# Introduction

<mark>Is privacy a luxury for the rich world?</mark><sup>1</sup> <mark>This paper seeks to understand how much data privacy laws cost to implement and enforce. Relying on industry surveys, government studies, and government agency budgets, this paper compares the costs of private sector implementation and public sector enforcement for the United States, European Union, and, to a limited extent, China. We conclude that data privacy is not outside the reach of the poorer parts of the world, though the rules should be written with differing resources for compliance and enforcement.</mark> <mark>The focus of this project is to help provide the informational base needed to support the practical realization of data privacy protections. Like some other legal domains, data privacy laws are subject to an “enforcement gap”—“that is, a wide disparity between the stated protections on the books and the reality of how companies respond to them on the ground.”</mark><sup>2</sup> <mark>A decade ago, Kenneth Bamberger and Deidre Mulligan observed that “no one has conducted a sustained inquiry into how corporations actually manage privacy and what motivates them.”</mark><sup>3</sup> <mark>Their study helped understand how companies were responding to regulations and enforcement. But even a decade later, we know too little about the costs of compliance or the costs of enforcement. Despite the rapid embrace of laws designed to regulate the use of personally identifiable information, there is a remarkable scarcity of studies of their costs.</mark><sup>4</sup> <mark>The absence of data makes it difficult to assess possible regulatory measures in the area. Some in developing nations may be worried about the costs for small and medium-sized companies of compliance with new regulations. Governments too may also be concerned about the additional costs of enforcement of new laws.</mark> This study begins to fill that lacuna by describing the costs of compliance with data privacy laws for businesses and the costs of enforcement for governments. By focusing on costs, the study should not be read in any way to neglect benefits. A wide array of scholarship and experience has shown that privacy regulations have widespread benefits.<sup>5</sup> Indeed, the Universal Declaration of Human Rights, the International Covenant on Civil and Political Rights, and the Charter of Fundamental Rights of the European Union all declare privacy a fundamental human right.<sup>6</sup> Benefits of data privacy are

> 1 Julia Angwin, _Has Privacy Become a Luxury Good?_ , N.Y. Times, Mar. 4 2014.

> 2 Filippo Lancieri, _Narrowing Data Protection’s Enforcement Gap_ (unpublished manuscript, dated Jan. 2021) (on file with author).

> 3 Kenneth A. Bamberger & Deirdre K. Mulligan, _Privacy on the Books and on the Ground_ , 63 STAN. L. REV. 247, 249 (2011).

4 We discuss the existing studies in Part II below. This paper relies on a number of different sources. The principal sources are the laws and regulations of the United States, the European Union, and China, scholarly and professional studies of the operation of the privacy regimes of these three jurisdictions, and government reporting on budgets in these jurisdictions. We supplemented these sources with both expert interviews and a survey that we designed and circulated.

> 5 Neil M. Richards, _Intellectual Privacy_ , 87 TEX. L. REV. 387, 408 (2008) ( <mark>“The core of intellectual privacy</mark> is <mark>the freedom of thought and belief.”); J</mark> ulie E. Cohen, _What Privacy Is For_ , 126 HARV. L. REV. 1904, 1905 (2013) (arguing that, among other things, privacy is “ <mark>foundational to the practice of informed and reflective citizenship”); Alessandro Acquisti, Curtis Taylor & Liad Wagman,</mark> _<mark>T</mark> he_ _<mark>Economics</mark> of_ _<mark>Privacy</mark>_ <mark>, 54 J. ECON. LITERATURE 442 (2016) (reviewing economic literature on privacy).</mark>

6 Universal Declaration of Human Rights, G.A. Res. 217(III)A, art. 8, U.N.Doc A/RES/217(III) (Dec. 10, 1948); International Covenant on Civil and Political Rights, opened for signature Dec. 16, 1966, S. Exec. Doc. E, 95-2 (1978), 999 U.N.T.S. 171 (entered into force Mar. 23, 1976); Charter of Fundamental Rights of the European Union: 2010 O.J. (C83) 389. Proclaimed by the Commission, 7 December 2000.

2