Firm Responses to the EU’s Data Privacy Requirements

Data analytics have become a key element of the production of goods and services in industries ranging from manufacturing to finance. New data privacy laws can affect the cost of acquiring, storing, and analyzing data, and ultimately raise production costs for firms. In Data, Privacy Laws and Firm Production: Evidence from the GDPR (NBER Working Paper 32146), Mert Demirer, Diego J. Jiménez Hernández, Dean Li, and Sida Peng study how the European General Data Protection Regulation (GDPR), one of the most influential privacy policies to date, has affected firm decisions about data storage and analysis.

The researchers use data from a global cloud-computing provider to measure firms’ demand for data storage and their use of computational resources before and after the implementation of the GDPR. Their dataset includes monthly information from 2015 to 2021 on storage, computation, the prices firms pay for computing and storage, and the location of the data centers from which firms source the services.

The new privacy requirements affected firms in the European Union (EU) but not those in the United States. The researchers find that the GDPR was associated with a decrease in the rate at which EU firms store and process data relative to their US counterparts. Two years after the GDPR was introduced, EU firms were storing 26 percent less data, on average, than comparable US firms. The level of computation performed by EU firms also declined, by about 15 percent, over these two years, suggesting that regulated firms became less data intensive.

The researchers study how much it costs companies to comply with the GDPR by estimating a production function that includes stored data and computation as key inputs. The two are highly complementary, which means that when the cost of data rises, firms cannot easily switch to using more computational resources to make up for more expensive data resources. The researchers estimate that the GDPR increased the cost of data storage by around 20 percent, with substantial variation both within and across industries. Firms in the software industry, which may be more exposed to the GDPR than those in manufacturing, and smaller firms, which may find compliance more costly, experienced significantly higher cost increases. These increases in firms’ data costs translate into roughly 4 percent increases in information production costs.

— Abigail Hiller

The researchers acknowledge the support of the National Institute on Aging, Grant Number T32- AG000186 and the National Science Foundation Graduate Research Fellowship under Grant No. 214106.