Jusletter IT

The topic of the risk-based approach to data protection has stirred quite some controversy, with the main criticism arguing that it goes directly counter the fundamental right nature of the right to personal data protection. Given the latter, and following the opinion of the Article 29 Working Party, the General Data Protection Regulation (GDPR) has adopted a risk-based approach that is limited to matters of compliance. This presentation explores what is exactly meant by such compliance oriented risk-based approach, and more in particular how it can nonetheless take into account the whole spectrum of the data subjects’ fundamental rights and freedoms affected by data processing operations.