Thread by @garjoh_canuck

🧵What have economists learned from the #GDPR?
I review the literature for a future NBER book on the "Economics of #Privacy" edited by @ce_tucker & @avicgoldfarb. 1/7
nber.org/books-and-chap…

Regulators & researchers seek to balance privacy & the data economy. The EU’s #GDPR is a landmark & influential regulation that defines personal data expansively. GDPR establishes:
-rules for data processing,
-rights for EU residents,
-responsibilities for firms, &
-BIG fines. 2/

#GDPR is hard to study:
A) Finding a suitable control group is hard because the GDPR had global spillovers. E.g., it affects EU firms & non-EU firms serving EU residents.
B) GDPR can screw with personal data: e.g., you may only see data from consenting users. 3/

C) Firm compliance & regulator enforcement is (ahem) variable, because it is legitimately difficult for both sides.
In data-intensive industries, we may then expect low compliance in equilibrium. But, if data thus show little impact, what have we actually learn about GDPR? 4/

On the firm side, the #GDPR literature is mostly bleak.
Research documents harms to profits, revenue, investment, market exit, & entry.
Research also shows harms to competition, the web, & marketing, though more mixed evidence for innovation. 5/

On the consumer side, economists struggle to convincingly measure welfare gains from privacy (it's hard!), but illuminate this with survey, structural, & theory evidence.
Empirical research also shows objective privacy gains through post-GDPR decrease in data processing. 6/

Research illuminates the gap between #GDPR on paper vs. on the ground & the (unintended) consequences of the GDPR’s many elements.
I end by suggesting opportunities for future research on the GDPR as well as privacy regulation & privacy-related innovation more broadly. 7/7

PS: You can also download on SSRN if you prefer.
"Economic research on privacy regulation: Lessons from the GDPR and beyond"
ssrn.com/abstract=42908….

@threadreaderapp unroll please.