Taking into account the state of the art , the cost of implementation and the nature , scope , context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing , the controller shall ,