• Privacy and Data Protection Impact Assessments (PIAs/DPIAs) are tools for organisations to manage privacy risks. They emerged in various jurisdictions from the 1980s, initially as a purely voluntary measure. DPIAs are now set to become a mandatory requirement in certain circumstances under...

The goal of this article is to provide a framework for assessing issues of data portability and other required transfers of data. Greater portability and other required transfers of data can have pro-competitive effects – if more companies have access to commercially valuable data, then there...

This paper reviews the economic literature on the European Union's General Data Protection Regulation (GDPR). I highlight key challenges for studying the regulation including the difficulty of finding a suitable control group, variable firm compliance and regulatory enforcement, as well as the...

The Internet comprises thousands of independently operated networks, interconnected using bilaterally negotiated data exchange agreements. The European Union (EU)'s General Data Protection Regulation (GDPR) imposes strict restrictions on handling of personal data of European Economic Area (EEA)...

Many governments are taking unprecedented measures to track, trace and contain the spread of the novel coronavirus (COVID-19), by turning to digital technologies and advanced analytics to collect, process and share data for effective front-line responses. Policy makers, in consultation with...