Privacy Discrimination Under GDPR

Abstract

Data protection and privacy rights afforded to consumers by General Data Protection Regulation (GDPR) have presented a challenge to the firms that depend on private consumer data for targeted pricing, product recommendations and other purposes. Specifically, GDPR affords consumers the right to not share any data or get past data erased and get a fresh start with the firm. Using a simple analytical model that captures the benefits of data sharing and the privacy concerns for the consumers, we show that GDPR can actually benefit firms. In particular, there are conditions under which both firm and consumer surplus as well as the amount of data collection increase under GDPR. The key insight is that GDPR serves to differentiate consumers based on their dis-utility for sharing data (privacy sensitivity). The optimal equilibrium strategy for the platform is to increase the data collection on those that have low privacy sensitivity, give them better recommendations but charge higher prices. At the same time, collect no or little data for highly price-sensitive consumers who exercise the GDPR right. It is optimal for the firm to provide poor product recommendations to users who exercise the GDPR rights to discourage them from exercising these rights. Overall, the results show that there are beneficial effects of GDPR to firms particularly in markets where consumers care about privacy a lot.

Keywords: General data protection regulation, GDPR, data privacy, price discrimination, privacy discrimination, product recommendation

JEL Classification: M30, M31, M37, M38, M21, M15