difficult to quantify outside clear invasions like identity theft.<sup>7</sup> Not only does data privacy have enormous benefits for individuals, it helps companies build and maintain the trust of both their users and their business partners. Indeed, understanding the costs of compliance and enforcement will better enable developing countries to design their laws and enforcement structures.

<mark>Understanding the costs of compliance and enforcement is critical to both designing laws and to enforcing them. Across the world, nations are establishing data privacy rules.</mark><sup>8</sup> <mark>The datafication of the economy means that few companies or individuals are untouched. Laws regulating the use of personally identifiable data are a necessary foundation of the digital economy. Companies are collecting data at an unprecedented rate, as computers mediate more and more of our lives. Laws help prevent abuse and thus help build trust as individuals interact in an increasingly digitized world. Data privacy is a necessity not just in richer nations, but in poorer ones as well.</mark> <mark>Achieving data privacy presents special challenges in the developing world—both for companies and governments. Micro, small and medium-sized companies may lack the resources to ensure compliance with complicated laws. If compliance is too expensive, businesses will simply ignore the law or avoid the jurisdiction altogether. Governments, their resources already stretched, may not be able to devote sufficient resources for privacy enforcement.</mark> <mark>Data privacy is also increasingly critical to international trade. As data travels across the world, governments and individuals seek to ensure that privacy protections travel alongside. At the same time, data regulations can be used to disfavor foreign service providers; data regulations that mandate data localization impose special costs.</mark><sup>9</sup> <mark>We focus here on three specific data privacy regimes, the European Union, the United States, and China. Because of their large economies, these data privacy regimes have global influence. The study seeks to elaborate and quantify the costs of data regulations, recognizing the limitations of the data available. Because the European Union’s General Data Protection Regulation (“GDPR”) and various U.S. laws have been in place already, we can illuminate the experience of companies in complying with those laws. We also describe the costs of enforcement.</mark> <mark>This paper proceeds as follows. Part I begins by briefly characterizing three of the major data protection regimes--the United States, the European Union, and China. Part II then describes the costs of private sector compliance with respect to each of these three regimes. Part III turns to the costs of public enforcement, again for these three different jurisdictions. Part IV concludes by drawing some lessons, focusing on developing countries.</mark>

# I. Three Approaches to Data Privacy: EU, US, and China

We focus on three principal jurisdictions in this study, the European Union, the United States, and China. The rules in each of these jurisdictions have evolved significantly in recent years and continue to evolve so any account of their costs inevitably describes a moving target. In order to better

> 7 While certain harms of data abuse are more readily calculable—such as those for identity theft—the harm from many data violations can be hard to assess. Thus, the full benefits of data protection are difficult to quantify. When describing the impact of a change to HIPAA rules in 2013, the Department of Health and Human Services noted, “We are not able to quantify the benefits of the rule due to lack of data and the impossibility of monetizing the value of individuals’ privacy and dignity....” Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules, 78 FED. REG. 5566, 5567 (Jan. 25, 2013) (to be codified at 45 C.F.R. pts 160 & 164). 78 FED. REG. 5567.

> 8 UNCTAD Cyberlaw Tracker, <u>https://unctad.org/en/Pages/DTL/STI_and_ICTs/ICT4DLegislation/eCom-Data-Protection-Laws.aspx.</u>

> 9 Anupam Chander & Uyên P. Lê, _Data Nationalism_ , 64 EMORY L. J. 677 (2015).

3