A case against the General Data Protection Regulation

The effects of the European Union's General Data Protection Regulation (GDPR) will spread beyond the EU. Since the requirements cover all data collected from EU citizens, American corporations that do business in the EU or with EU partners will have to comply with the GDPR. Changing data collection, sharing, and analysis processes places significant financial burdens on business. For example, businesses cannot transfer an individual’s data out of the EU unless they have obtained explicit consent and have put adequate safeguards in place to ensure the security of transfer. Furthermore, they have to promptly notify citizens in case of a breach and allow sharing of data between entities upon request of an individual. While GDPR is widely perceived as a major step forward, it is not yet clear how much of a meaningful impact it would have on consumers’ privacy and whether it will ultimately lower the cost and raise the quality of the services they receive. GDPR could increase the cost of the services that consumers are so used to receiving free of charge.