Abstract:General Data Protection Regulation (GDPR)—the European Union’s data protection regulation—has two key principles. It recognizes that individuals own and control their personal (but not contractual) data in perpetuity, leading to three critical privacy rights, namely, the rights to (i) explicit consent (data opt-in), (ii) to be forgotten (data erasure), and (iii) portability (data transfer). It also includes data security mandates against privacy breaches through unauthorized access. We study GDPR’s equilibrium impact by including these features in a dynamic two-period model of forward-looking firms and consumers. Firms collect consumer data for personalization and price discrimination. Consumers trade off gains from personalization relative to potential losses from privacy breaches and price discrimination in their purchase, data opt-in, erasure, and transfer decisions. Though data security mandates impose fines on firms for privacy breaches, firms can benefit from higher opt-in given lower breach risk. Surprisingly, data security mandates can hurt consumers. The effect of privacy rights is nuanced. Since the right to opt in separates goods exchange from the provision of personal data, it prevents market failure under high breach risk. But it also reduces consumer opt-in and personal data availability. Erasure and portability rights reduce consumers’ hold-up concerns by disciplining firms to provide ongoing value by limiting price discrimination and not slacking off on data security; but they also reduce the incentive to offer lower initial prices that encourages opt-in. Overall, privacy rights always benefit consumers in competitive markets, but they can surprisingly hurt consumers under monopoly, as monopolists have less incentives to subsidize consumer opt-in. They raise (reduce) firm profit and social welfare when breach risk is high (low). Finally, privacy rights increase firm profit most at moderate levels of data transferability. This paper was accepted by Dmitri Kuksov, marketing. Funding: T. T. Ke acknowledges financial support from the General Research Fund of the Hong Kong Research Grants Council [Grant 14500421]. Supplemental Material: The e-companion is available at https://doi.org/10.1287/mnsc.2022.4614 .

A Noxious Market for Personal Data

Beyond Data Ownership

A vision for global privacy bridges: Technical and legal measures for international data markets

Ownership of User-Held Data: Why Property Law Is the Right Approach

Data Privacy: from Transparency to Fairness

Data Pricing Mechanism Based on Property Rights Compensation Distribution

Locked-in Data Production: User Dignity and Capture in the Platform Economy

Personal Data Gentrification

Patient data ownership: who owns your health?

Big Data and Digital Markets Contestability: Theory of Harm and Data Access Remedies

Legal Responses to the Commodification of Personal Data in the Era of Big Data: The Paradigm Shift from Data Protection towards Data Ownership

Is Data Ownership Empowerment Welfare-Enhancing?

Personal data management and accountability: European regulation, market principles and civic agency strategies

Reconciling the Conflicting Goals of Privacy Protection and Competition Policy Through Making Platform Use Data Saleable – an Institutional Perspective on Data Markets

Who Should Own the Data? the Impact of Data Ownership Shift from the Service Provider to Consumers.

Own Data? Ethical Reflections on Data Ownership

How should we think about clinical data ownership?

Privacy Rights and Data Security: GDPR and Personal Data Markets

DATA OWNERSHIP: A MISTAKEN PERSPECTIVE TO PROTECTION OF DATA PRIVACY

Measuring Lay Reactions to Personal Data Markets

Willing Buyer, Willing Seller: Personal Data Trade as a Service