Abstract

This paper process-traces how European policymakers have delegated regulatory responsibilities to private certification and monitoring bodies acting as regulatory intermediaries. It explores how regulators can constrain or incentivise self-regulation that exists in their shadow via intermediaries, instead of using direct modes of regulation.

Highlights

  • The governance of European values around issues of data protection is continually on global political, regulatory, academic, and business agendas

  • This paper addresses how European policymakers have delegated the responsibility of protecting European values inside transnational data flows to private bodies acting as regulatory intermediaries

  • If the member states decided that national accreditation bodies (NABs) would award accreditation—instead of, or together with, data protection supervisory authorities (DPAs)— the accreditation requirements needed to complement the requirements set by regulation (EC) 765/2008 and the EN-ISO/IEC 17065/2012 standards. 11

Read more

Summary

Introduction

The governance of European values around issues of data protection is continually on global political, regulatory, academic, and business agendas. European and national hierarchies: the requirement under the General Data Protection Regulation (GDPR) to rely on private monitoring and certification bodies to adopt data protection codes of conduct or certifications. I ask, how have European policymakers established the two regulatory arrangements that permit private bodies to act as regulatory intermediaries in order to monitor codes and assess conformity with certifications in the shadow of hierarchy? The paper thereafter asks what the similarities and differences in the design of the two sub-regimes are, and concludes by addressing how hierarchical decisions can impact the self-regulation that exists in the sub-regimes’ shadows To answer these questions, I chose to use the process-tracing methodology as it has previously been used to empirically and theoretically study European integration (Pierson, 1996). Thereafter, I draw conclusions about how regulators can impact self-regulation that exists in their shadow by regulating via the intermediaries instead of using direct modes of regulation

Theoretical framework
Codes of conduct before and during the old regime
Certification during the old data protection regime
The adoption of a ‘new’ data protection regime
To demonstrate compliance with
Where accreditation is by NABs
Respect for the certification criteria
Technical
The DPAs or the EDPB approve the criteria
Findings
Conclusions
Full Text
Paper version not known

Talk to us

Join us for a 30 min session where you can share your feedback and ask us any queries you have

Schedule a call

Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.