Regulating the European Data‐Driven Economy: A Case Study on the General Data Protection Regulation

Abstract

In recent years, data have become part and parcel of contemporary capitalism. This created tensions between the growing demand for personal data and the fundamental right to data protection. Against this background, the EU's adoption of the general data protection regulation (GDPR) poses a puzzle. Why did the EU adopt a regulation that strengthens data protection despite intensive lobbying by powerful business groups? We make two arguments to explain this outcome. First, we use process tracing to show how institutional legacies triggered and structured the policy-formulation process by strengthening the position of data protection advocates within the Commission. Second, we use discourse network analysis to show that the Snowden revelations fundamentally changed the discursive and coalitional dynamics during the decision-making stage, 'saving' the GDPR from being watered down. Our paper contributes to the literature on the political economy of data protection while also offering a comprehensive explanation of the GDPR. * Earlier versions of this article were presented at the European University Institute and at the 2019 GIG-ARTS conference in Salerno. We would like to thank all participants for their helpful feedback. We are particularly grateful to Camille Borrett, Clément Perarnaud and Martin Weinrich for their detailed comments and suggestions. In addition, we would like to thank Alexander Dix and Christopher Kuner for taking the time to answer our questions and lending us their expertise. Replication materials can be found online at https://www.timoseidl.com/publications/regulatingthe-european-data-driven-economy/

A step back to look ahead: mapping coalitions on data flows and platform regulation in the Council of the EU (2016-2019)

“…Among the digital like-minded group, negotiators from the most digitally advanced member states appear prominent (Sweden,Denmark,Finland,Estonia, ed by Google, which invited member states considered as digital front-runners to coordinate their action "at both political and policy levels […] for true digitization success and to communicate their strong commitment to the execution of the digital agenda" (Alm et al, 2016). This development illustrates the indirect lobbying channels that corporate actors can use to secure influence in relation to the DSM, in addition to their more traditional repertoire of actions at the EU level (Laurer & Seidl, 2020;Christou & Rashid, 2021).…”

“…The literature has acknowledged the increasingly active role of the EU in internet policies, as illustrated by recent regulatory and policy initiatives in the fields of data governance (Borgogno & Colangelo, 2019), privacy (Ochs et al, 2016;Bennett & Raab, 2020;Laurer & Seidl, 2020), copyright (Meyer, 2017;Schroff & Street, 2018) and cybersecurity (Christou, 2019). Recent research has also investigated the nature and determinants of a 'European approach' in regulating large internet companies and safeguarding competition (Radu & Chenou, 2015), in balancing competing policy objectives such as national security and data protection (Dimitrova & Brkan, 2018), or in promoting its 'digital sovereignty' (Pohle & Thiel, 2020).…”

Why and how does the regulation of emerging technologies occur? Explaining the adoption of the EU General Data Protection Regulation using the multiple streams framework

“…The case is, therefore, appropriate for uncovering the different actors and activities involved in the policy process. Further, as several studies have provided an account of the regulation based on explanations such as technological change, interests, institutionalism, and policy entrepreneurship (Burri & Schar 2016;Moulonguet 2016;Rossi 2018;Hildén 2019;Kalyanpur & Newman 2019;Laurer & Seidl 2020), a study of the GDPR is apt for investigating whether the MSF can go further and provide a more complete explanation for the formulation and the adoption of the regulation.…”

“…As a result of that legislation, data protection authorities were established in all member states and the institution of "Article 29 Working Party" (WP29) was created to ensure uniform application of the DPD (European Union 1995). The WP29 was instrumental in the insertion of data protection in the EU Fundamental Rights Charter and in the Treaty of Lisbon (Laurer & Seidl 2020). Moreover, Laurer and Seidl (2020) found that several new instruments of the GDPRincluding data protection by design, the accountability principle, and the creation of the European Data Protection Boardhad their origin in the proposal made by the WP29 in its 2009 opinion to the Commission.…”

The Personal Data Protection Mechanism in the European Union

“…Improved methods of data mining, increasing volume of publicly available data have expanded the scope of the EU Data Protection Directive (Van Loenen, Kulk and Ploeger, 2016). "Data have become part and parcel of contemporary capitalism" (Laurer and Seidl, 2020). At the same time, the legislation on personal data protection remains underdeveloped, which requires a revision of the concept of personal data protection (Van Loenen, Kulk and Ploeger, 2016).…”