15. MAIN QUESTION – The main research question of this book is the following:

16. ALLOCATION OF RESPONSIBILITY AND LIABILITY – “Allocation of responsibility” can be described as the process whereby the legislature, through one or more statutory provisions, imposes legal obligations upon a specific actor. “Allocation of liability”, on the other hand, can be described as the process whereby the legislature, through one or more statutory provisions, imputes liability or sanctions to an actor where certain prescriptions or restrictions have not been observed.

17. ACTORS INVOLVED IN THE PROCESSING – The research question is limited to actors involved in the processing of personal data. An actor may be “involved” in the processing of personal data either by processing data for themselves, on behalf of others, or by causing others to process personal data on their behalf. The research question does not extend to other stakeholders who might influence the level of data protection, such as system developers, technology designers, standardisation bodies, policymakers, etc.

18. LEGAL CERTAINTY – Legal certainty is a general principle of EU law. It expresses the fundamental premise that those subject to the law must be able to ascertain what the law is so as to be able to plan their actions accordingly. One of the reasons why European data protection law introduced the distinction between controllers and processors was to clarify their respective responsibilities under data protection law, thereby increasing legal certainty. Many stakeholders consider, however, that the distinction reflects an outdated paradigm, which is overly simplistic and has become increasingly difficult to apply. Some even suggested that, because of its decreased relevance and applicability, the distinction actually creates legal uncertainty. The main objective of this book is to explore ways in which legal certainty might be increased, without diminishing the legal protections currently enjoyed by data subjects.

19. AT LEAST EQUIVALENT – The reference, in the research question above, to “an equivalent level of data protection”, refers to the protection offered EU data protection law. Within the context of this book, the substantive requirements and principles of EU data protection law (e.g. finality, proportionality, transparency) are taken as a given.