Risk¶
Scattered use
None of the sources read defines risk. The word is used in very different senses. van Dijk et al. 2016, which has risk in its title, has no PDF and is not included.
Definitions in the sources¶
| Source | Definition/use | Page | U/T |
|---|---|---|---|
| Fairfield & Engel 2015 | The individual does not account for the risk her own contributions pose to others' privacy; courts recognise an increased risk of harm, such as identity theft | 424, 426–427 | U |
| Vedder & Naudts 2017 | The GDPR's impact assessment where there is a high risk to rights and freedoms; the effects of algorithms are hard to foresee | 212–213, 216 | U |
| Mazzucato 2018 | The state takes risks as an investor and should share in the rewards, not only the risks | 809 | U |
| Asdal et al. 2023 | The SINTEF report turns threats into ‘criteria for growth’, so that serious risk does not reduce growth potential | 12–13 | U |
| Solove 2011 | The risk of dying from terrorism is low compared with other causes of death; it is hard to assess | 42–43 | U |
| Marres 2025 | Tech trials pose societal risks such as discrimination, surveillance and exploitation of work | 2, 5 | U |
| EEAS 2025 | The Response Framework relies on assessing risks and vulnerabilities; anticipatory analysis is needed to prevent and manage risks | 4, 7 | U |
| Alegre 2021 | Risk profiling in criminal justice, based on inferences about what people think | 5–6 | U |
Where usage diverges¶
- Risk to whom? To the individual and other users (Fairfield & Engel), to rights and freedoms (Vedder & Naudts), to the state as investor (Mazzucato), to the economy (Asdal et al. 2023), to society (Marres 2025) and to security (EEAS, Solove) [U].
- Risk as tool or threat? In Vedder & Naudts and NOU 2022:11, risk assessment is a regulatory tool (Vedder & Naudts 2017, p. 216; NOU 2022:11, p. 11) [U]. In Alegre, risk profiling is itself a problem (pp. 5–6) [U].
Concepts easily confused with this one¶
- Risk and harm: Fairfield & Engel distinguish concrete harm from increased risk of harm (pp. 426–427) [U]. Solove criticises the demand for visible harms of the ‘dead bodies’ kind (pp. 29–30) [U].
- Risk and threat: EEAS and the FFI report use threat assessments and threat actors (EEAS 2025, p. 4; Sivertsen et al. 2026, pp. 9–10) [U].
- Risk assessment and precaution: NOU 2022:11 combines thorough risk assessments with the precautionary principle where risk is particularly high (p. 11) [U].
How the concept is used in the primary documents¶
- NOU 2022:11:
- A national privacy policy must involve thorough risk assessments (risikovurderinger), also when designing regulations and services (p. 11) [U].
- The precautionary principle (føre-var-prinsippet) should apply where technology poses a particularly high risk to privacy (p. 11) [U], and to profiling for control purposes (pp. 81, 85) [U].
- FFI report:
- The project has its own risk assessment for processing personal data (Sivertsen et al. 2026, p. 20) [U].
- The report cites threat assessments from PST, the Intelligence Service, NSM and NESS (pp. 9–10) [U].
Open questions for Rebekka¶
- Is risk a central concept for you, or just a recurring word?
- Do you have van Dijk et al. 2016, which is likely about risk in data protection law?
- Do the documents frame privacy as a question of risk, of rights, or both?