Understanding the Impacts of Data Privacy Regulation on Firm Performance

Abstract

More and more privacy regulations are being introduced around the world. These regulations are intended to protect the consumers, but how they impact firms that must adhere to and implement such regulations is not yet well understood. Essay 1 synthesizes the evolution of data privacy regulations, according to a comprehensive taxonomy and defines 12 distinct legal elements, which can be grouped into control, transparency, and data-restricting categories. The time dynamics of these evolutions indicate increasingly strict privacy regulations. On the basis of these insights, the essay introduces an integrated conceptual model and ten propositions, illustrated with business cases, that can help managers operate strategically and effectively in strict regulatory, big data environments. Essay 2 proposes a conceptual framework of the likely effects on firm performance grounded in the control paradox theory. The results of tests of the proposed framework with two global and two single-country samples suggest a negative overall impact of data privacy regulations on firm performance. The severity of this effect depends on features of the regulation and firm data management strategies. Regulation control requirements, a firm’s robust privacy reputation, and larger firm sizes can alleviate harmful effects. Regulation transparency requirements, a firm’s privacy negligent practices, and firm lobbying enhance the adverse impacts. Instead, negative implications are enhanced for firms that violate consumer privacy and lobby. The paper provides insights for improving managerial and policy strategies.