Regulatory Compliance with Limited Enforceability: Evidence from Privacy Policies

Bernhard Ganglmair (), Julia Krämer () and Jacopo Gambato ()

CRC TR 224 Discussion Paper Series from University of Bonn and University of Mannheim, Germany

Abstract: The EU General Data Protection Regulation (GDPR) of 2018 introduced stringent transparency rules compelling firms to disclose, in accessible language, details of their data collection, processing, and use. The specifics of the disclosure requirement are objective, and its compliance is easily verifiable; readability, however, is subjective and difficult to enforce. We use a simple inspection model to show how this asymmetric enforceability of regulatory rules and the corresponding firm compliance are linked. We then examine this link empirically using a large sample of privacy policies from German firms. We use text-as-data techniques to construct measures of disclosure and readability and show that firms increased the disclosure volume, but the readability of their privacy policies did not improve. Larger firms in concentrated industries demonstrated a stronger response in readability compliance, potentially due to heightened regulatory scrutiny. Moreover, data protection authorities with larger budgets induce better readability compliance without effects on disclosure.

Keywords: data protection; disclosure; GDPR; privacy policies; readability; regulation; text-as-data; topic models (search for similar items in EconPapers)
JEL-codes: C81 D23 K12 K20 L51 M15 (search for similar items in EconPapers)
Pages: 66
Date: 2024-05
New Economics Papers: this item is included in nep-big, nep-eec, nep-law, nep-mac and nep-reg
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (1)

Downloads: (external link)
https://www.crctr224.de/research/discussion-papers/archive/dp547 (application/pdf)

Related works:
Working Paper: Regulatory Compliance with Limited Enforceability: Evidence from Privacy Policies (2024)
Working Paper: Regulatory compliance with limited enforceability: Evidence from privacy policies (2024)
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:bon:boncrc:crctr224_2024_547

Access Statistics for this paper

More papers in CRC TR 224 Discussion Paper Series from University of Bonn and University of Mannheim, Germany Kaiserstr. 1, 53113 Bonn , Germany.
Bibliographic data for series maintained by CRC Office ().