Can privacy impact assessment mitigate civil liability? A precautionary approach

Privacy impact assessment (PIA) is now considered an important tool to address privacy challenges of the digital era. Unless PIA is already mandatory, regulators need to provide incentive to both public and private sector to conduct PIA and thus a potential limitation or even exclusion of civil liability seems attractive. In this paper we try to understand why PIA can impact this liability by going back to its foundation, i.e. the precautionary principle. In result, a good PIA could demonstrate no fault was committed or could allow resorting to the so-called development risk defence