Risk as a subjective phenomenon. Integrating cognitive science into the concept of risk in European data protection law

Despite the impossibility of conducting an ‘objective’ risk assessment, there are European legal acts,
such as the General Data Protection Regulation (GDPR), which demand that regulatees conduct such
an assessment. The project will respond to the calls for debiasing the law through a better
understanding of the subjective character of risk – including a ‘risk to a right’. This will be done
through the identification of the heuristics and cognitive bias influences on risk assessors within the
process of the GDPR Data Protection Impact Assessment (DPIA). This issue has not yet been
researched despite its significance for (legal) practice, such as conducting risk assessments according
to Art. 32, 35(7)(c) GDPR and monitoring enforcement of application of a risk-based approach (Art.
57(1)(a)). The proposed project is interdisciplinary, combining knowledge and expertise in three
main areas: data protection and criminal law, and cognitive science. Using the black letter legal
method and empirical methods, such as behavioural experiments and interviews, the project will
contribute to a better understanding of risk in data protection law by filling the knowledge gap and
providing new insights into the subjective character of risk assessment. In parallel, a systematic
analysis of cognitive biases in risk analysis in the EU data protection law will contribute to a better
understanding of the concept of risk in law, itself an essentially contested and continuously evolving
concept.