budget of $13.2 million in 2018, rising to $13.6 million in 2019.<sup>60</sup> Estimates for compliance with U.S. privacy law are wide-ranging, but generally significantly lower.

The review below shows that compliance with the GDPR for large firms is quite expensive. Our survey respondents generally ranked the EU privacy regime to be the costliest of the three frameworks. They described the US as less expensive, whether for large or small firms, and compliance with Chinese privacy law as the least expensive, though that may be because of lack of awareness of the law. Among our respondents, cybersecurity costs seemed to be more significant with respect to Chinese and U.S. law compliance, than with EU law compliance. EU compliance costs seem to be heavily skewed towards personnel, both inhouse personnel and outside consultants.

As the wide ranges might suggest, the data is inherently limited. There is no consistent framework for analyzing the costs of compliance with data privacy laws. Every study seems to adopt its own methodology. One study, for example, breaks down costs as consisting of 1) the costs of granting access to data gathered on each consumer, 2) the costs of providing notice of privacy policies, 3) the costs of obtaining individual consent, 4) the costs of creating greater transparency, and 5) the costs of granting customers choice, including that of opting out or opting in to the database.<sup>61</sup> Another study meanwhile identifies the following components of data privacy costs: data protection and enforcement activities, incident response plans, compliance audits and assessments, policy development, communications & training, staff certification, redress activities, investments in specialized technologies to protect data assets such as threat intelligence, managed file transfer, identity and access governance, cyber analytics, data loss prevention, and encryption.<sup>62</sup> The studies are based on surveys of selected participants, which of course reflect who is invited to take them and who actually completes them.

Furthermore, any study of costs is necessarily incomplete. Privacy law also affects firms in ways that are difficult to quantify. If a firm decides not to offer a feature or decides not to enter a jurisdiction because of privacy law, the opportunity foregone is difficult to value. Little information is available on the costs of restructuring of operations by businesses to bring them into compliance.

We conducted a survey among privacy experts to seek to obtain information about the costs of compliance for private enterprises.<sup>63</sup> The survey was circulated to members of the International Association of Privacy Professionals, and was also circulated by leading privacy expert Daniel Solove to his LinkedIn network. We also emailed the survey to privacy lawyers we identified via web searches and through LinkedIn. The survey was open for responses from June 18 to August 3, 2020. The survey was posted to the web via Qualtrics and was available only to those that had the link. Various biases introduced by a web-based survey both suggest caution in relying on its results, and we do not rely on the survey results for our conclusions in this paper.

The questionnaire asked privacy professionals to indicate whether they worked at companies that largely collect data on those companies’ own behalf, or companies that help other organizations manage their data. It tailored most of the remaining questions based on the answer to that initial query. The questions focused on the costs of complying with the privacy regimes of the three jurisdictions that are the focus of this study, the impact of those regimes on decisions by companies, and questions about cross-border data flows. To help provide consistency of responses, privacy professionals helping

> 60 _See infra_ note 69 and accompanying text.

> 61 Christopher J. Robertson & Ravi Sarathy, _Strategic and Ethical Considerations in Managing Digital Privacy_ , 46 J. Bus. Ethics. 111, 120 (2003).

> 62 <mark>Ponemon Institute,</mark> _<mark>The True Cost of Compliance with Data Protection Regulations</mark>_ <mark>5 (Dec. 2017),</mark> <u><mark>https://dynamic.globalscape.com/files/Whitepaper-The-True-Cost-of-Compliance-with-Data-ProtectionRegulations.pdf.</mark></u>

> 63 <mark>The complete survey and its results are posted here. https://drive.google.com/file/d/1CwzneOtePmmj0kZt7HBF-bxRkVfsORYc/view?usp=sharing.</mark>

10