The Effect of the GDPR on Privacy Policies

TLDR

The GDPR, effective May 2018, is widely regarded as the most significant data‑privacy reform in two decades and applies to any organization processing EU citizens’ personal data worldwide. This study aims to quantify the GDPR’s impact on privacy policies across the globe. Using the PrivacyCheck mining tool, the authors automatically compared 550 privacy policies before and after the GDPR, and manually examined 450 policies to assess current compliance levels. The GDPR has advanced data protection but still falls short in granting users editing and deletion rights, encourages law‑enforcement data sharing, and non‑compliance is often due to omitted explicit compliance statements, raising concerns about individuals’ control over their PII.

Abstract

The General Data Protection Regulation (GDPR) is considered by some to be the most important change in data privacy regulation in 20 years. Effective May 2018, the European Union GDPR privacy law applies to any organization that collects and processes the personal information of EU citizens within or outside the EU. In this work, we seek to quantify the progress the GDPR has made in improving privacy policies around the globe. We leverage our data mining tool, PrivacyCheck, to automatically compare three corpora (totaling 550) of privacy policies, pre- and post-GDPR. In addition, to evaluate the current level of compliance with the GDPR around the globe, we manually studied the policies within two corpora (450 policies). We find that the GDPR has made progress in protecting user data, but more progress is necessary—particularly in the area of giving users the right to edit and delete their information—to entirely fulfill the GDPR’s promise. We also observe that the GDPR encourages sharing user data with law enforcement, and as a result, many policies have facilitated such sharing after the GDPR. Finally, we see that when there is non-compliance with the GDPR, it is often in the form of failing to explicitly indicate compliance, which in turn speaks to an organization’s lack of transparency and disclosure regarding their processing and protection of personal information. If Personally Identifiable Information (PII) is the “currency of the Internet,” these findings mark continued alarm regarding an individual’s agency to protect and secure their PII assets.