Publication | Closed Access
Personal Data and the GDPR: Providing a Competitive Advantage for U.S. Companies
63
Citations
0
References
2019
Year
EngineeringBusiness IntelligenceInformation SecurityU.s. CompaniesLawLegal Aspects Of Data MiningInformation PrivacyBusiness AnalyticsTechnology LawCompetitive AdvantageManagementDisclosureData ManagementPersonal DataMay 2018Privacy ComplianceEconomicsPublic PolicyCompliance (Corporate Governance)Data PrivacyEuropean UnionInformation ManagementPersonalized AnalyticsPrivacy BreachesBusinessData Privacy LawData PortabilityRegulationData Protection
The GDPR, effective May 2018, imposes extraterritorial obligations that threaten U.S. firms with large fines, prompting interest in comparative privacy law and the recent California Consumer Privacy Act, yet the precise scope of data covered by these regulations remains underexplored. This paper aims to delineate the divergent definitions of personal data in the U.S. and EU and to outline five legal strategy pathways for companies regarding data transfer and privacy compliance.
The European Union's General Data Protection Regulation (GDPR) became applicable in May 2018. Due to the GDPR's extraterritorial scope, which could result in massive fines for U.S. companies, comparative data privacy law is of great current interest. In June 2018, California passed its own Consumer Privacy Act, echoing some of the provisions of the GDPR. Despite the many articles comparing the two schemes of law, little attention has been given to the foundation of these laws, that is, what exactly encompasses the data referred to by these laws? By understanding how the term “personal data” or “personal information” is defined in both jurisdictions, and why these definitions and the treatment of protected data are so different, companies can strategize to take advantage of these developments in the European Union. After explaining the differences in how data is treated in the United States and the European Union by exploring the definitions, regulations, and court cases, we will explore the five legal strategy pathways that companies might pursue with respect to the legal aspects of data transfer and privacy law compliance. While these strategies range from ignoring the law to adopting the European model worldwide, this analysis of legal strategy reveals a means for companies to gain a competitive advantage through their adoption of a worldwide compliance scheme.