Europe has something stupid called the GDPR (General Data Protection Regulation). It wastes huge amounts of people’s time to regulate the collection and use of even non-sensitive information. As a result of the GDPR, people have to regularly click “accept” or “reject” on popups when visiting various news websites.
The GDPR wastes so much time and interferes so much with information collection that it harms healthcare innovation and research. Many studies have found that the GDPR has disproportionately harmed small tech firms by increasing compliance costs, and led to markets being dominated by fewer tech companies.
The abstract of a study explains:
We examine how data privacy regulation affects healthcare innovation and research collaboration. The European Union’s General Data Protection Regulation (GDPR) aims to enhance data security and individual privacy, but may also impose costs to data collection and sharing critical to clinical research. Focusing on the pharmaceutical sector, where timely access and the ability to share patient-level data plays an important role drug development, we use a difference-in-differences design exploiting variation in firms’ pre-GDPR reliance on EU trial sites. We find that GDPR led to a significant decline in clinical trial activity: affected firms initiated fewer trials, enrolled fewer patients, and operated at fewer trial sites. Overall collaborative clinical trials also declined, driven by a reduction in new partnerships, while collaborations with existing partners modestly increased. The decline in collaborations was driven among younger firms, with little variation by firm size. Our findings highlight a trade- off between stronger privacy protections and the efficiency of healthcare innovation, with implications for how regulation shapes the rate and composition of subsequent R&D.
That’s from the study “Data Privacy and Medical Innovation: The Case of GDPR,” by Jennifer Kao of UCLA and Sukhun Kang of the University of California-Santa Barbara.
AI Overview describes additional ways the GDPR harms innovation and competition:
- Disproportionate Compliance Costs: Small and medium-sized enterprises (SMEs) bear a heavier relative cost burden for compliance than large corporations, which have dedicated legal and technical teams to handle the requirements. One analysis found compliance costs raised data storage costs by over 20% for small firms.
- Reduced Innovation and Investment: The regulation has been linked to a decline in new app development, reduced venture capital investment in EU tech companies (a 26.1% decrease in monthly deals compared to the U.S.), and a general slowdown in innovation, as companies become more risk-averse regarding data use.
- Market Concentration: The high costs and complexity of compliance effectively create barriers to entry, allowing large, established tech firms like Google and Meta to solidify their market dominance. Large firms are better equipped to gather data internally across multiple services, while smaller firms struggle with the rules around third-party data sharing and obtaining explicit user consent.
- Operational Burden: Small firms face challenges in managing requirements such as obtaining explicit user consent, and handling data subject access requests (which must be fulfilled within 30 days). These tasks drain resources that would otherwise be used for growth and innovation.
