I. Introduction

“Vien poi l’occasione/che vuolmi il padrone/don, don; in tre salti/lo vado a servir”Footnote ¹ sings the innocent Figaro in the first act of Mozart’s Mariage de Figaro. He is talking to his betrothed, Susanna, with naïve happiness about the future advantages of sleeping in a bedroom close to that of his master, the Count Almaviva. The Count is in love and insidiously pursues Figaro’s bride-to-be; the conventional plot of a love triangle. The concepts of risk regulation, data protection, and data ethics seem to be entangled in a similar complicated relationship, with persuasive affinities and ambiguous misunderstandings. This dangerous liaison stems from the fact that the digital economy is fuelled by personal data, quite literally. Its main, and quintessentially defining, commercial applications – such as the Google search engine or a Facebook newsfeed – rely on the collection, use, analysis, and transfer of information concerning individual users. Search engines, apps and digital platforms offer services to users almost at no cost, the commercial transaction being enabled by the exchange of data. Collection and use of the data are agreed upon by consumers by accepting voluntarily “terms of use”. We know that the tripartite methodology of risk regulation, i.e. risk assessment, risk management and risk communication, is technology-neutral, and yet its emergence and prominence has come about in the second half of last century. This is why risk regulation has been traditionally associated with the uncertain negative outcomes connected with the products of industrialized manufacturing, such as food, pharmaceuticals, chemicals, or with sources of energy, safety of transport, or general environmental issues. It is now becoming obvious, with the skyrocketing amount of digital data being created and used, that there is a relationship between risks and data. One could, therefore, legitimately wonder what is the role for risk regulation in the emerging economic and social landscape of digital platforms, algorithms and artificial intelligence (AI)? Can risk regulation contribute to the governance of the data-driven digital economy? And if so, what is the role that data ethics will play in the relationship between risk regulation and data protection?

This brief contribution does not provide a definitive answer to these questions. It rather attempts to lay down some of the theoretical and practical conditions that make not only possible but desirable the development of research to explore the relationships between risk regulation and data governance. The first condition, in our view, is the centre of interest that the new EU data protection legislation, Regulation (EU) No 679/2016 (also known by the acronym, GDPR) assigns to risks. Compared to the current EU legislation on data protection, the GDPR strengthens the rights of individuals vis-à-vis public and private entities (“data controllers”). But one of the most important transformations brought about by the GDPR is the different regulatory model envisaged to ensure that data controllers comply with data protection law, through the principle of accountability. In this new regulatory framework, data controllers are requested to control, in a formal and structured way, the risks to the rights and freedoms of data subjects arising from data processing operations. We are therefore witnessing a progressive “riskification” of EU data protection law, which will likely move out from the limited boundaries of formal legality of processing of data and enforcement of individual rights against companies. The shift towards a model of “enforced self-regulation” for managing technological innovation in uncertain scenarios seems to be at play.

Secondly, in a mutually reinforcing relationship, it seems that both the industrial products – the risks of which have been controlled by traditional regulatory frameworks – and the urban settings where risky activities take place, are becoming “smart”. Sensors, data-generating micro-devices, connected wearables and more generally the Internet of Things transform our experience of the world and present another layer of risks to consumers that need to be factored in. Driverless cars, for example, create not only risks to the safety of passengers and third parties, but also to their privacy, as these connected cars can function only through the collection, analysis, and integration of large quantity of data.

The final consideration moves the debate about the social and economic disruption of digital innovation back to the core of the structural definition of the risk regulation regime. In fact, the idea of regulation stems originally from the cybernetic perspective of organizing control systems. These systems operate through the function of standard-setting. But this function is paired with intrinsically interconnected functions of information-gathering and behaviour-modification.Footnote ² The complexity of risks created by digital innovation seems to necessitate the creation of a regulatory control system which is focused not only on the formal compliance with formal rules and standards, but also on the technical aspects of the information-gathering and on the ethical aspects of the real impact of those rules (behaviour-modification). Risk regulation, in this sense, should be able to integrate in its tripartite model of risk assessment, risk management and risk communication the profound ethical issues that materialize. The new digital service and products, in fact, present risks that cannot be easily measured or quantified in accordance with a mere technocratic paradigm; they do not only affect the individuals that use them, but transform the collective fabric of our society; they concern the cognitive rather than the physical integrity of human beings. One could think, for example, of the concerns raised about the echo chambers or filter bubbles created by social media, or the extent of the inadvertent digital manipulation of our behaviour and the invisible and therefore uncontrollable forms of algorithmic discrimination.

Hoping that the new livery of this journal will trigger the interest of risk regulation scholars in exploring new connections between digital data and risks, we will now examine the three conditions presented above and discuss their links.

II. The concept of risk embedded in the GDPR

As we have already seen, the collection and use of personal data will be regulated in the EU by the GDPR, that will apply as of May 2018. In this new legal framework, the concrete operative functioning of which is still not fully developed yet,Footnote ³ the concept of risk will play a crucial role. This is not just because the word “risk” is widely used in the text of the GDPR, or at least it is certainly more frequently used than in the previous legislative instrument that will be replaced, i.e. Directive 95/46/EC. In the latter, the concept of risk occurs in relation to data security and for the justification of a separate category of sensitive data. Health information, political opinions or religious beliefs fall into that category on account of being likely, by virtue of their nature, scope or their purposes, to pose specific risks to the rights and freedoms of individuals.Footnote ⁴ It is perhaps important to make a clarification about the role of risk or, better, risk-based model, in data protection law, which still generates some confusion and misunderstanding between experts. In the gestation of the new data protection law, the risk-based model emerged in public debates as a synonym with a more flexible approach to ensure compliance with data protection law. It was opposed by those who wanted rules on data protection to be serious and effective.Footnote ⁵ In reality, the “riskification” of data protection legislation in the GDPR has a much more profound underpinning, which goes well beyond considering “risk-based” as a model for enforcement. First, the idea of the control of risks marks the essence of the new regulatory tool that data controllers should use to measure the impact of new technologies, the “Data Protection Impact Assessment” or DPIA – Article 35 of Regulation (EU) 679/2016. Second, whilst Directive 95/46/EC mentioned, but did not describe, what the risks to the rights and freedoms of individuals are, the GDPR presents a detailed overview of the criteria for the definition of the risks. Recital 75 informs us that risks to the rights and freedoms:

This is, then, followed by a reference to the objective assessment needed to evaluate these risks depending on the likelihood and severity and by a reference to the code of conducts and guidelines that could provide best practices “to mitigate the risk”. There is a need for more in-depth analysis of the severity of these risks and for a refinement of the language used to describe negative events resulting from unlawful processing of personal data. The severity of risks depends, in the final analysis, on the evaluation of the harmful consequence by size or nature of the unwanted event occurring. It remains to be seen whether the highly individualized set of attitudes to avoid privacy risks could result in a more homogenous baseline of events that could be assessed in an objective manner, depending on the likelihood and severity of risks. Although the GDPR makes reference to risks in other instances,Footnote ⁶ the introduction of the principle of accountability grounds the idea of risk control at the very heart of the new enforced self-regulation model adopted to guarantee compliance with the provisions of the legislation. A set of governance measures to control risks will be available to data controllers, including the performance of DPIAs but also the appointment of data protection officers (DPOs), and the adoption of regulatory strategies to embed data protection principles “by design” and “by default” in new data processing systems.

III. Combination of products, combination of risks

Besides the regulatory approach moulded on the control of risks, which forms the basis of the new EU data protection legislation, risk regulation theory remains relevant in the field of digital technological development essentially because the products that were traditionally in the scope of risk regulation are being transformed and digitally enhanced. This entails the use of connected data-processing sensors and devices that are either integrated with the product or exert an ancillary function. In this way, users’ behaviour is monitored, influenced or even enabled by digital technologies. The mass of data created by the products would pose a new risk to be assessed and managed, together with the usual risks to the safety of the users or to the environment. This becomes particularly challenging when the additional smart feature modifies the risk profile of the use of the product, bringing a trade-off between risks of a different nature or, better, between risks to privacy and alleged benefits to individuals. Take, for example, the case of digital pills: the sensor implanted in the pill is meant to guarantee the transmission of data for monitoring the intake of medicines by patients and therefore decrease the risk of non-adherence to the recommended treatment.Footnote ⁷ Or consider the use of “smart” metering in the distribution of energy and the relative problems of balancing the legitimate interest to make efficient decisions on energy distribution, which could result in benefits to consumers, and the risk posed by the mass collection of personal data from the use of electrical appliances and the personal insight into private life of individual households that analysis of consumption patterns could provide.Footnote ⁸ When the new smart version of the product becomes commercially dominant, users will not effectively opt-out from the processing of the data connected to the use of the product that could gradually become the standard commercial practice.Footnote ⁹ The tension between risks of a different nature and between risks and benefits will be an important aspect of development and discussion in risk regulation studies.

IV. Risk regulation and data protection meet the ethical aspects of technology development

In the relationship between risk regulation and data protection, a special place is occupied by the emergent field of data ethics.Footnote ¹⁰ The ethical considerations which are relevant to the consequences of the emerging digital technologies are connected with the new form of unprecedented informational power. It would probably be over-reductive to refer to this change only as a consequence of extended computational capabilities. “Big Data” is not only a technological artefact, but a much more complex phenomenon of epistemic change that affects the availability of knowledge and the governance of the public and private space.Footnote ¹¹ To oversimplify, Big Data is a new form of power and the benefits and risks stemming from the use of this new analytical power are substantial, complex and yet unclear in their scope and nature. We are just starting to realize the full extent of the consequences of the fact that the design of social media generates “echo chambers” and “filter bubbles”,Footnote ¹² problematic social developments undermining profoundly the public space and the common sense of belonging to a social community. Another important development is the erosion of our capacity to choose freely, due to digital manipulation of the information sources framing our decision-making,Footnote ¹³ and, finally, the thorny issues of algorithmic discrimination,Footnote ¹⁴ whereby mathematical models, which embed the logic of their creators, could determine and shape our life. It is therefore evident that some of the risks posed by Big Data exceed the limited scope of data protection law and present more general ethical challenges.Footnote ¹⁵ In this context, the rigorous methodology of risk regulation could be essential. First, through an analytical approach, risk regulation can unbundle the set of multiple and heterogeneous risks posed by “Big Data”. Second, the tripartite composition of the institutional framework could certainly help to ensure that the review process of these risks is conducted in an objective, transparent, independent, and accountable manner. The risk regulation model has been often associated with a technocratic form of governance, but this is not necessarily true. In fact, there is nothing preventing ethical concerns from being integrated in the decision-making process of risk management, of the decisions that collectively are deemed fair and just. This model would be essential in order to counterbalance new forms of technological power, which aim at programming our cognitive understanding of the world and advancing an idea of human behaviour as “programmed behaviour systems” with a renewed sense of collective responsibility. It is, perhaps, timely to recall the lecture of the German philosopher Hans Jonas, who speaking of the technological modalities of behaviour control and social functionalism, wrote in a rather prophetic way: “Somewhere along the line of increasing social manageability at the price of individual autonomy, the question of the worthwhileness of the whole human enterprise must pose itself. Answering it involves the image of man we entertain. We must think it anew in light of the things we can do with it or to it now and could never do before”.Footnote ¹⁶

V. Conclusion

In the final scenes of Mozart’s Mariage de Figaro, the vicissitudes of troubled lovers and couples, after a series of encounters and unexpected revelations, come to a happy end and every character finds again its place in the order of things. The category of risk and the methodology of risk regulation offer powerful theoretical instruments and practical solutions to avoid unnecessary, preventable harm and enable the societal benefit accrued by technological innovation. This has resulted in perfectible, yet functioning, models for the control of risks previously considered unimaginable, such as those of nuclear energy and nanotechnology. Likewise, risk regulation will be an essential governance instrument for the control of the risks of the digital “infosphere” we inhabit. It is a complex relationship that pulls, as in a complicated ménage, concepts and models in many different directions. It is fertile territory for the inquisitive mind.