The risk-based approach in the GDPR and the ‘two-step test’ within Article 44

Introduction

The integration of the risk-based approach (RBA) in the General Data Protection Regulation (GDPR or Regulation)¹ has been a focal point in scholarly articles² and books.³ Gellert describes the RBA as a trend emerging in the late 2000s or early 2010s, characterized by the integration of risk management tools into data protection legal frameworks.⁴ Similarly, important scholars view data protection law as a form of ‘risk regulation’.⁵ However, the GDPR adopted this approach only partially. It emphasizes risk-based measures that data controllers must implement to safeguard fundamental rights and freedoms, while at the same maintains a commitment to a more traditional legal approach described as ‘rights-based’.⁶

Following the landmark Schrems II decision⁷ and subsequent decisions by Data Protection Authorities (DPAs),⁸ the RBA has garnered renewed attention, particularly in the context of personal data transfers.⁹ Nevertheless, the topic of risk in personal data transfers rules is not a novel one.¹⁰ The concept was briefly alluded to by the Article 29 Working Party (WP)¹¹ in the late 1990s¹² and prior to Schrems II, prominent scholars had already been advocating for data controllers to consider the risks associated with data transfers and to implement corresponding mitigating measures.¹³

More recently, some scholars¹⁴ argue in favour of a RBA based on the Standard Contractual Clauses released by the European Commission in June 2021.¹⁵ Differently, Moerel¹⁶ relies on the horizontal application of the accountability requirement in Article 24 (1) GDPR.¹⁷ The author identifies Article 44 GDPR (General principle for transfers) as a pivotal source for this argument, noting its requirement for controllers to adhere to specific provisions of Chapter V, alongside ‘other provisions’ of the Regulation, including Article 24. This double requirement for data transfers is the essence of the ‘two-step test’ central to this article’s discussion.

Building on Moerel’s insights, this article seeks to further the understanding of the GDPR’s RBA by highlighting the critical role of Data Protection Impact Assessment (DPIA) within the ‘two-step test’ in Article 44 GDPR. To directly address this goal, the article posits that the DPIA, as necessitated by Article 35 in cases of ‘high risk’, is a fundamental component in operationalizing the RBA for data transfers. This exploration addresses a gap in existing scholarship, aiming to elucidate the conditions under which DPIAs become integral to ensuring compliance with the GDPR’s requirements for data transfers.

Initially, the article outlines the ‘two-step test’ as articulated in Article 44 of the GDPR, tracing its evolution from the precedent set by the Lindqvist case to its current status as a principle governing data transfers within the GDPR framework.

Subsequently, the discussion shifts towards an in-depth examination of the test’s first step, emphasizing the DPIA requirements for data transfers. Recognizing that the GDPR mandates a DPIA for processes deemed ‘high risk’, this analysis endeavours to identify the conditions under which data transfers might fall into this category. In doing so, the article not only contributes to the broader discourse on the RBA’s role in ensuring compliance of data transfers, but it also seeks to elucidate the critical function and implications of DPIAs for data controllers navigating the post-Schrems II landscape. This ruling¹⁸ has tightened the requirements of the test’s second phase, introducing a pre-transfer assessment that demands meticulous attention from controllers.

Through this inquiry, the article aspires to clarify the operationalization of DPIAs within the framework of data transfer compliance, addressing a crucial need for guidance in the wake of the Schrems II judgment.

The ‘Two-Step Test’ in Article 44 GDPR

Chapter V GDPR outlines the framework for personal data transfers to third countries or international organizations. Central to this framework, Article 44 establishes the ‘two-step test’ as a general principle, requiring that data transfers comply not only with the general provisions of the GDPR but also with the specific requirements detailed in Chapter V.

This section traces the evolution of the ‘two-step test’ from its conceptual foundations to its current definition in Article 44 GDPR. In tracing its evolutions, the article underlines the test’s pivotal role in integrating DPIAs into the GDPR’s regulatory framework for data transfers, thereby providing a foundational context for this article’s proposals.

The evolution of the ‘two-step test’: from the Lindqvist case to a general principle for data transfers in Article 44

In the seminal Lindqvist case,¹⁹ the Court of Justice of the European Union (CJEU) characterized the data transfers regime in Chapter IV of the Directive as ‘a special regime, with specific rules’. This set of rules was further defined as ‘a complementary regime to the general regime set up by Chapter II of that directive concerning the lawfulness of processing of personal data’.²⁰ This interpretation suggests that data transfer rules add an extra layer of lawfulness to the standard data protection requirements. Leading scholars have consequently viewed transfer mechanisms as ‘special legal grounds’ for data transfers, with Kuner noting that ‘the rules requiring a legal basis for international data transfers apply in addition to those requiring a legal basis for data processing’.²¹

Article 44 GDPR appears to reflect and expand upon the standard established in Lindqvist. It states that ‘Any transfer of personal data (…) shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processing (…)’. This indicates an expansion of the extra lawfulness requirement in Lindqvist to ‘other provisions’, thereby adding another layer of protection to data transfers that extends beyond mere lawfulness.

Consequently, Article 44 operates an expansion of the ‘two-step test’.²² This test involves subjecting the data transfer to the general provisions of the GDPR (step one) and to the ‘complementary regime’ in Chapter V (step two). Hence, this Chapter is not an exception to other duties in the GDPR.²³

The rationale for this dual layer of protection in data transfers is articulated in Recital 116, which notes that ‘when personal data moves across borders outside the Union’, it may be subject to foreign laws that do not ensure the ‘ability of natural persons to exercise data protection rights’. In the words of Advocate General Saugmandsgaard Øe, ‘in the absence of common personal data protection safeguards at global level, cross-border flows of such data entail a risk of a breach in the continuity of the level of protection guaranteed in the European Union’.²⁴ Scholars also mention the ‘prevention of circumvention of the law’ as the main policy goal of data transfers rules.²⁵

Article 44 GDPR further reinforces this approach, stipulating that ‘All provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons guaranteed by this Regulation is not undermined.’ Recital 101 emphasizes the tension inherent in Chapter V, acknowledging the significance of the free flow of data while underscoring the necessity to maintain GDPR standards.

Applying the ‘two-step test’ for data transfers

In applying the ‘two-step test’, the GDPR mandates initial compliance with its general provisions (Articles 5, 24, 25, and 32), setting the stage for this article’s examination of how these provisions underpin the necessity for DPIAs in the first step of data transfer compliance. This alignment is pivotal in this article’s exploration of DPIAs’ role within the RBA framework and data transfer compliance.

The second step demands alignment with Chapter V’s detailed conditions for international data transfers. This section aims to methodically dissect these steps, clarifying the distinct requirements each entails.

Step one: compliance with general provisions of the GDPR

Kuner points to an agreement between the European Data Protection Board (EDPB) and the European Commission on the necessity for both a legal basis for data transfers under Article 6 GDPR, alongside a specific data transfer mechanism outlined in Chapter V.²⁶ However, Article 44 GDPR extends beyond Article 6, referencing ‘other provisions’ of the Regulation.

Thus, controllers must meet ‘general obligations’, beginning with Article 24 (1), which mandates the identification and evaluation of risks in processing personal data.²⁷ Following this initial assessment, controllers are to implement effective and appropriate measures as specified in Article 24.²⁸

Echoing Moerel, this duty extends to data transfers,²⁹ requiring controllers to objectively assess the risk of the data transfer and to quantify it in terms of its likelihood and severity. Should a transfer be deemed ‘likely to result in a high risk to the rights and freedoms of natural persons’,³⁰ it triggers an additional requirement: conducting a DPIA. This point is further elaborated in ‘The DPIA in the realm of data transfers’ section.

Step two: compliance with Chapter V GDPR

In this step, controllers must adhere to the regime for personal data transfers outlined in Chapter V GDPR. This includes adhering to the overarching principle articulated in Article 44, which necessitates the selection and use of a transfer mechanism. Such mechanisms include adequacy decisions (Article 45), appropriate safeguards (Articles 46 and 47), and derogations for specific situations (Article 49). This exhaustive list³¹ does not enumerate any unilateral risk assessment of the data transfer among the transfer mechanisms listed.³²

The prerogative to determine if a third country or an international organization ensures an ‘adequate level of protection’ rests solely with the European Commission.³³ In conducting this assessment, the Commission is guided by criteria outlined in Article 45 (2) GDPR, which generally encompass elements of the legal framework, such as the rule of law, relevant legislation, data protection rules, the existence and functioning of supervisory authorities, and the international commitments of the third country or international organization concerned. The primary legal effect of such a decision is that transferring personal data ‘shall not require any specific authorization’.³⁴

Furthermore, in the absence of an adequacy decision, the selection³⁵ and use of another transfer mechanism must not undermine the ‘level of protection’ contained in the GDPR. This principle was emphasized by the CJEU in the Schrems II decision,³⁶ where the court explored the possibilities provided in the GDPR for data transfers under the umbrella of safeguarding EU fundamental rights as protected in the Charter of Fundamental Rights of the EU. It invalidated the adequacy decision for transfers to the USA—the Privacy Shield—and placed fundamental rights at the core of transfer mechanisms.

Indeed, the CJEU further expanded a concept previously developed in Schrems I³⁷ and Opinion 1/15³⁸ in relation to EU fundamental rights—essential equivalence—and extended it towards a guiding benchmark for the whole approach for data transfers in the GDPR.³⁹

Following Schrems II, when using Article 46’s appropriate safeguards, controllers must assess the effectiveness of the transfer mechanism and, if necessary, implement ‘additional safeguards’ provided by ‘supplementary measures’ that bring the protection to the level required by EU law.⁴⁰ Drechsler and Kamara emphasize that ‘the standard of essential equivalence as developed by the CJEU is the level to maintain when personal data are being transferred’.⁴¹ More practically, the CJEU requires controllers to evaluate the effectiveness of the transfer mechanism and the legislation and practices in place in the country of destination.⁴²

Lastly, Article 49 GDPR introduces ‘Derogations for specific situations’ detailing conditions under which data transfers can occur in the absence of an adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR. The EDPB has interpreted this provision very restrictively, emphasizing its ‘exceptional nature’ and stating that the derogations ‘must be interpreted restrictively and mainly relate to processing activities that are occasional and non-repetitive’.⁴³

The DPIA in the realm of data transfers

The preceding analysis demonstrates that Article 44’s first step requires controllers to conduct a risk assessment (Article 24) and, where applicable, a DPIA (Article 35), emphasizing the critical role of risk assessment in this phase.

Moerel relies on this argument to underscore that the obligation in Article 24 GDPR (Responsibility of the controller) applies to data transfers.⁴⁴ This section delves into the interplay between the GDPR’s general risk management obligation (Article 24) and the specific requirements for conducting DPIAs (Article 35 GDPR). In particular, it will examine whether a data transfer qualifies as ‘high risk’ processing, necessitating a DPIA, and how this aligns with the CJEU’s assessment in the Schrems II decision. This discussion will provide a concrete foundation for understanding when data transfers trigger the need for a DPIA.

The general obligation to manage risks in Article 24 (1) GDPR

Article 24 (1) GDPR imposes a proactive obligation on controllers to implement ‘appropriate technical and organizational measures’. However, it neither prescribes a specific list of measures nor grants unfettered discretion to controllers in their choices. Instead, controllers must consider two primary criteria in their decision-making: (i) ‘the nature, scope, context and purposes of processing’⁴⁵; and (ii) ‘the risks of varying likelihood and severity for the rights and freedoms of natural persons’⁴⁶. These two criteria embody the ‘scalability of obligation’ concept articulated by the WP, allowing controllers to customize their compliance system.⁴⁷

The WP interprets Article 24 (1) as establishing a ‘general obligation to appropriately manage risks presented by the processing of personal data’.⁴⁸ This interpretation extends to the need for risks to be assessed, meaning that they need to be ‘identified, analyzed, estimated, evaluated, treated (e.g. mitigated), and reviewed regularly’.⁴⁹

However, the GDPR does not define ‘risk’, despite its frequent mention throughout the Regulation. The term ‘risk’ appears 73 times throughout the Regulation,⁵⁰ with three instances being particularly significant for understanding its integration into the GDPR’s framework. These key references are found in Recital 75,⁵¹ Articles 24 (1), and 35 (1) GDPR. Recital 75 GDPR delineates the concept of risk, which encompasses the following elements: (i) any unintended or unforeseen effect or consequence to the data subject, (ii) with varying likelihood and severity, (iii) caused by the processing of personal data.

The forward-looking notion of risk, as underscored by the WP, aligns with scenarios envisaging potential events and their repercussions, marking a shift from purely ‘harms-based approaches’.⁵² The criteria of likelihood in the second element was introduced by the GDPR, in addition to that of the level of severity of risk already in Article 17 of the Directive.⁵³ This option seems to outline a modern concept of risk, defined through concepts of likelihood and probability in dealing with the possibilities of future events.⁵⁴ Arguably, the use of the term ‘probability’ points to a conception of risk that can be measured in certain formulas.⁵⁵

This focus on quantification and rationality is further evident in Recital 76 GDPR, which mandates an objective identification of risk factors and an assessment of risk levels. Recital 75 GDPR also points to the necessity of quantifying the consequences—such as physical, material or immaterial damage, issues of discrimination, loss, damage to reputation, etc—of potential future events on the rights and freedoms of the data subject.

Notably, the WP interprets ‘rights and freedoms’ broadly, encompassing not only data protection but also other fundamental rights like free speech, freedom of thought, and the prohibition of discrimination.⁵⁶ Consequently, the GDPR’s focus on risk is primarily for the protection of the data subject, rather than the controller or processor’s regulatory compliance.

Lastly, the third element of this framework locates the main source of the risk for the data subject in the processing of personal data.

The duty to perform a DPIA and the role of risk

Kosta notes that the use of impact assessments is not new and it has been prevalent in various regulatory fields.⁵⁷ The author gives the example of technology assessments developed in the 1960s to study the impact of technological inventions.⁵⁸

In the GDPR, the ‘high risk’ of personal data processing is the trigger of a particular type of assessment. Article 35 (1) GDPR introduces a mandate for controllers to conduct a DPIA when a data processing operation, or a set of similar operations, is likely to pose a ‘high risk’ to the rights and freedoms of data subjects.⁵⁹

Recital 84 GDPR positions DPIAs as an accountability requirement, stipulating that their outcomes must inform the decisions on appropriate measures to demonstrate that the data processing operation is compliant. Simultaneously, DPIAs serve as an ex-ante compliance requirement, designed to pre-emptively identify and mitigate potential negative consequences of processing operations.⁶⁰

In a non-exhaustive list, Article 35 (3) GDPR introduces three scenarios where a DPIA is required, encompassing systematic and extensive evaluations based on automated processing, large-scale processing of special categories of data, and systematic monitoring of publicly accessible areas.⁶¹ Recital 92 provides examples such as ‘where public authorities or bodies intend to establish a common application or processing platform or where several controllers plan to introduce a common application or processing environment across an industry sector or segment or for a widely used horizontal activity’.

Additionally, Article 35 (4) obliges data protection authorities to publish a list of processing operations warranting DPIAs, with Article 35 (7) GDPR providing a non-exhaustive checklist for DPIA contents, including risk assessment in terms of likelihood and severity⁶² and the measures necessary to address these risks and demonstrate GDPR compliance. Recitals 84 and 90 GDPR add that DPIAs should, among other elements, evaluate the origin, nature, particularity, and severity of the risk.

The WP contends that the risk assessment integral to DPIAs does not overlap with the general risk management obligation outlined in Article 24 GDPR.⁶³ The latter underscores the importance of risk assessment for all processing operations, regardless of the perceived level of risk, meaning that the absence of conditions demanding a DPIA does not reduce the obligation to manage risks effectively.⁶⁴

This article concurs with this interpretation. Following a logical and chronological argument, risk assessment is essential before classifying risks as high, medium, or low, with only the former necessitating a DPIA. The WP’s suggestion also highlights the scalable nature of the RBA,⁶⁵emphasizing the need for comprehensive and preliminary or basic risk assessments that differ from the scope of DPIAs.

Data transfers as ‘high risk’ processing

Applying this logic to data transfers, not all transfers necessitate a DPIA. In fact, Article 35 GDPR does not explicitly mention data transfers. Beyond the scenarios listed in Article 35 (3) GPDR, the WP issued Guidelines in 2017, proposing nine criteria for identifying ‘high risk’ processing.⁶⁶

These criteria are not legally binding but serve as a guidance for controllers. They include evaluation or scoring, automated-decision making with legal or similar significant effect, systematic monitoring, processing of sensitive data or data of a highly personal nature, large-scale data processing, matching or combining datasets, processing personal data concerning vulnerable data subjects, innovative use or application of new technological or organizational solutions, and processing that impedes data subjects from exercising a right or using a service or a contract. The WP suggests that a DPIA is generally required when a processing operation meets two of these criteria.⁶⁷

Similar to Article 35 (3) GDPR, the WP guidance does not explicitly mention data transfers nor any criteria directly related to the problems discussed in data transfers case law⁶⁸ and recognized in other legal instruments⁶⁹ such as the impact of foreign law or the direct access to personal data by foreign authorities. Arguably, this absence is not sufficient to conclude that personal data transfers do not pose ‘high risk’ for data subjects. The expression ‘shall in particular be required in the case of’ in paragraph 3 of Article 35 suggests that the list is not exhaustive. Therefore, data transfers can be ‘high risk’, for instance, a multinational research project involving significant health data collected from millions of data subjects could be considered ‘processing on a large scale of special categories of data referred to in Article 9(1)’.

In addition, the WP, as early as 1998, recognized the heightened risk of data transfers, suggesting that the degree of risk should significantly influence the ‘requirements of a particular case’.⁷⁰ It recommended creating a list of ‘priority cases’ for data transfers that ‘pose particular risks to privacy’ and ‘merit particular attention’, including transfers of sensitive categories of data, risks of financial loss, threats to personal safety, and situations that could cause serious embarrassment or tarnish an individual’s reputation.⁷¹

Also, recital 116 GDPR acknowledges that personal data transfers ‘may put at increased risk the ability of natural persons to exercise data protection rights’ and that DPAs ‘can be unable to pursue complaints or conduct investigations relating to the activities outside their jurisdiction’.

A DPIA for data transfers and the Schrems II decision

The terms ‘data transfer risk assessment’⁷² or ‘data transfer impact assessment’ (DTIA)⁷³ emerged post-Schrems II decision, potentially conflating the CJEU required assessment with general risk identification processes for data transfers and suggesting a new type of assessment specific to data transfers.

Yet, the Court did not directly link between the specialized assessment of transfer mechanisms with the risk assessment obligation under Article 24 or the DPIA requirement under Article 35 GDPR. Therefore, conducting a risk assessment for data transfers, whether under the general obligation of risk management or as part of a DPIA, differs from the assessment mandated by the CJEU in Schrems II.

Applying the ‘two-step test’ strictly, both the obligation to manage risks and the duty to perform a DPIA, arise from the first step, unrelated to the second step concerning the transfer mechanism. Conducting a DPIA is based on the processing’s risk level, not on the type of transfer mechanism used. Thus, performing a DPIA can be mandatory regardless of the transfer mechanism in place, even when an adequacy decision was adopted. The legal effect of the adequacy decision is that the transfer does ‘not require any specific authorisation’,⁷⁴ but it does not replace or annuls the application of the general provisions of the GDPR applied in step one. Nevertheless, there seems to be no reason or legal ground for data controllers to re-assess the criteria used by the Commission before adopting the adequacy decision.

In addition, the nature and content of assessments can differ. The Schrems II decision emphasized that controllers should consider the factors aligned with those the EU Commission considers under Article 45 (2) GDPR, such as the rule of law in a third country, the presence of comprehensive data protection laws, or an independent data protection authority.⁷⁵ This approach ensures consistency in fundamental rights protection across data transfer mechanisms, requiring controllers to assess protection equivalency as the EU Commission does.⁷⁶ Hence, the assessment suggested in Schrems II differs from the risk analysis or quantification rationale foundational to both Articles 24 and 35 GDPR.

However, when data transfers are considered ‘high-risk’ and a DPIA is mandatory, there may be an overlap with the Schrems II assessment. Article 35 (7) GDPR introduces a non-exhaustive list of elements that can be included in a DPIA, making it a flexible instrument to accommodate the assessment introduced by the Schrems II decision. In cases where conducting a DPIA is not mandatory, controllers must independently assess the transfer mechanism according to the CJEU criteria.

Concluding remarks

In conclusion, this article affirms the significance of DPIAs within the GDPR’s ‘two-step test’ for data transfers, directly addressing the previously identified gap in scholarly discourse. By systematically examining the conditions that necessitate DPIAs for data transfers, this article not only advances the understanding of the RBA but also provides guidance for data controllers on ensuring GDPR compliance with data transfers post-Schrems II.

It explored the RBA within the GDPR, specifically through the prism of personal data transfers and the pivotal ‘two-step test’ delineated in Article 44. A critical examination of the first step revealed that the general obligation to assess risk, as specified in Article 24, applies to data transfers. Consequently, controllers must identify risks and implement appropriate safeguards for data transfers, similar to the requirements for other types of data processing. But more importantly, the initial phase of the test dictates that following the risk assessment required by Article 24 (1), if a ‘high risk’ to data subjects is determined, a DPIA, as required by Article 35 (1) GDPR, must be carried out.

Notably, the scenarios deemed ‘high risk’ under Article 35 (3) do not explicitly pertain to data transfers. Nevertheless, this absence does not imply that DPIAs are unnecessary for data transfers. Indeed, ‘high risk’ data transfers that fall into the scenarios described in Article 35 (3) necessitate a DPIA. Therefore, the first conclusion of this article is that data transfers are subjected to a risk assessment not only due to the general obligation to manage risk (Article 24), but also when a DPIA is required whenever the data transfer presents a ‘high risk’. An illustrative example involves a research project with international partners and health data.

Following the Schrems II ruling, the test’s second phase has become more stringent for controllers. The CJEU’s refinement of ‘essential equivalence’ now serves as the guiding benchmark for GDPR’s approach to data transfers. Controllers are thus tasked with evaluating the effectiveness of the transfer mechanism and the legislative and practical landscape in the destination country.⁷⁷ But the Court’s assessment in Schrems II and the risk assessment process outlined primarily in Article 35 GDPR are different. This is the second conclusion of this article that identifies three key differences.

The first distinction addresses the ‘two-step test’ structure, indicating that risk assessment occurs in the first phase, while the CJEU’s assessment applies to the second. Accordingly, the necessity for a DPIA is influenced by the processing’s risk level, independent of the chosen transfer mechanism, marking the second distinction. The third difference highlights that the CJEU’s recommended assessment departs from the risk analysis or quantification foundational to Articles 24 and 35 GDPR. The Court emphasized that controllers are to consider the same factors as the EU Commission, as specified in Article 45 (2) GDPR, which includes the rule of law in a third country, the presence of comprehensive data protection laws, or an independent data protection authority.⁷⁸

These three differences open the avenue for another conclusion about the connection between a DPIA and data transfers mechanisms, in particular adequacy decision. Indeed, given the mandatory nature of a DPIA for ‘high risk’ data transfers such an assessment must be performed even when the transfer mechanism is an adequacy decision by the EU Commission. This requirement stems from the ‘two-step test’s’ first phase, with the adequacy decision forming part of the second phase’s transfer mechanism verification. However, it seems impractical to compel controllers to re-evaluate the Commission’s analysis.

Furthermore, the distinctions drawn between the general risk assessment obligation under Article 24, the specific requirements of Article 35, and the nuanced assessment mandated by the Schrems II decision underscore the complexity of the GDPR’s approach to safeguarding data subject rights across borders. The article illuminated the subtle yet significant differences in these assessment processes, highlighting the GDPR’s layered approach to risk in the realm of data transfers.

In conclusion, this article contributes to the ongoing dialogue on the GDPR’s RBA by elucidating the ‘two-step test’ and its implications for data transfers, especially regarding DPIA requirements. By mapping out when and how data transfers should be considered ‘high risk’ processing, it seeks to offer clarity on a previously underexplored aspect of GDPR compliance.

Footnotes