Three Standpoints in Risk-Based Regulation: Applying a Meta-Regulatory Framework to Personal Data Protection

By distinguishing between three perspectives of risk-based regulation—namely, of the regulated entity, the regulated activity, and of the regulator itself (Black, 2010b)—this article aims to propose a meta-regulatory framework to investigate the regulation of risk in the field of personal data protection. Using insights from the institutional development of Brazilian data protection law and comparing it with the GDPR, this study clarifies how each jurisdiction operationalizes risk and provides examples to illustrate how each of the three standpoints may interact with other perspectives. The article supports meta-regulatory debates and research on personal data regulation by providing examples and connecting these categories to the key features of a “riskified” (Spina, 2017; Macenaite, 2017) data protection law.