A Three-Year Study of the GDPR and the Consumer

Abstract

This paper presents an empirical study of the General Data Protection Regulation (GDPR) from the consumer perspective. Based on data collected through an online survey questionnaire over a period of three years (2018-2020), we identify trends and patterns among Norwegian consumers. The findings show that the GDPR has not significantly affected consumer awareness, nor level of control over their own personal data. Concerning the enhanced rights of deletion, data portability and access to personal data, the patterns are similar, revealing that most of our respondents 'might execute' their rights. Pertaining to website cookies, most of the respondents are unsure, and the general trend from 2019 to 2020 reveals a greater uncertainty. This paper contributes with new insights for the industry and to the information privacy research field.