Promise Not Fulfilled: Fintech Data Privacy, and the GDPR

Abstract

This article analyzes how the General Data Protection Regulation (GDPR) has affected the privacy practices of FinTech firms. We study the content of 308 privacy statements respectively before and after the GDPR became binding. Using textual analysis methods, we find that the readability of the privacy statements has decreased. The texts of privacy statements have become longer and use more standardized language, resulting in worse user comprehension. This calls into question whether the GDPR has achieved its original goal-the protection of natural persons regarding the processing of personal data. We also analyze the content of privacy statements and link it to company-and industry-specific determinants. Before the GDPR became binding, more external investors and a higher legal capital were related to a higher quantity of data processed and more transparency, but not thereafter. Finally, we document mimicking behavior among industry peers with regard to the data processed and transparency. JEL-Codes: K200, L810.

<div> Does Privacy Regulation Harm Content Providers?&nbsp; </div> <div> <br> </div> <div> A Longitudinal Analysis of the Impact of the GDPR </div>

“…However, Degeling et al (2019) found that while most websites adjusted their privacy policies and implemented consent mechanisms in the months immediately following GDPR enforcement, some did not comply and did not provide users with means to meaningfully consent to tracking. Dorfleitner et al (2021) found that the readability of privacy policies for German financial technology firms decreased after the GDPR, while their length and the quantity of data processed increased. Sanchez-Rola et al (2019) found that, despite the presence of the opt-out mechanism, it was still difficult for users to avoid being tracked.…”

Fin-tech Regulations Development, Challenges, and Solutions : A Review

“…The security and safety of a person and his or her data is very much at risk. Though there are laws like General Data Protection Regulation [GDPR] which was created to deal with these kinds of risks however, these laws are governing an entity communicating with Europe (Dorfleitner et al, 2021). Though India is bringing in Digital Personal Data Protection Bill, 2022, however, it is not passed in the Parliament yet.…”

Human factors in cybersecurity: Navigating the fintech landscape

“…In the context of cybersecurity, the literature emphasizes the importance of data security, customer trust, and user design interface in influencing the adoption of Fintech (Stewart & Jürjens, 2018). Additionally, the theoretical construct for future Fintech industry development should ensure sound security mechanisms based on observed security and privacy concerns and their solutions (Dorfleitner et al, 2021). Moreover, the effects of trust, security, and privacy are crucial in understanding the pattern of adoption, indicating the significance of these factors in shaping user behavior (Shin, 2010).…”