GDPR: Is it worth it? Perceptions of workers who have experienced its implementation

TL;DR

This study explores workers' perceptions of GDPR implementation, revealing that they recognize its benefits and see it as positive for privacy and their companies, despite limited knowledge about regulators.

Contribution

It provides empirical insights into workers' views on GDPR, highlighting perceived benefits and support, which contrasts with common negative narratives about regulation.

Findings

Workers recognize their rights when prompted.

Participants observe positive data practice changes.

They view GDPR as beneficial for privacy and companies.

Abstract

The General Data Protection Regulation (GDPR) remains the gold standard in privacy and security regulation. We investigate how the cost and effort required to implement GDPR is viewed by workers who have also experienced the regulations' benefits as citizens: is it worth it? In a multi-stage study, we survey N = 273 & 102 individuals who remained working in the same companies before, during, and after the implementation of GDPR. The survey finds that participants recognise their rights when prompted but know little about their regulator. They have observed concrete changes to data practices in their workplaces and appreciate the trade-offs. They take comfort that their personal data is handled as carefully as their employers' client data. The very people who comply with and execute the GDPR consider it to be positive for their company, positive for privacy and not a pointless, bureaucratic regulation. This is rare as it contradicts the conventional negative narrative about regulation. Policymakers may wish to build upon this public support while it lasts and consider early feedback from a similar dual professional-consumer group as the GDPR evolves.