By distinguishing between three perspectives of risk-based regulation—namely, of the regulated entity, the regulated activity, and of the regulator itself ( Black, 2010b )—this article aims to propose a meta-regulatory framework to investigate the regulation of risk in the field of personal data protection. Using insights from the institutional development of Brazilian data protection law and comparing it with the GDPR, this study clarifies how each jurisdiction operationalizes risk and provides examples to illustrate how each of the three standpoints may interact with other perspectives. The article supports meta-regulatory debates and research on personal data regulation by providing examples and connecting these categories to the key features of a “riskified” ( Spina, 2017 ; Macenaite, 2017 ) data protection law.
KeywordsRisk-Based RegulationPersonal Data ProtectionGDPRLGPDComparative Law
Alemanno, A. (2016). Risk and Regulation. In A. Burgess, A. Alemanno, & J. O. Zinn (Eds.), Routledge Handbook of Risk Studies (pp. 191-203). Routledge.
Alves, F. N. R., & Peci, A. (2011). Análise de Impacto Regulatório: Uma nova ferramenta para a melhoria da regulação na Anvisa. Revista de Saúde Pública, 45, 802-805. https://doi.org/10.1590/s0034-89102011000400023
Bennett, C. (1997). Convergence Revisited: Toward a Global Policy for the Protection of Personal Data? In P. E. Agre, & M. Rotenberg (Eds.), Technology and Privacy: The New Landscape (pp. 99-123). MIT Press.
Bianquini, H. (2024). Personal Data Protection and Risk-Based Regulation: Institutional Development of Regulatory Frameworks by the Brazilian Data Protection Authority . Ph.D. Thesis, University of São Paulo.
Black, J. (2010a). The Role of Risk in Regulatory Processes. In R. Baldwin, M. Cave, & M. Lodge (Eds.), The Oxford Handbook of Regulation (pp. 302-348). Oxford University Press. ttps://doi.org/10.1093/oxfordhb/9780199560219.003.0014
Black, J. (2010b). Risk-Based Regulation: Choices, Practices and Lessons Being Learnt. In OECD (Eds.), Risk and Regulation: OECD Reviews of Regulatory Reform (pp. 185-236). OECD Publishing.
Bradford, A. (2012). The Brussels Effect. Northwestern University Law Review, 107, 1-67.
Carrillo, A. J., & Jackson, M. (2022). Follow the Leader? A Comparative Law Study of the Eu’s General Data Protection Regulation’s Impact in Latin America. ICL Journal, 16, 177-262. https://doi.org/10.1515/icl-2021-0037
CIPL (Centre for Information Policy Leadership) (2014). A Risk-Based Approach to Privacy: Improving Effectiveness in Practice. https://www.informationpolicycentre.com/uploads/5/7/1/0/57104281/white_paper_1-a_risk_based_approach_to_privacy_improving_effectiveness_in_practice.pdf
Council of Europe (1981). Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data. Council of Europe. https://rm.coe.int/1680078b37
Dalle Rocha, L., Sousa Silva, G. R., & Canedo, E. D. (2023). Privacy Compliance in Software Development: A Guide to Implementing the LGPD Principles. In Proceedings of the 38th ACM/SIGAPP Symposium on Applied Computing (pp. 1352-1361). ACM. https://doi.org/10.1145/3555776.3577615
Doneda, D. (2019). Da privacidade à proteção de dados pessoais (2nd ed.). Revista dos Tribunais.
Ewald, F. (1991). Insurance and Risk. In G. Burchill, C. Gordon, & P. Miller (Eds.), The Foucault Effect: Studies in Governmentality (pp. 197-210). University of Chicago Press.
Gellert, R. (2015). Understanding the Notion of Risk in the General Data Protection Regulation. Computer Law & Security Review, 31, 497-508.
Gomes, M. C. O. (2020). Entre o método e a complexidade: Compreendendo a noção de risco na LGPD. In F. Palhares (Coord.), Temas atuais de proteção de dados (pp. 245-271). Revista dos Tribunais.
Hood, C., Rothstein, H., & Baldwin, R. (2001). The Government of Risk: Understanding Risk Regulation Regimes. Oxford University Press.
Husa, J. (2003). Farewell to Functionalism or Methodological Tolerance? Rabels Zeitschrift für ausländisches und internationales Privatrecht , 67, 419-447. https://doi.org/10.1628/0033725033631996
IRGC (2005). Risk Governance: Towards an Integrative Approach. International Risk Governance Council.
Kaplan, S., & Garrick, B. J. (1981). On the Quantitative Definition of Risk. Risk Analysis, 1, 11-27. https://doi.org/10.1111/j.1539-6924.1981.tb01350.x
Levi-Faur, D. (2005). The Global Diffusion of Regulatory Capitalism. The Annals of the American Academy of Political and Social Science, 598, 12-32. https://doi.org/10.1177/0002716204272371
Macenaite, M. (2017). The “Riskification” of European Data Protection Law through a Two-Fold Shift. European Journal of Risk Regulation, 8, 506-540. https://doi.org/10.1017/err.2017.40
Mayer-Schönberger, V. (1997). Generational Development of Data Protection in Europe. In P. E. Agre, & M. Rotenberg (Eds.), Technology and Privacy: The New Landscape (pp. 219-241). MIT Press.
Mendes, L. S., & Bioni, B. R. (2019). O regulamento europeu de proteção de dados pes-soais e a Lei Geral de Proteção de Dados Brasileira: Mapeando convergências na direção de um nível de equivalência. Revista de Direito do Consumidor , 124, 157-180.
Michaels, R. (2006). The Functional Method of Comparative Law. In M. Reimann, & R. Zimmermann (Eds.), The Oxford Handbook of Comparative Law (pp. 339-382). Oxford University Press.
Organisation for Economic Co-Operation and Development (OECD) (1980). OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data . https://bja.ojp.gov/sites/g/files/xyckuh186/files/media/document/oecd_fips.pdf
Parker, C., & Braithwaite, J. (2012). Regulation. In M. Tushnet, & P. Cane (Eds.), The Oxford Handbook of Legal Studies (pp. 119-145). Oxford Academic. https://doi.org/10.1093/oxfordhb/9780199248179.013.0007
Quelle, C. (2017). Privacy, Proceduralism and Self-Regulation in Data Protection Law. Teoria Critica della Regolazione Sociale , 89-106. https://ssrn.com/abstract=3139901
Rosa, E., Renn, O., & McCright, A. (2014). The Risk Society Revisited: Social Theory and Governance. Temple University Press.
Spina, A. (2017). A Regulatory Mariage de Figaro : Risk Regulation, Data Protection, and Data Ethics. European Journal of Risk Regulation, 8, 88-94. https://doi.org/10.1017/err.2016.15
van der Heijden, J. (2019). Risk Governance and Risk-Based Regulation: A Review of the International Academic Literature. Te Herenga Waka-Victoria University of Wellington. https://ir.wgtn.ac.nz/items/e02c2440-ab62-43dd-81bb-e86fc871fe17