Mapping the Empirical Evidence of the GDPR (In-)Effectiveness: A Systematic Review
This work addresses the gap in empirical understanding of GDPR effectiveness for policymakers and researchers, though it is incremental as it synthesizes existing evidence rather than introducing new methods.
The paper tackles the disconnect between legal and policy discussions on data protection and the scattered empirical evidence on GDPR effectiveness by conducting a systematic review of empirical research from 1995 to 2022, aiming to integrate this evidence into GDPR evaluation and provide a methodological foundation for future studies.
In the realm of data protection, a striking disconnect prevails between traditional domains of doctrinal, legal, theoretical, and policy-based inquiries and a burgeoning body of empirical evidence. Much of the scholarly and regulatory discourse remains entrenched in abstract legal principles or normative frameworks, leaving the empirical landscape uncharted or minimally engaged. Since the birth of EU data protection law, a modest body of empirical evidence has been generated but remains widely scattered and unexamined. Such evidence offers vital insights into the perception, impact, clarity, and effects of data protection measures but languishes on the periphery, inadequately integrated into the broader conversation. To make a meaningful connection, we conduct a comprehensive review and synthesis of empirical research spanning nearly three decades (1995- March 2022), advocating for a more robust integration of empirical evidence into the evaluation and review of the GDPR, while laying a methodological foundation for future empirical research.