Data Privacy Laws and Economic Consequences

 The growing development and widespread use of the internet and new technologies have brought dramatic changes to the way individuals and businesses interact and how transactions are conducted. We live in a digital economy where people and objects communicate constantly thanks to rapid interconnection, a situation that allows for the transmission and reception of enormous amounts of information at very low cost. This has enabled companies to exploit data on a massive scale, generating added value and innovating in ways that once seemed unthinkable; however, Data Privacy Laws and Economic Consequences must now be carefully considered, as they shape how data can be used and influence the broader economic landscape.

In this context, personal data that is, information related to an identified or identifiable natural person is one of the most controversial assets, as it allows companies to improve their services but also to use said information in ways that potentially conflict with the human right to privacy, protected in numerous international treaties and enshrined in Article 19, paragraph 4, of the Political Constitution of the Republic of Chile. The main problem is that, as technology improves and expands exponentially, market dynamics are continually changing, creating uncertainty and making it difficult to establish.

Defining Data Protection and Its Significance

Image Source: Freepik.com

Efficient mechanisms to regulate the processing of personal data while simultaneously ensuring the protection of the data subjects' right to privacy. Personal data regulation is currently a hot topic in international debate, a subject of multiple amendments around the world. Its most audacious regulatory proposal is the European Union's most recent regulation, the General Data Protection Regulation, in force since May 2018. This regulation extends its scope of application even to companies outside the European Union, provided they process personal data belonging to EU residents for the provision of goods or services (no payment required) or monitor their behavior within that territory.

Chile is not exempt from this debate. On June 16, 2018, the government published Law 21,096, which elevated personal data protection to the status of a constitutional guarantee. Added to this is the current draft law, which consists of a consolidated text that seeks to substantially amend Law 19,628 and, among other matters, creates the Personal Data Protection Agency (Bulletin 11,144-07). Given this scenario, this article seeks to analyze various mechanisms for regulating personal data protection from the perspective of economic analysis of law. To do so, we must first determine whether the data subject can waive the right to privacy and, consequently, the right to personal data protection, and under what conditions such a waiver would be valid.

Convergence of Legal and Economic Perspectives

Image Source: Freepik.com

IIf we conclude that this right is alienable, we will then determine whether to recognize property rights over it in order to enable data subjects to derive pecuniary benefits from their personal information. If we accept that the right is not fully available due to the presence of a public interest, the next step is to identify regulatory mechanisms—through the lens of economic analysis of law—that more effectively balance economic growth in the digital age with the adequate protection of the right to privacy and personal data, while recognizing that these tools impact both individuals and society.

Within this context, the objective of this article is to demonstrate that restricting the analysis to the granting of individual consent is not a sufficient criterion to remedy existing market failures. Thus, this research paper will describe the market in general terms and highlight its unique characteristics, define the concept of personal data, examine its usage, identify the market participants, and outline the relevant products or services they provide. It will then identify existing market failures in order to understand the areas that the regulator must address when regulating.

Objectives and Scope of the Blog

Image Source: Freepik.com

The study will then examine the right to privacy from an economic perspective, analyzing whether it constitutes a quasi-private or public good and exploring the resulting implications, which make it a complex legal interest to protect. Finally, it will examine some of the mechanisms that address these market failures, distinguishing between ex ante and ex post mechanisms depending on whether the harm caused by the disclosure of personal information has actually occurred. On the one hand, we will conclude that, in the long term, the most appropriate intervention.

Law 19.628, Article 2, letter f), defines personal data as any information that identifies or can be associated with a specific person. The OECD and the General Data Protection Regulation both define identifiable or identified individuals as those whose data allows for their identification. Therefore, we define personal data as information that organizations can link to a specific individual, unlike anonymous data, which they cannot associate with any person. Organizations collect personal data through various methods. According to the World Economic Forum, individuals may voluntarily provide it, organizations may observe it during sign-up processes, or analysts may infer it from existing data (WEF, 2011: 13).

Conclusion

Image Source: Freepik.com

Personal data may be sensitive depending on its qualities. Personal information according to Law 19.628 (Article 2, letter g) means facts or circumstances of someone’s private or intimate life like their habits, race, beliefs, political opinions, religion, health and sexual life. This kind of information can easily breach the main rights of its holders, so it has a special set of laws protecting it. "Article 10 of Law 19.628 states that entities may process data only when a law mandates it, the data owner grants permission, or it is necessary to evaluate or authorize health resources for the owner.

Given the significance of personal data, one must recognize that the concept of personal data itself inherently defines the scope of its protection. It is obvious that the concept should be flexible, wide-ranging and dynamic because it has to handle unexpected changes in technology (Purtova, 2018). In 2007, the European Union issued a highly respected opinion, known as Article 29 of the Working Party, which clarified the concept of personal data and outlined its essential elements as: (i) any information; (ii) connected to a natural person; (iii) that can identify or be identified; and (iv) relating to that individual.