The rise of data protection laws is one of the most profound legal changes of this century. Yet, online privacy laws recurrently suffer from a severe enforcement gap—that is, a rather wide disparity between data protection on the books and in action. This raises the question: what accounts for this gap and what can be done to improve the performance of these laws?

This presentation maps out how data protection regimes in the United States and in Europe have been designed to harness a combination of market forces, tort liability and regulatory enforcement to ensure that companies reflect consumers’ privacy preferences. It then argues that these mechanisms are failing to achieve their goals because laws largely ignore how: (i) particularly deep information asymmetries in data collection and processing undermine all three enforcement mechanisms; and (ii) high levels of market power found in data markets allow companies to behave strategically to protect private interests and undermine legal compliance.

The conclusion leverages on the experience of antitrust and anti-fraud regimes to argue that an effective online privacy regulatory system should be built around three key principles. First, the system must multiply monitoring and enforcement resources, and antitrust demonstrates how litigation can fund sophisticated civil-society intermediaries that safeguard consumers. Second, the system must bring violations to light, and anti-fraud policies demonstrate the importance of establishing effective whistleblower programs for data protection. Third, the system must increase governmental accountability, and antitrust provides examples on how to promote public transparency without sacrificing enforcement capacity.

Biography

Filippo Lancieri is a Fellow in The George J. Stigler Center for the study of the Economy and the State, UChicago Booth and JSD Candidate, University of Chicago Law School.