Political cleavages and the global privacy regime

Abstract

Since 2000, there was a huge increase in the number of jurisdictions with privacy laws. While some of the jurisdictions had comprehensive laws which covered both the private and public sectors, others had laws which only covered either the public or the private sector. Yet others had independent Data Protection Agencies (DPAs). In addition, some jurisdictions implemented their privacy laws earlier than the rest. Existing political economy models were under-determined to account for the heterogeneity in equilibrium of the global privacy regime. This paper studied the effects of trade in services, and of civil society linkages, between the Schengen area and third-party jurisdictions on the global privacy regime.

Using a newly constructed dataset on the years which jurisdictions implemented their privacy laws, merged with the relevant variables from the Varieties of Democracy (V-Dem) dataset and the World Bank's Ease of Doing Business Index, this paper found that the larger the market share of firms which exported personal data out of the Schengen area after 1997 as part of a jurisdiction's economy, conditional on legislators who valued economic performance, the earlier the jurisdiction was to implement a comprehensive privacy law. In addition, the stronger the presence of privacy rights group in a third-party jurisdiction, conditional on the government being open to influence from the civil society, the earlier the jurisdiction would implement a comprehensive privacy law. The lack of electoral legitimacy of a state had no statistically significant effect on whether a jurisdiction would implement a public sector privacy law.

This paper also found no statistically significant result to support the claim that either-the Data Protection Directive or the General Data Protection Regulation had discriminatory economic effects against foreign firms operating in the Schengen area. The findings of this paper suggested that even in the absence of a legally binding international agreement to protect privacy, jurisdictions with significant market power could unilaterally set privacy laws with extra-territorial reach to re-align multinational firms' interest towards supporting the strengthening of the global privacy regime.