Wednesday 12 June 2019, 16.00, room W416 (Weymouth House)

One of the ways to ensure compliance of new technologies with legal values and principles has been the introduction of by-design obligations. Those obligations demand economic operators to program their technologies in such a way as to comply with legal norms. Related to, yet different from classical co-regulation initiatives, by-design obligations present a new and potentially powerful way to push economic operators into compliance with legal norms and principles.

Within the EU, Article 25 of Regulation 2016/679 – the General Data Protection Regulation or GDPR – requires controllers of personal data to take appropriate measures guaranteeing data processing systems are designed and functioning to protect the values of the Regulation, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing. Although the GDPR seems to indicate the types of measures that can be taken and the ways in which compliance with them can be acknowledged through certification mechanisms, the actual scope of the by-design and by-default obligations covered by that provision are unclear from a regulatory theory and constitutional law point of view.

This paper takes the explicit insertion of by-design obligations in the GDPR as a starting point for a more systematic reflection on the use of those obligations as a regulatory strategy in the European Union and its Member States. More generally, the paper seeks better to conceptualise legal nature of by-design obligations and the challenges they raise for legislators and regulators. Taking the European Union as a study in point, the paper will additionally question to what extent by-design obligations require a better integration into or modifications of the EU’s constitutional framework.

________________________________________________

Pieter Van Cleynenbreugel is Professor of Law at the University of Liège and Director of the Liège Competition and Innovation Institute. Pieter is a CIPPM Residential Fellow, Summer 2019.

_________________________________________________