Welfare Effects of the EU GDPR and Data Localization Measures

Abstract

It is widely acknowledged that cross-border data flows play a key role in boosting our living standards by utilizing digital trade, artificial intelligence, the internet of things, and big data (to name a few). However, there are also concerns about privacy violations and online security issues. In this vein, data consumer protection has become the center of debates at several international organizations including the OECD, USITC, APEC, and UNCTAD and many countries around the world. As cross-border data flows have increased by more than 45 times over the last decade, many countries including China, Russia, Brazil, India, Indonesia, Vietnam, etc., have introduced their own measures to restrict data flows, also known as “data localization measures” (see Figure 1). Unlike how these countries enacted data localization measures, the European Union decided to effectuate the General Data Protection Regulations. The EU GDPR applies to all firms processing the personal data of data subjects in the EU and also to the processing of personal data of data subjects in the EU by a controller or processor not established in the EU.