Impact assessments are tools of growing popularity. Since their first appearance as environmental impact assessments in 1970, namely in the US National Environmental Policy Act (NEPA), they have proliferated as a regulatory technique in other areas. A whole range of different approaches exist such as Constructive Technology Assessment (CTA), Real Time Assessment, Social Impact Assessment (SIA)¹ and so on. These imply certain foci in terms of purposes, procedures or impact dimensions, but also overlap in many respects.² Moreover, impact assessments have captured the field of data protection, privacy and surveillance. Different approaches exist and diverse guidelines are at hand.³ In our view this proliferation as a whole must be seen as exemplary for a broader social change regarding the meanings and roles science and technology play in society and how both can be regulated. To gain a better understanding of this proliferation as well as of the meaning of impact assessments we begin by situating it under the notion of reflexive modernization as Ulrich Beck has coined it in his famous book Risk Society.⁴

In his book, Beck points to the changing conflicts arising as side effects of on-going techno-economic development. While the welfare state ameliorated the many miseries that industrialization and the logic of wealth distribution had come to mean, especially for the working class during the nineteenth and first half of the twentieth century, another source of conflict arose in the 1960s: risks due to environmental pollution, health risks for consumers, etc. However, the major difference of these side-effects was that they were produced by technological and scientific progress itself. Science and modernity are not simply struggling against tradition and natural scarcity, but also against the danger produced by themselves.⁵

We are therefore concerned no longer exclusively with making nature useful, or with releasing mankind from traditional constraints, but also and essentially with problems resulting from techno-economic development itself. Modernization is becoming reflexive; it is becoming its own theme. Questions of the development and employment of technologies (in the realms of nature, society and the personality) are being eclipsed by questions of the political and economic ‘management’ of the risks of actually or potentially utilized technologies – discovering, administering, acknowledging, avoiding or concealing such hazards with respect to specially defined horizons of relevance. The promise of security grows with the risks and destruction and must be reaffirmed over and over again to an alert and critical public through cosmetic or real interventions in the techno-economic development.

Scientific progress is no longer just the producer of societal benefits but also of dangers to society. The result is a shift within the relation of science and the public but also within science itself. Reflexive modernization implies the turning of science’s methodological skepticism to science itself. As the producer of risks it immediately discovers its role to discern the risks it has produced and starts a “process of demystification”, in which “the structure of science, practice and the public sphere is subjected to a fundamental transformation”.⁶ At the same time its knowledge monopoly is scrutinized. Traditionally seen to be the uneducated receivers of scientific wisdom, or even worse, people with naïve beliefs, the public begins to question the role of science and scientists in society. Scientific research is not an unquestionable good anymore but now has to legitimate itself.⁷

In this respect impact assessments gain significance. Their proliferation can be seen both as an expression of, and a method for dealing with the increasing demand of legitimization by introducing reflexivity into techno-scientific processes. Even when impact assessments are done by a limited group of experts, it shows that the projects under consideration cannot be seen simply as unquestionable signs of progress, but now must supply justification beyond their own implicit normativity. The turn to participatory approaches in impact assessments then deepens the reflexivity and pulls experts and scientists further into the legitimacy debate including those scientists, e.g. social scientists, who are carrying out the assessments themselves.⁸

However, the shift from the logic of wealth to that of risk distribution also has implications for the political landscape. In the risk society the grip of the formal political institutions on society lessens and new forms of politics outside and beyond traditional politics proliferate. In the arenas of subpolitics other societal actors outside parliaments and governments gain impact, challenge conventional decision-making and thus transcend the formal political system in its practices, orientation and rules of decision-making. The de-monopolization of scientific truth is accompanied by a decentralization of political acting. It is a highly ambivalent process. On the one hand subpolitics can compensate political gaps, on the other they often stay hidden from view. Indeed, new hybrid monopolies, consisting of state as well as of non-state actors, emerge beyond democratic control. Industry and science attain an enormous impact while the formal political institutions fail to impact both.

In the end techno-scientific research occurs on a highly deregulated level while technological developments often have a large and unpredictable impact on society, an impact larger even than that of legislation. It becomes difficult and even impossible to regulate future technological developments through law. Technological developments leave law and politics behind. Law and politics do not control these developments, but are confronted with their consequences. Formal political institutions still reflect the idea of a central command and control over societal developments, while the actual power of these institutions is diminishing. Instead, new social movements, non-governmental organizations and citizen groups are gaining voice and are beginning to play an increasing role in new political arenas. Even though this process of decentralization of politics implies in part more freedom for social movements and citizens as the monopoly of traditional politics wanes, all these forms of subpolitics⁹ are not – by definition – democratic. Especially industry and scientific research work remains more or less a closed world that is increasingly independent and based on its own rationality.

Borrowing from Gunther Teubner, Thomas Mathiesen has talked of a lex vigilatoria of a globalized surveillance and security realm. As the lex mercatoria, its equivalent in the economic sphere, the lex vigilatoria is developed outside the central political institutions and given sanction by parliaments. The lex mercatoria has been developed “through the work of the large and expanding group of professional lawyers operating on the transnational level, tying vast capital interests together in complex agreements furthering capital interests”. Similarly the lex vigilatoria is developed by system functionaries working on “integrated or ‘interlocked’” information systems, which are at the same time “increasingly becoming untied or ‘de-coupled’ from the nation-states”. Decision-making in these arenas becomes “self-referential and self-validating”.¹⁰ Neither political institutions and their democratic organization of policy debate, nor other societal actors gain a meaningful possibility to question them or to have a direct impact on scientific-industrial work. Especially “techno-economic sub-politics” tend to seclude themselves. Already Beck observed¹¹:

Decision-making on techno-scientific development and its economic exploitation, however, escapes the reach of research policy. In relations to the state, industry possesses a double advantage, that of the autonomy of investment decisions and the monopoly on the application of technology. The strings controlling the modernization process in the form of economic planning, of the economic yield (or risk) and of the technological structure in the firms themselves all lie in the hands of economic sub-politics.

However, the term subpolitics also offers a different view on ‘re-politicization’, different from pushing the matter back into the old formal political institutions. Despite its implicit threat of political vacuity, it opens a view on re-politicization which is more decentralized and consists of opening up forms of more active decision making. Within the tendency of decentralization of the political process, impact assessments can be understood as a form of subpolitics. In fact, an ever-accelerating technological evolution makes it increasingly difficult to assess and regulate potential impacts of novel technological projects. As such, impact assessments also reflect the ongoing crisis of policy-making.¹² The complexity of potential consequences and thus the risks are beyond comprehensive regulative instruments such as the law or political decision-making processes. In this respect, one could argue that the use of impact assessments is – at least in part – a method to delegate the power to regulate socio-technological change in an absence of better options. Within a general legal framework with some guiding norms, regulative power is delegated to project developers in order to negotiate solutions specific for the project based on an expertise that goes beyond the mere technological perspective. Elite models, based on highly qualified experts can be differentiated from democratic models, in which the general public plays a significant role.¹³ Depending on how impact assessments are implemented, they become a method to de-politicize decision-making or to organize the political debate around technology and its uses in a more decentralized manner.

When impact assessments are made mandatory as part of public inquiry procedures or as a distinct obligation before implementing a project as in environmentalism, legal rules install a framework for debate. These instruments are tools to produce a certain knowledge, about ‘the environmental effects’ of a project or ‘the impact of the envisaged processing operations on the protection of personal data’, but as this legal framework shows, these tools are primarily political instruments introducing into decision-making a method to deal with the legitimacy of the project and to make decisions more accountable. The legal framework specifies the minimal information to be provided and, as a consequence, also the minimal issues to be considered, and an explicit account of how they will be dealt with. By making consultation of the concerned public obligatory, it gives stakeholders a legal standing to raise questions during the impact assessment or the decision-making process, and forces the project developers and involved experts to answer their concerns.¹⁴ Thus, this legal framework institutionalizes subpolitics to a certain degree. Indeed, the turn to participatory approaches can be seen as an example of democratization in this form of subpolitics.

Understanding impact assessments as subpolitics emphasizes the need to reconsider the relation between knowledge and power or interests. Already the term impact is obviously not a value-free notion but a construction of what is selected as relevant. For instance, while a Privacy impact assessment has a normative focus on privacy, a Surveillance impact assessment focuses on the societal implications of surveillance. Accordingly, “it must address the impacts of a surveillance project not only on privacy, but also on other issues and impacts e.g. social, economic, financial, political, legal, ethical and psychological”. What is actually at stake can thus be defined differently and presumably depends not only upon the project’s application context but also upon the scientific and political standpoint of the expert and the interest of those who initiated the process in the first place.

In the literature impact assessments are mainly presented as tools to produce knowledge for informed decision-making, and are most often conceptualized as risk assessments. Wright points out that they are often described as an “early warning system”¹⁵ and in fact, looking at guideline PIAs, follow core risk assessment procedures.¹⁶ Based on a review of various PIA definitions, Wright and De Hert define the idea of PIA: It “is a process for identifying and evaluating risks to privacy, checking for compliance with privacy legislation and considering ways in which those risks can be avoided or mitigated.”¹⁷ Within various steps of planning, negotiating and documenting, the main focus remains to ‘identify risks and possible solutions.’¹⁸ However, the term risk also presumes a normative horizon and its definition, as Beck pointed out, again has ethical and political implications. “Statements on risk are the moral statements of scientised society”.¹⁹ According to Brian Wynne the notion of risk has meanwhile become “the defining discourse identifying the meaning of public issues concerning scientific research and development”.²⁰ In a “monovalent simple-realist discourse […] the risks, though they may be imprecisely known, have a meaning which is taken for granted, not a political-cultural artefact whose meaning and definition have been (deliberately or not) constructed.”²¹

In respect to its universality the risk discourse forms subjects and cultures, including a hegemonic Western-developed scientific culture, which “implicitly” imposes “saliency or irrelevance of local contextual conditions”. It produces a “standardized model of the citizen”²² as Wynne says, a parochial North-world social type, who either can be at risk or a risk in regard to others. Thus, the question remains: what does the subjection under the standardized risk model imply in regard to impact assessments in the field of data protection, privacy and surveillance? Does it mean following the same preemptive logic as it is known from other areas of risk management? And is the claim that the future present could be governed by assessing a present future needed in order to be justified as a form of subpolitics? Given its scientific appearance the notion of risk may serve to hide the fact that a power struggle always lies at the core of impact assessments, a power struggle that finds its expression in a certain tension between the knowledge that is produced and the interests that take part in the process.

The language of risk provides the framework for how knowledge is produced. The framed knowledge needs a certain quality according to the predefined purpose of the whole assessment action. To structure, inform and thus support decision-making it needs to have a certain stability. The significance of a risk, the probability of its occurrence, and the magnitude of its impact should the risk occur need to be classified in order to be able to measure and seemingly objectify the impact. As early as the 1990s Bennett and Raab recommended “a healthy skepticism” to “any attempt to construct a hard-nosed evaluation of the performance of a data-protection system”²³ and indeed not everything seems quantifiable or classifiable as for example the embarrassment of body searches and profiling, and thus other methods are needed. However, the claim may also confront arguments derived from forms of evaluation other than risk assessments. The aim is to scientifically produce evidence, to come to the most rational or scientifically legitimate conclusion.

However, to get an understanding of the tension between knowledge and power that is at stake here, we can contrast the outcome of a scientific discussion on the one hand with the outcome of a negotiation on the other. A scientific or rational discussion tries to produce knowledge. It confronts arguments and scientifically produced evidence and tries to come to the most rational or scientifically legitimate conclusion. This conclusion can change when new evidence is produced, but there is a clear idea of progress. It is the conclusion which is fits best to the evidence or rational arguments that will be considered the best solution and that will replace the earlier, and now considered faulty, conclusion.

On the other hand, when differing interests are present, there is no best solution. We get a negotiation which can lead to a compromise. Several compromises are possible and depend on the power of the actors around the table to influence the valuation of an impact. And a compromise is not guaranteed. The conflict may remain among the actors. Who counts as relevant actors in an assessment procedure to discern relevant facts and who does not, remains challenging, e.g., given the fact that surveillance is an inherently power-related process with the surveilling party exerting power over the surveilled party. Highly different interests may clash. However, what happens if we mix these two poles of rational discussion and of negotiation? What happens with the production of knowledge in an interest-driven context?

In the context of impact assessment knowledge and power are inextricably linked. Impact assessments produce knowledge, but are also the object or site of a struggle between interests. Trying to single out the knowledge component by making ‘evidence-based’ assessments and excluding mere ‘political beliefs’, is in practice granting a monopoly to experts and locking out broader participation. It implies excluding the public, separating technology from society and thus dismissing science, technology and society as mutual co-evolutionary, generative and open processes that entail different roles and conflicting objectives of participating actors and communities.²⁴ Defining what knowledge is, is in itself an element of power.

Accordingly, stakeholder participation is usually promoted as a method to ensure that a broad range of issues is raised and therefore a wide spectrum of knowledge produced in PIAs as well as in SIAs. As Wright has put it, participation allows discovering risks otherwise not considered. Ignoring these risks or refusing to assess them can lead to liability or sanctions. Stakeholder participation can also be used to assess risk perceptions, “testing the waters” when it comes to acceptance. The overall objective is thus to a make a decision and an investment more “accountable” as well as “robust” in terms of acceptance. This robustness stays weak. The results of this participation remain limited to knowledge about perceptions of stakeholders, without assuring that the concerns of stakeholders are also effectively taken into account.

In general we cannot say that in the PIA and SIA literature the political aspects are ignored, but that it is presumed that the elements of knowledge and power can be separated. This literature considers impact assessments as tools to produce knowledge, and stakeholder involvement has to be legitimized in this context. It seems a mere addition of information and scrutinizing efforts, which can be separated from the conflict of interests. Through this separation of knowledge and politics impact assessments become a tool to de-politicize the issues.

These presuppositions can be questioned. In our view impact assessments are political tools and not just tools to produce knowledge. With this tool issues can be re-politicized and the political debate between stakeholders newly organized. To clarify this we present a typology of impact assessments made by Matthew Cashmore, which presents very well how decisions concerning the purpose of impact assessments and its envisaged outcome frame the role given to public participation and knowledge. This typology helps us to uncover the political aspects present in impact assessments.