Game-theoretical Model on the GDPR - Market for Lemons?

• Author: Tim Zander - Anne Steinbrück - Pascal Birnstill
• Position: Research assistant at the Chair of Interactive Real-Time Systems at the Karlsruhe Institute of Technology - Ass. iur., is research assistant at the center for advanced legal studies at the Karlsruhe Institute of Technology - Research assistant at the Fraunhofer Institute of Optronics, System Technologies and Image Exploitation IOSB
• Pages: 200-208

2019

Tim Zander, Anne Steinbrück and Pascal Birnstill

200

2

Game-theoretical Model on the GDPR

Market for Lemons?

by Tim Zander, Anne Steinbrück and Pascal Birnstill*

© 2019 Tim Zander, Anne Steinbrück and Pascal Birnst ill

Everybody may disseminate this ar ticle by electronic means and make it available for download under the terms and

conditions of the Digital P eer Publishing Licence (DPPL). A copy of the license text may be obtain ed at http://nbn-resolving.

de/urn:nbn:de:0009-dppl-v3-en8.

Recommended citation: T im Zander, Anne Steinbrück and Pascal Birnstill, Game-theore tical Model on the GDPR - Market for

Lemons?, 10 (2019) JIPITEC 200 para 1.

Keywords: EU-Privacy; game-theory; GDPR; justification of data processing; information asymmetry; adverse

selection; network effect; lock-in effect

the scope of the GDPR can rewrite their privacy pol-

icies and afterwards request the users’ consent or

otherwise lock them out of the service causes un-

due pressure on the data subject. The recent decision

of the Federal Cartel Office of Germany disputed this

behaviour and imposed far-reaching restrictions on

Facebook. Thus, elements of the GDPR have begun to

fall within the remit of competition law and the ques-

tion of effective regulatory compensation regarding

the economic effects in privacy should be addressed.

In general, the measurement of privacy risks seems

to be the first reasonable step towards empowering

actors to make effective decisions.

Abstract: In order to evaluate the regulatory

effects of the GDPR on the institution of privacy as

a public good, a data protection law and economi-

cal perspective should be applied. Conveying an eco-

nomic point of view on the GDPR, we include a game-

theoretical model on the rights and duties arising out

of the GDPR in order to clarify the possible game-

theoretical strategies and discuss the compensatory

mechanisms for the problem of asymmetric informa-

tion between the data controller and the data sub-

ject. Furthermore, we point out the concepts of con-

trol and the legal construction of “data ownership” as

an unsatisfying concept. The fact that services within

A. Introduction

1 The EU General Data Protection Regulation (GDPR)

reects a harmonised legal approach towards data

protection law and the protection of personal data

and privacy based on Art. 7, 8 EU-Charter in the

European Union. The effectiveness of this Regulation

remains to be subject to scrutiny. In general, the

concept of privacy is linked to the idea of the control

of private information1 as the wording of recital

* Dr. Tim Zander, is research assistant at the Chair of

Interactive Real-Time Systems at the Karlsruhe Institute of

Technology; Anne Steinbrück, Ass. iur., is research assistant

at the center for advanced legal studies at the Karlsruhe

Institute of Technology and Dr. Pascal Birnstill is research

assistant at the Fraunhofer Institute of Optronics, System

Technologies and Image Exploitation IOSB.

1 Laura Brandimarte, Alessandro Acquisti and George

Loewenstein, ‘Misplaced Condences: Privacy and the

7 S. 2 GDPR states, “control of their own personal

data”. The question is, whether individuals have full

control over their privacy or – if they wish to do so

– can economically exploit their own personal data

with the effect of a general disclosure of the common

good privacy?2 By taking a similar line of argument

as Anderson,3 who argues against the control concept

on privacy, we reach the conclusion that markets

of data processing might suffer from adverse

Control Paradox’ (2013) 4 Social Psychological and

Personality Science 340.

2 Yoan Hermstrüwer, Informationelle Selbstgefährdung (Mohr

Siebeck 2016) 134–38; Joshua AT Faireld and Christoph

Engel, ‘Privacy as a Public Good’ (2015) 65 Duke Law

Journal 385.

3 Ross Anderson, ‘Why Information Security Is Hard-an

Economic Perspective’, Computer security applications

conference, 2001. Acsac 2001. Proceedings 17th annual

(IEEE 2001).