Regulatory Spillovers and Data Governance: Evidence from the GDPR

Peukert, Christian; Bechtold, Stefan; Batikas, Michail; Kretschmer, Tobias

doi:10.1287/mksc.2021.1339

Cited by 101 publications

(53 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Actually implementing resilience is not the same as proposing its existence, akin to calculating risk and actually managing it. The choice of tools depend on which type of defence is needed 22 What matters is whether the resilience is anchored by the practical failure tolerance/recovery/preventive systems, have redundancy in the form of backup servers does not matter if the adversary also has hit them with ransomware, or if they keep on initiating attacks on the basis of errors in IoT equipment which the manufacturer is never going to patch. It is therefore paramount to understand resilience as a constant level of readiness, not as an attribute that can be put into a system and then abandoned.…”

Section: Resiliencementioning

confidence: 99%

“…This paper does not pretend to be able to show all possible principles which could be used to regulate security, but we have selected a big handful which cover contested topics, and which the EU is uniquely placed to regulate due to the Brussels effect [11,22]. These take security and the users' seriously, and at the same time offer quite realistic and direct alternatives to the lax structure which exists currently.…”

Section: Principlesmentioning

confidence: 99%

See 1 more Smart Citation

The Opportunity to Regulate Cybersecurity in the EU (and the World): Recommendations for the Cybersecurity Resilience Act

Ludvigsen¹,

Nagaraja²

2022

Preprint

View full text Add to dashboard Cite

Safety is becoming cybersecurity under most circumstances. This should be reflected in the Cybersecurity Resilience Act whenever it is proposed and agreed upon in the European Union. In this paper, we define a range of principles which this future Act should build upon, a structure and argue why it should be as all encompassing as possible. We do this on the basis of what the cybersecurity research community for long have asked for, and on what constitutes clear hard legal rules instead of soft. Important areas such as cybersecurity should be taken seriously, by regulating it in the same way we see other types of critical infrastructure and physical structures, and be uncompromising and logical, to encompass the risks and potential for chaos which its ubiquitous nature entails.We find that principles which regulate cybersecurity systems' life-cycles in detail are needed, as is clearly stating what technology is being used, due to Kirkhoffs principle, and dismissing the idea of technosolutionism. Furthermore, carefully analysing risks is always necessary, but so is understanding when and how the systems manufacturers may fail or almost fail, all of these details must be expected and detailed. We do this through the following principles:Ex ante and Ex post assessment, Safety and Security by Design, Denial of Obscurity, Dismissal of Infallibility, Systems Acknowledgement, Full Transparency, Movement towards a Zero-trust Security Model, Cybersecurity Resilience, Enforced Circular Risk Management, Dependability, Hazard Analysis and mitigation or limitation, liability, A Clear Reporting Regime, Enforcement of Certification and Standards, Mandated Verification of Security and Continuous Servicing.To this, we suggest that the Act employs similar authorities and mechanisms as the GDPR, and create strong national authorities to coordinate inspection and enforcement in each Member State, with ENISA being the top and coordinating organ. 1

show abstract

Section: Resiliencementioning

confidence: 99%

Section: Principlesmentioning

confidence: 99%

The Opportunity to Regulate Cybersecurity in the EU (and the World): Recommendations for the Cybersecurity Resilience Act

Ludvigsen¹,

Nagaraja²

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Several other papers have studied the impact of the GDPR in other domains Wagman, 2018, 2020;Zhuo et al, 2021;Utz et al, 2019;Degeling et al, 2018). Peukert et al (2022); Johnson, Shriver and Goldberg (2020) show that GDPR increased market concentration amongst web technology services. Goldfarb and Tucker (2011);Johnson, Shriver and Du (2020) study the effectiveness of previous data privacy regulations on online advertising.…”

Section: Consequences Of Data Privacy Regulationmentioning

confidence: 99%

“…A prevalent theme in the economics of privacy literature consistently finds a privacy paradox -the apparent inconsistency between individual's strong stated preferences for privacy and their willingness to give away personal information at little cost(Acquisti, Taylor and Wagman, 2016). This directly implies that a natural hypothesis is that consumers may ask legislators for such privacy means but, ultimately, make little use of them.8 This concern has been raised in the recent literature(Johnson, Shriver and Goldberg, 2020;Peukert et al, 2022) and the popular press (Wall Street Journal -GDPR Has Been a Boon for Google and Facebook. Retrieved on June 2nd, 2020) which show that GDPR led to an increase in market concentration of web trackers, favoring those from Google and Facebook.…”

mentioning

confidence: 99%

The Effect of Privacy Regulation on the Data Industry: Empirical Evidence from Gdpr

2020

View full text Add to dashboard Cite

“…For individual users, privacy concerns could be reduced if tracking by Facebook outside of its own platform could easily be avoided by quitting Facebook or by visiting websites without engagement buttons. While recent privacy regulations and industry changes have made third party tracking more difficult (Johnson, Shriver & Goldberg 2020, Peukert et al 2022, the reality of tracking remains much the same. Legal ascertainment of consumer consent has become more robust over time but consumers effectively still do not know they consented or have little choice.…”

Section: Introductionmentioning

confidence: 99%

Facebook Shadow Profiles

Aguiar¹,

Peukert²,

Schäfer³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Data is often at the core of digital products and services, especially when related to online advertising. This has made data protection and privacy a major policy concern.When surfing the web, consumers leave digital traces that can be used to build user profiles and infer preferences. We quantify the extent to which Facebook can track web behavior outside of their own platform. The network of engagement buttons, placed on third-party websites, lets Facebook follow users as they browse the web. Tracking users outside its core platform enables Facebook to build shadow profiles. For a representative sample of US internet users, 52 percent of websites visited, accounting for 40 percent of browsing time, employ Facebook's tracking technology. Small differences between Facebook users and non-users are largely explained by differing user activity.The extent of shadow profiling Facebook may engage in is similar on privacy-sensitive domains and across user demographics, documenting the possibility for indiscriminate tracking.

show abstract

Regulatory Spillovers and Data Governance: Evidence from the GDPR

Abstract: Privacy regulation by the European Union has had effects for websites beyond the European Union and lead to an increase in market concentration of web technology vendors

Cited by 101 publications

References 44 publications

The Opportunity to Regulate Cybersecurity in the EU (and the World): Recommendations for the Cybersecurity Resilience Act

The Opportunity to Regulate Cybersecurity in the EU (and the World): Recommendations for the Cybersecurity Resilience Act

The Effect of Privacy Regulation on the Data Industry: Empirical Evidence from Gdpr

Facebook Shadow Profiles

Contact Info

Product

Resources

About