Gegevensbescherming door ontwerp: ontleding, toepassing van en ondersteuning voor Artikel 25(1) AVG

Article 24(1) of the General Data Protection Regulation (GDPR) compels controllers to 'implement appropriate technical and organisational measures to ensure and demonstrate compliance with the Regulation', while Article 25(1) requires them to do so 'both at the time of the determination of the means for processing and at the time of the processing itself'. The switch to such a 'risk-based' approach follows from the legislator's ambition to ensure the flexibility and future-proofness of the data protection law reform. Yet, if the motivations behind that paradigm shift are clear, translating it in practice remains challenging for controllers. For three reasons, mostly. First, the material scope of data protection by design, and therefore the extent of controllers' compliance exercise, is unclear. This leads to uncertainties as to the type of risks controllers ought to identify and mitigate. Second, lawyers and software engineers, while both conducting a form of risk identification and mitigation process, work in relative isolation, operate on the basis of discipline-specific assumptions and rely on different representations of the same system. That disconnect results in the implementation of inconsequential or inconsistent countermeasures. Third, the GDPR purposefully leaves controllers a wide margin of appreciation when it comes to transposing its principles and rules into the planning, design, implementation and deployment of concrete software systems. That flexibility shifts the burden of compliance onto controllers, and comes at the cost of upfront legal certainty. Against this background, this thesis pursues three objectives. First, it sheds light on the material scope of data protection by design (Part I). To do so, Chapter 2 first unravels the history of data protection by design by delving into its technical roots and outlining comparable initiatives that have preceded the entry into force of the GDPR. Chapter 3 then outlines the constitutive elements, role and addressees of that obligation, and delves into the argumentation that brought us before the Court of Justice of the European Union (CJEU) in case C-604/22. Lastly, Chapter 4 draws from the findings of a case law review spanning 177 decisions issued by 26 National Supervisory Authorities (NSAs) in 24 countries to break down the components of data protection by design. Second, it puts the 'raison d'ëtre' of data protection by design to the test by leveraging Articles 24(1) and 25(1) GDPR to try and address the risks raised by companion chatbots (Part II). More specifically, Chapter 5 outlines the pivotal role played by data protection by design in the reasoning that served as the basis for a formal complaint lodged against Chai Research Corp. before the Autorité de Protection des Données (APD). Third, it proposes, implements, validates and evaluates the Data Protection Modeling Framework (DPMF), a concrete solution to support controllers in complying with their obligations pursuant to Articles 24(1) and 25(1) GDPR (Part III). The framework presented in Chapter 6 is the product of an interdisciplinary collaboration between the KU Leuven Centre for IT & IP Law (CITIP) and the DistriNet Research Unit. Building on the above, this thesis highlights two key takeaways. First, the vagueness of data protection by design is a feature rather than a bug. Providing clear guidance on how to substantiate Articles 24(1) and 25(1) GDPR within the text of the Regulation itself would have defeated its very purpose, that is, compelling controllers to continuously monitor the risks raised by their processing activities and adapt their mitigation strategies accordingly. While this comes at the cost of upfront legal certainty, it is a necessary trade-off to guarantee the relevance of the Regulation in the long run. The true value of data protection by design, I argue, lies in the enforcement ecosystem built around it, which is comprised of NSAs acting in their enforcement and advisory capacity under the umbrella of the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS). Second, the broad interpretation of Articles 24(1) and 25(1) GDPR defended in this thesis requires controllers to look beyond their own activities and consider the risks that downstream or upstream usage of their respective contribution to the processing might pose for data subjects, and natural persons more generally. In that sense, data protection by design sparks an essential reflection as to the broader ecosystem in which each individual actor operates. By forcing each actor to consider the impact of its contribution to the overall chain, I conclude, Articles 24(1) and 25(1) GDPR foster a deeper conversation as to the desirability of software products and services that depend on interorganisational data sharing.