Enforcement Discretion in Tech Policy: A fuzzy-set qualitative comparative analysis (fsQCA) across data protection authorities post GDPR

Abstract

This paper examines how tech regulators apply their discretion in policy enforcement. Studies on the growing role of the state in governing risks from technology and the difficulty to design policies to control unintended consequences do not usually consider policy enforcement processes, that shape how policies come to life and potentially create regulatory arbitrages for firms. To answer these gaps, this paper builds a novel typology to measure and compare policy enforcement discretion. Based on survey responses from 18 Data Protection Authorities (DPAs), interviews, and secondary sources, this study clusters regulatory agencies based on their captured enforcement strategies, analyzes cross-national variations in enforcement discretion, and investigates misalignments between enforcement strategy and actions. Using fuzzy set Qualitative Comparative Analysis (fsQCA), this study tests how bureaucratic and political contexts – organizational capacities, budget sources, and issue saliency – impact enforcement choices and direct tech policy enforcement. I find that almost half of studied agencies reflect highly deterrent strategy, but for many, lack of resources and expertise inhibits the translation of strategy into practice. This study provides a starting point for understanding the national impacts of EU’s General Data Protection Regulation (GDPR) and adds empirical support for theorizing about enforcement strategies in the age of promising privacy laws on paper. By highlighting an often-neglected aspect in the way technology outpaces the law, this study shows how privacy gatekeepers are far from being equipped for their mission, creating regulatory arbitrage for firms across Europe.

Keywords: Policy Implementation, GDPR, National Enforcement Styles, Europeanization

JEL Classification: privacy, public policy, european union, enforcement styles