The Transformation of Risk Regulation: Managing Uncertainty and Powers in the Digital Age
Barra lateral de artigos
Conteúdo do artigo principal
Resumo
Risk regulation has increasingly expanded in European digital policy, yet it is diverging from its roots, especially the precautionary principle. Rather than traditionally focusing on scientific evidence and knowledge, the European approach to risk regulation has been increasingly based on constitutional values such as the protection of fundamental rights and democracy. This article seeks to unravel the logic that has led the Union to move from an approach to risk more based on science to a model which considers constitutional values as parameters to assess and mitigate risks. By focusing on European digital regulation, primarily the GDPR, the DSA and the AI Act, this work underlines how the constitutional rationale of this transformation comes as a response to the intangibility of risks resulting from digital technologies and to imbalances of information and knowledge coming from the concentration of private power in the digital ecosystem. The primary argument is that risk regulation in European digital policy does not seek to rationalise uncertainty through science but to govern epistemological uncertainty through the instruments of constitutionalism, with the goal of addressing the impact of digital technologies on fundamental rights and imbalances of power.
Downloads
Detalhes do artigo
Este trabalho está licenciado sob uma licença Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
Os autores mantêm os direitos autorais de seus artigos publicados na Revista de Direito Administrativo (RDA) e concedem à Fundação Getulio Vargas / FGV Direito Rio o direito não exclusivo de primeira publicação.
Os artigos são licenciados sob a Creative Commons Atribuição–NãoComercial–SemDerivação 4.0 Internacional (CC BY-NC-ND 4.0), que permite o compartilhamento do conteúdo por qualquer pessoa, desde que seja dada a devida atribuição aos autores e à publicação original, vedado o uso para fins comerciais e a realização de modificações ou obras derivadas.
Os autores assumem total responsabilidade pela originalidade e integridade de seus trabalhos, isentando a FGV Direito Rio de qualquer responsabilidade por violações de direitos de terceiros. Os artigos publicados na RDA não refletem, necessariamente, a posição institucional da Fundação Getulio Vargas.
Referências
Vagelis Papakonstantinou and Paul de Hert, The Regulation of Digital Technologies in the EU. Act-ification, GDPR Mimesis and EU Law Brutality at Play (Routledge 2024).
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Ser vices and amending Directive 2000/31/EC.
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act).
Maria Weimer, Risk Regulation in the Internal Market: Lessons from Agricultural Biotechnology (Oxford University Press 2019).
Weimer, Maria, and Luisa Marin, ‘The Role of Law in Managing the Tension between Risk and Innovation: Introduction to the Special Issue on Regulating New and Emerging Technologies’, European Journal of Risk Regulation, 7 (2016), 469-74 <http://dx.doi.org/10.1017/S1867299X00006012>
Kristel De Smedt & Ellen Vos, ‘The Application of the Precautionary Principle in the EU,’ in Simone Arnaldi and others (eds), The Responsibility of Science 163 (Springer 2022).
AI Act, art 5.
Ibid., Arts 28b(2) and Annex VIII.
Ljupcho Grozdanovski and Jasper De Cooman, ‘Forget the Facts, Apply the Law: Artificial Intelligence, Fact-Finding and the European Union’ (2023) 49(2) Rutgers Computer and Technology Law Journal 296.
Claudia Quelle, ‘Enhancing Compliance under the General Data Protection Regulation: The Risky Upshot of the Accountability-and Risk-Based Approach’ (2018) 9 European Journal of Risk Regulation 502.
Andrea Mantelero, ‘The Fundamental Rights Impact Assessment (FRIA) in the AI Act: Roots, legal obligations and key elements for a model template’ (2024) 54 Computer Law & Security Review 106020.
Claudio Novelli and others, ‘Generative AI in EU law: Liability, privacy, intellectual property, and cybersecurity’ (2024) Computer Law & Security Review https://arxiv.org/pdf/2401.07348 accessed 12 march 2025; Janneke Gerards and Raphaële Xenidis, Algorithmic Discrimination in Europe: Challenges and Opportunities for Gender Equality and Non-Discrimination Law (European Commission, Directorate-General for Justice and Consumers, Publications Office 2021); Matthew U Scherer, ‘Regulating Artificial Intelligence Systems: Risks, Challenges, Competencies, and Strategies’ (2016) 29 Harvard Journal of Law & Technology 353. 15 Julie Cohen, Between Truth and Power: The Legal Constructions of Informational Capitalism (Oxford University Press 2019).
AI Act, Arts 9 and 29.
Julie Cohen, Between Truth and Power: The Legal Constructions of Informational Capitalism (Oxford University Press 2019).
Jonathan B Wiener et al, Reality of Precaution. Comparing Risk Regulation in the United States and Europe (Taylor & Francis 2010). See also Bernstein, Against the Gods (n 9); Ian Hacking, The Emergence of Probability (CUP 1975).
Brian Wynne, ‘Uncertainty and Environmental Learning’ (1992) 2 Global Environmental Change 111, 113.
Ibid 113.
Jenny Steele, Risks and Legal Theory (Hart Publishing 2004) 6.
Andrew Stirling, On Science and Precaution in the Management of Technological Risk: Volume I—A Synthesis Report of Case Studies (Institute for Prospective Technological Studies 1999) 16.
Kristel De Smedt & Ellen Vos (n ).
Jale Tosun, ‘How the EU Handles Uncertain Risks: Understanding the Role of the Precautionary Principle’ (2013) 20 Journal of European Public Policy https://doi.org/10.1080/13501763.2013.834549.
For the purpose of this paper, we treat scientific uncertainty as a subset of epistemic uncertainty. Consistent with regulatory governance scholarship, risk is used here as a device to rationalise decision-making under uncertainty, distinct from hazard (source of harm) and from uncertainty itself. See Christopher Hood, Henry Rothstein and Robert Baldwin, The Government of Risk: Understanding Risk Regulation Regimes (Oxford University Press 2001); Michael Power, The Risk Management of Everything: Rethinking the Politics of Uncertainty (Demos 2004); Michael Power, Organized Uncertainty: Designing a World of Risk Management (Oxford University Press 2007); Andrew Stirling, ‘Risk, Precaution and Science: Towards a More Constructive Policy Debate’ (2007) EMBO Reports 8(4) 309-315.
Karl-Heinz Ladeur, Das Umweltrecht der Wissensgesellschaft: Von der Gefahrenabwehr zum Risikomanagement (Schriften zur Rechtstheorie 167, Duncker & Humblot 1995). In Maria Weimer, Risk Regulation in the Internal Market. (24)
Julia Black, ‘The Role of Risk in Regulatory Processes’ in Robert Baldwin, Martin Cave, and Martin Lodge (eds), The Oxford Handbook of Regulation (OUP 2010) 302.
Christopher Carrigan and Cary Coglianese, ‘Capturing Regulatory Reality: Stigler’s The Theory of Economic Regulation’ (University of Pennsylvania, Institute for Law & Economics Research Paper No 16-15, 4 July 2016) https://ssrn.com/abstract=2805153 accessed 28 April 2025.
Kukuh Komandoko, ‘The Role of the Precautionary Principle in Mitigating Financial and Banking Crisis’ (2020) 5(10) International Journal of Innovative Science and Research Technology 2456. Hugues Chenet et al, Developing a Precautionary Approach to Financial Policy — From Climate to Biodiversity: The INSPIRE Sustainable Central Banking Toolbox, Policy Briefing Paper 02 (University College London and New Economics Foundation, April 2022). OECD, Understanding and Applying the Precautionary Principle in the Energy Transition (OECD Publishing 2023) https://doi.org/10.1787/5b14362c-en.
Although the precautionary principle was systematised in the last century, some traces can be found in the origin to the ancient Greece, when Aristotle referred to prudence as “practical wisdom” (phronesis), different than the theoretical wisdom (sophia). Therefore, prudence is understood in its classical sense as the "ability to discern the most appropriate course of action". Unlike philosophy, prudence addresses contingent matters, which cannot be systematically resolved in advance and require specific responses for each unique situation. See Roberto Andorno, ‘The Precautionary Principle, A new Legal Standard for a Technological Age’ (2004) 1 Journal of International Biotechnology Law. 11.
See Sonja Boehmer-Christiansen, ‘The Precautionary Principle in Germany — Enabling Government’ in Tim O’Riordan and James Cameron (eds), Interpreting the Precautionary Principle (Earthscan 1994) 31.
Ragnar Löfstedt, ‘The Swing of the Regulatory Pendulum in Europe: From Precautionary Principle to (Regulatory) Impact Analysis’ (2004) 28(3) Journal of Risk and Uncertainty 237-260.
Staffan Westerlund, ‘Legal Antipollution Standards in Sweden' (1981) 25 Scandinavian Studies in Law 223, 231.
Mary Stevens, ‘The Precautionary Principle in the International Arena’ (2002) Sustainable Development Law and Policy Spring/Summer, 13-15.
Bergen Declaration, Fifth International Conference on the Protection of the North Sea (Bergen, 2002) https://www.ospar.org/site/assets/files/1239/5nsc-2002_bergen_declaration_english.pdf accessed 28 April 2025.
This document explicitly linked the importance of precaution in innovation to the achievement of sustainable development.
Convention for the Protection of the Marine Environment of the North-East Atlantic (OSPAR Convention) (1992). In relation to the protection of the marine environment. Article 2 of the OSPAR Convention establishes the precautionary principle, allowing preventive measures to be taken in the face of reasonable concerns that substances or energy introduced into the marine environment may cause harm, even without conclusive evidence of a causal relationship.
Rio Declaration on Environment and Development, Report of the United Nations Conference on Environment and Development (Rio de Janeiro, 3-14 June 1992) UN Doc A/CONF.151/26 (Vol I): ‘In order to protect the environment, the precautionary approach shall be widely applied by States according to their capabilities. Where there are threats of serious or irreversible damage, lack of full scientific certainty shall not be used as a reason for postponing cost-effective measures to prevent environmental degradation’.
Ibid 22
Alberto Alemanno, ‘The Shaping of the Precautionary Principle by European Courts: From Scientific Uncertainty to Legal Certainty’ (Bocconi Legal Studies Research Paper 2007); Johan Zander, The Application of the Precautionary Principle in Practice: Comparative Dimensions (Cambridge University Press 2010).
Kristel De Smedt & Ellen Vos.
Regarding debate on the nature of the principle as general principle or approach see Jacqueline Peel, ‘Precaution—A Matter of Principle, Approach or Process?’ (2004) 5(2) Melbourne Journal of International Law 483-501; Johan Zander, The Application of the Precautionary Principle in Practice: Comparative Dimensions (Cambridge University Press 2010); Joanne Scott, Legal Aspects of the Precautionary Principle: A British Academy Brexit Briefing (British Academy 2019).
Natalie Eckley and Henrik Selin, ‘All Talk, Little Action: Precaution and Its Effects on European Chemicals Regulation’ (2004) 11(1) Journal of European Public Policy 78-105.
Commission Communication on the Precautionary Principle [2000] OJ C200/1.
Ibid, 2.
Ibid, 13.
For the purpose of this paper, scientific uncertainty is considered as the inability to reach a scientific consensus or the lack of full available information, as referred in the Communication from the Commission on the precautionary principle, 16.
Terje Aven, ‘A Risk and Safety Science Perspective on the Precautionary Principle’ (2023) 165 Safety Science 106211. A risk and safety science perspective on the precautionary principle. He explains that uncertainties must be scientific in order to properly talk about the performance of precautionary principle instead of pure risk analysis.
Commission Communication on the Precautionary Principle (n ), 15.
Ibid, 17-21.
Commission Implementing Regulation (EU) C/2024/8795 final establishing detailed provisions for the voluntary environmental labelling system for estimating the environmental performance of flights, in accordance with Article 14 of Regulation (EU) 2023/2405 of the European Parliament and of the Council (Flight Emissions Label) (European Commission, 18 December 2024).
Implementation Protocol of the Sustainable Fisheries Partnership Agreement between the European Union, the Government of Greenland and the Government of Denmark (2025–2030) ST/14781/2024/INIT (12 December 2024).
Cass R Sunstein, Laws of Fear: Beyond the Precautionary Principle (Cambridge University Press 2009); Johan Zander, The Application of the Precautionary Principle in Practice: Comparative Dimensions (Cambridge University Press 2010); David Gee, ‘More or Less Precaution’ in European Environment Agency, Late Lessons from Early Warnings II: Science, Precaution, Innovation (EEA Report No 1/2013, 2013) 643; Ragnar Löfstedt, ‘The Precautionary Principle in the EU: Why a Formal Review Is Long Overdue’ (2014) 16(3) Risk Management 143-145; Daniel Castro and Michael McLaughlin, Ten Ways the Precautionary Principle Undermines Progress in Artificial Intelligence (Information Technology and Innovation Foundation 2019) https://itif.org/publications/2019/02/04/dont-put-artificial-barriers-artificial-intelligence-out-fear-new-report/ accessed 28 April 2025.
Kimberly Garnett and David KJ Parsons, ‘Multi-Case Review of the Application of the Precautionary Principle in European Union Law and Case Law’ (2017) 37(3) Risk Analysis 502; Alemanno (n ).
Mark Geistfeld, ‘Implementing the Precautionary Principle’ (New York University School of Law, NYU Law and Economics Research Paper No 00-004, 2000) https://papers.ssrn.com/sol3/papers.cfm?abstract_id=289146 accessed 28 April 2025.
Directive 2008/50/EC of the European Parliament and of the Council of 21 May 2008 on ambient air quality and cleaner air for Europe.
Ibid, Art. 13.
Directive 2011/92/EU of the European Parliament and of the Council of 13 December 2011 on the assessment of the effects of certain public and private projects on the environment.
Ibid, Art 3.
Tosun (n )
Ulrich Beck, Risk Society: Towards a New Modernity (Sage 1992).
Julia Black, ‘The Emergence of Risk-Based Regulation and the New Public Risk Management in the UK’ [2005] Public Law 512, 513.
Grozdanovski and De Cooman (n ), 296.
Steele, Risks and Legal Theory, 6.
Sheila Jasanoff, ‘The Songlines of Risk’ (1999) 8 Environmental Values 135, 141.
See for the counterargument of this traditional model: van Asselt and Vos, ‘The Precautionary Principle and the Uncertainty Paradox’ (n 57) 313.
Martijn W Hesselink, ‘A European Legal Method? On European Private Law and Scientific Method’ (2009) 15 ELJ 20. In Maria Weimer, Risk Regulation (43).
GDPR, Art. 5.
Ibid, Art 35.
Digital Services Act, art 12(2).
Ibid, Arts 34(1)-(2).
AI Act, Art 27.
Council Directive 2008/50/EC of 21 May 2008 on ambient air quality and cleaner air for Europe [2008] OJ L152/1.
Grozdanovski and De Cooman (n ), 296.
Regarding efforts to quantify digital risks see Gemma Galdon Clavell, AI Auditing — Proposal for Algo-scores (European Data Protection Board, SPE Programme 2024); J Mökander, ‘Auditing of AI: Legal, Ethical and Technical Approaches’ (2023) 2 DISO 49.
Weimer and Marin (n ).
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L281/31.
GDPR, Arts 1(2) and 5(2), Recital 74; Charter of Fundamental Rights of the European Union, Art 8.
Giovanni De Gregorio, Digital Constitutionalism in Europe. Reframing Rights and Powers in the Algorithmic Society (Cambridge University Press 2022).
Jack M. Balkin, ‘Free Speech in the Algorithmic Society: Big Data, Private Governance, and New School Speech Regulation’ (2018) 51 UC Davis Law Review 1151.
Marietje Schaake, The Tech Coup: How to Save Democracy from Silicon Valley (Princeton University Press 2024).
This asymmetric distribution of information is not unique to the digital age; it is a widespread feature of the risk society described by Ulrich Beck. What is distinctive now are the political responses adopted by public authorities, which follow an ex post logic—as discussed in section 3.2 of this paper.
European Commission, Strengthened Code of Practice on Disinformation (June 2022) https://digital-strategy.ec.europa.eu/en/library/strengthened-code-practice-disinformation accessed 28 April 2025.
Cary Coglianese, ‘Performance-Based Regulation: Concepts and Challenges’ in Francesca Bignami and David Zaring (eds), Comparative Law and Regulation: Understanding the Global Regulatory Process (Edward Elgar Publishing 2016) 403.
Artificial Intelligence Act, art 5 (prohibited practices); arts 9-15 (performance elements in high-risk systems).
Coglianese (n 403).
DSA, Art. 34.4.
AI Act, Art. 5.
Raphael Gellert, The Risk-Based Approach to Data Protection (Oxford University Press 2020).
DSA, Arts. 33-4.
AI Act, Art. 27.
Giovanni De Gregorio, ‘The Normative Power of Artificial Intelligence’ (2023) 30 Indiana Journal of Global Legal Studies 55.