other organizations manage data were requested to respond on behalf of two hypothetical clients: a small e-commerce firm with 100,000 user accounts and few overseas accounts; and a large business service provider with 100 million user accounts and operations in various jurisdictions. We received 51 responses to our survey from persons based in 17 different countries. The top countries among our respondents were the United States (43 percent), India (11 percent), Germany and UK (both 7 percent). Half of the respondents were consultants that help other organizations manage their data, while 36 percent were data controllers themselves. The bulk of the respondents (81%) had no foreign ownership, while 13 percent of the respondents had less than 50 percent foreign ownership and 6.38 percent of them had 50 percent or more foreign ownership. The percentage of respondents having more than 500 full-time employees was 41 percent, 17.39 percent of respondents have more than 50 fewer than 500 full-time employees, 19.57 percent of respondents have more than 10 and fewer than 50 full-time employees, and for 21.74 percent respondents, the number of full-time employees is between 1 and 10. Both the survey and the survey results are available online.

We also conducted interviews with a dozen leading experts across the world, in the United States, Europe, Africa, Asia, and Latin America. We promised confidentiality with respect to their identities so that they could advise us freely. We do not rely upon either our survey results or interviews as dispositive. The survey results and interviews have informed our study, but largely to serve as a check on our conclusions.

We highlight one especially costly component of data privacy because it is not limited to any one jurisdiction. Data breaches are expensive to respond to and highlight the need for proper cybersecurity to avoid such breaches. A global study conducted by the Ponemon Institute on behalf of computer hardware developer IBM analyzed breaches involving the loss or theft of customer or consumer records during July 2018 to April 2019.<sup>64</sup> Expenditures on activities and resources enabling the company to successfully detect the severity and reach of a breach had an average cost of $1.22 million.<sup>65</sup> An average of $0.21 million was expended on resources enabling organizations to notify regulators such as the GDPR’s Supervisory Authorities, and affected data subjects of the relevant breach.<sup>66</sup> A Ponemon Institute survey found data breaches to be widespread among the companies surveyed: “About half of the respondents had GDPR data breaches that must be reported to regulators.”<sup>67</sup> This was consistent across the world: “39% of US respondents, 45% of European respondents, 36% of Chinese respondents and 33% of Japanese respondents say they reported a personal data breach to a regulator.”<sup>68</sup>

- A. Compliance Costs for EU Data Protection Law

# 1. Overall Costs of GDPR Compliance

As indicated earlier, estimates for average annual compliance costs for the GDPR range widely, depending on the size of the company, the nature of its business, and other factors. For large firms, the estimates are routinely in the millions of dollars each year. A study conducted in 2019 by the International Association of Privacy Professionals (IAPP) in conjunction with Ernst & Young, a global professional service network, found mean privacy expenditures for the companies at which its survey respondents worked to be $1 million in 2018, the year the GDPR first went into effect, and $622,000

> 64 IBM Security, _Cost of a Data Breach_ (Ponemon Inst. (2019).

> 65 _Id_ .

> 66 _Id._

> 67 Ponemon Institute, _Keeping Pace in the GDPR Race: A Global View of GDPR Progress in the United States, Europe, China and Japan_ 2 (2019).

> 68 _Id_ .

11