An Economic Analysis of Personal Data Protection Obligations in the European Union

The collection, storage and processing of data have become easier and cheaper with the development of the Internet and the evolution of ICT technologies in general. This may be a cause (or a consequence) of new business models that rely on the exploitation of these stored data in order to try to extract some kind of value. If some value is found in personal data and in its processing in large volumes, this value would increase social welfare. In order for the value of an asset to be appraised, entrepreneurial activity is required. This is process of trial and error which may be hindered by regulation, due to the limits that this imposes on economic activity, for different reasons. In the European Union, the 1995 Data Protection Directive, the ePrivacy Directive and the more recent General Data Protection Regulation put limits to the exploitation of personal data. These limitations can be synthetized around the four rights that they grant individuals, the so-called ARCO rights: access, rectification, cancellation and objection. In this paper, the consequences of the data protection rights on entrepreneurial activity are analysed, and thus on the value that may be accrued from data related to individuals, and on social welfare. As a conclusion, some policy recommendations are proposed to achieve a balance between legal rights in the EU and possibilities for social welfare improvement.