Mapping the Empirical Evidence of the GDPR (In-)Effectiveness: A Systematic Review

Overview

• The paper examines the disconnect between traditional legal and theoretical approaches to data protection and the growing body of empirical evidence in this field.
• It conducts a comprehensive review and synthesis of empirical research on data protection spanning nearly three decades, from 1995 to March 2022.
• The goal is to advocate for a more robust integration of empirical evidence into the evaluation and review of the General Data Protection Regulation (GDPR), and to lay a methodological foundation for future empirical research.

Plain English Explanation

The paper explores the gap between how data protection is traditionally studied and the real-world evidence that has been collected. Much of the academic and regulatory discussions around data protection focus on abstract legal principles or theoretical frameworks, without closely examining the actual impact and perceptions of these policies.

Plain English Explanation of Key Concepts

Over the past few decades, a modest amount of empirical research has been conducted on data protection, but this evidence has remained scattered and underutilized. The paper argues that this empirical data offers vital insights into how data protection measures are perceived, how effective they are, and what their actual effects are. However, these insights have not been adequately integrated into the broader discussions and evaluations of data protection regulations like the GDPR.

To address this gap, the paper conducts a comprehensive review of the empirical research on data protection from the past 27 years. The goal is to synthesize this evidence and use it to inform a more grounded and effective approach to data protection policy and regulation.

Technical Explanation

The paper presents a systematic review and synthesis of empirical research on data protection spanning nearly three decades, from 1995 to March 2022. This extensive analysis aims to bridge the disconnect between traditional legal and theoretical approaches to data protection and the growing body of real-world evidence in this field.

Technical Explanation of Empirical Research Methodology

The review covers a wide range of empirical studies, including surveys, experiments, and observational research, that have explored various aspects of data protection, such as the perception, impact, clarity, and effects of data protection measures. By synthesizing this diverse body of evidence, the paper advocates for a more robust integration of empirical findings into the evaluation and review of data protection regulations, such as the GDPR.

Technical Explanation of GDPR Evaluation and Review

The authors argue that this approach will lead to a more grounded and effective approach to data protection policy and regulation, moving away from the often-abstract legal and theoretical frameworks that have dominated the field.

Critical Analysis

The paper acknowledges several limitations and areas for further research. For example, it notes that the empirical evidence reviewed remains "widely scattered and unexamined," suggesting that more systematic and coordinated efforts are needed to fully understand the real-world impact of data protection measures.

Critical Analysis of Limitations and Future Research

Additionally, the paper does not delve into the potential biases or methodological issues that may be present in the empirical studies it reviews. A more critical examination of the research methods and data sources used in these studies could help strengthen the paper's conclusions and recommendations.

Critical Analysis of Research Methodology and Data Sources

Overall, the paper makes a compelling case for the need to better integrate empirical evidence into the ongoing evaluation and development of data protection regulations. However, a more thorough exploration of the limitations and potential pitfalls of this approach could further strengthen the paper's impact and usefulness for policymakers and researchers in the field.

Conclusion

This paper highlights the significant disconnect between the traditional legal and theoretical approaches to data protection and the growing body of empirical evidence in this field. By conducting a comprehensive review and synthesis of nearly three decades of empirical research, the authors advocate for a more robust integration of real-world data and insights into the evaluation and development of data protection regulations, such as the GDPR.

Conclusion on Implications and Future Directions

Bridging this gap between theory and practice could lead to more effective and evidence-based data protection policies that better serve the needs and concerns of individuals, organizations, and society as a whole. The methodological foundation laid by this paper can also inform and inspire future empirical research in this crucial domain.