party sets out examples of its application in the current Data Protection Directive (95/46/EC) and the proposed General Data Protection Regulation.  The Working Party confirms that the risk-based approach must result in the same level of protection for data subjects, no matter the size of the particular organisation or the amount of data processed.  However, the Working Party clarifies that the risk-based approach should not be interpreted as an alternative to established data protection rights, but instead a “scalable and proportionate approach to compliance.”  Consequently, the Working Party accepts that low-risk data processing may involve less stringent obligations on data controllers than comparatively high-risk data processing.

Key Messages

To conclude its views on the risk-based approach, the Working Party establishes 13 key messages – in summary:

1. Protection of personal data is a fundamental right and any processing should respect that right;
2. Whatever the level of risk involved, data subjects’ legal rights should be respected;
3. While the levels of accountability obligations can vary according to the risk of the processing, data controllers should always be able to demonstrate compliance with their data protections obligations;
4. While fundamental data protection principles relating to data controllers should remain the same whatever the risks posed to data subjects, such principles are still inherently scalable;
5. Accountability obligations should be varied according to the type and risk of processing involved;
6. All data controllers should document their processing, although the form of documentation can vary according to the level of risk posed by the processing;
7. Objective criteria should be used when determining risks which could potentially negatively impact a data subject’s rights, freedoms and interests;
8. A data subject’s rights and freedoms primarily concerns the right to privacy, but also encompasses other fundamental rights, such as freedom of speech, thought and movement, prohibition on discrimination, and the right to liberty, conscience and religion;
9. Where specific risks are identified, additional measures should be taken – data protection authorities should be consulted regarding highly risky processing;
10. WHile pseudonymising techniques are important safeguards that can be taken into account when assessing compliance, such techniques alone do not justify a reduced regime on accountability obligations;
11. The risk-based approach should be assessed on a very wide scale and take into account every potential/actual adverse effect;
12. The legitimate interest pursued by data controllers or third parties is not relevant when assessing the risks for data subjects; and
13. Under the proposed General Data Protection Regulation, data protection authorities will have an active role in respect of the risk-based approach, including inter alia developing guidelines on impact assessments and targeting enforcement activity on areas of greater risk.