Digital Privacy: GDPR and Its Lessons for Australia

• Published date: 01 June 2023
• Author: Ratul Das Chaudhury,Chongwoo Choe
• Date: 01 June 2023
• DOI: http://doi.org/10.1111/1467-8462.12506

The Australian Economic Review, vol. 56, no. 2, pp. 204–220DOI: 10.1111/1467-8462.12506

Digital Privacy: GDPR and Its Lessons for Australia

Ratul Das Chaudhuryand Chongwoo Choe*

Abstract

Australia's Privacy Act 1988 is under review

with a view to bringing Australia's privacy

laws into the digital era, more in line with the

European Union's General Data Protection

Regulation (GDPR). This article discusses

how the GDPR can be refined and standar-

dised to be more effective in protecting

privacy in the digital era while not adversely

affecting the digital economy that relies

heavily on data. We argue that an ideal data

policy should be informative and transparent

about potential privacy costs while giving

consumers a menu of opt‐in choices into

which they can self‐select.

JEL CLASSIFICATION

D21; K24; L51

1. Introduction

If this is the age of information, then privacy

is the issue of our times. Activities that were

once private or shared with the few now leave

trails of data that expose our interests, traits,

beliefs, and intentions. (Acquisti, Brandimarte

& Loewenstein 2015).

A popular business model adopted by many

of the world's largest tech platforms is the so‐

called broadcasting model where services are

provided free in return for advertising revenue.

These firms collect and process consumer data

generated from the use of their ‘free’services.

Consumer data thus gathered can help create

value for the business in various ways: it can be

used for product improvement, for developing

new business models, or for general manage-

ment purposes; the data can be also monetised

through sales of data‐based services or even by

direct sales of data to third parties.

1

A famous

quote dating back to the 1970s in relation to

advertising in commercial broadcasting reso-

nates even louder in the digital era: if you are

not paying for the product, then you are the

product. But the key difference between the

traditional broadcasting model and the business

model in the digital era is the role played by

consumer data.

In the age of digital transformation,

buyers are not only consumers but also

producers of data, which in turn becomes a

valuable input to the production of goods

and services. Indeed, data is the new oil in

the digital era, as famously declared by The

Economist in 2017.

2

Consumer‐generated

data analysed with powerful machine‐

learning tools can enable firms to offer

* Das Chaudhury: Monash Digital Lab, Monash Business

School, Monash University, Clayton, Victoria, 3800,

Australia; Choe: Department of Economics, Monash

Digital Lab, Monash Business School, Monash University,

Clayton, Victoria, 3800, Australia. Corresponding author:

Das Chaudhury, email <ratul.daschaudhury@monash.edu>.

This article is partly based on the authors' submission to

the Australian Competition and Consumer Commission's

Digital Platform Services Inquiry. We thank Zhijun Chen,

Stephen King and Chengsi Wang for useful discussions,

and two anonymous referees for many constructive

comments. We gratefully acknowledge financial support

from the Australian Research Council (grant number

DP210102015). The usual disclaimer applies.

© 2023 The Authors . TheAustralian Economic Reviewpublished by John Wiley & SonsAustralia, Ltd on behalf of TheUniversity of

Melbourne, Melbourne Institute: Applied Economic & Social Research, Faculty of Business and Economics.

This is an open access article underthe terms of the Creative CommonsAttribution‐NonCommercial License, which permits use,

distributionand reproduction in any medium,provided the original work is properly cited and is not used for commercialpurposes.

new or improved products, develop more

target‐oriented business models, and ven-

ture into new business opportunities (Hagiu

& Wright 2020). Online recommendation

systems and targeted advertising have

become the cornerstone of modern‐day

marketing. The availability of big data and

finer‐grained analysis has also enabled firms

in some industries to exercise personalised

pricing, once considered only a theoretical

possibility (Choe, King & Matsushima 2018;

Chen, Choe & Matsushima 2020).

3

Consumer data is collected not only by tech

platforms with which consumers directly

interact, but also by data brokers who collect

and sell data to third parties. There are about

4,000 data brokers globally, including com-

panies such as Acxiom and Oracle, who keep

an enormous amount of data about individual

consumers, ranging from relatively harmless

data such as the city of residence to more

sensitive data such as health issues or police

records. A recent estimate suggests that the

global data broker market is worth approxi-

mately US$250 billion in 2020 and is

expected to grow to US$365 billion in 2027.

4

Given the stratospheric rise of large tech

platforms, the expansion of the data brokerage

industry, and the rapid growth in online

activities, consumers are increasingly concerned

about the privacy risks associated with how their

personal data is collected and shared. According

to the Australian Community Attitudes to

Privacy Survey 2020 (OAIC 2020), privacy is

a major concern for 70 per cent of Australians,

and almost 9 in 10 want more choice and control

over their personal information. The survey also

finds that 84 per cent of Australians perceive

identity fraud and data breaches as the biggest

risk to data privacy. Such a concern is well

justified: from January to June 2021, the Office

of the Australian Information Commissioner

received 446 data breach notifications, with

about half of these breaches resulting from

cyber security incidents.

5

Similar sentiments

towards online privacy are observed in the

United States: a study by Pew Research Center

reports that about 80 per cent of Americans think

their personal data is less secure now and that

data collection poses more risks than benefits

(Auxier et al. 2019).

Before the advent of the digital era, privacy

was not viewed as something that needed

regulatory protection, an argument put forward

most notably by the Chicago School. Posner

(1981) regarded the ‘righttoprivacy’of fully‐

informed economic agents with control over

disclosing or withholding information as a mere

artefact, rendering any legislation to protect

privacy unnecessary. He argued that any

regulatory intervention would interfere with

the efficient flow of information. But Acquisti

& Grossklags (2005) challenge this view by

arguing that people are not informed enough to

make privacy‐sensitive decisions and, even

when they are sufficiently informed, they trade

off long‐term privacy for short‐term benefits.

The latter is also related to the so‐called privacy

paradox whereby people relinquish privacy in

exchange for small incentives, even though their

stated preferences for privacy may be strong

(Berendt, Günther and Spiekermann 2005;

Athey, Catalini & Tucker 2017). In addition,

the monitoring of personal information is

ubiquitous in the digital era, as the opening

quote suggests. A recent study finds that 80 per

cent of the data collected by online service

providers through mobile apps is not related to

the direct performance of the app, but is

primarily shared with data brokers or third

parties for analytics, advertisement and so on

(Bian, Ma & Tang 2022). In short, people are

barely aware of the extent to which their

personal information is collected and shared;

nor do they have full control over their personal

information.

6

Even if people are well‐informed, their

decision to share personal information is

influenced by various behavioural elements.

Johnson, Bellman & Lohse (2002) provide

experimental evidence that well‐informed

individuals' decision to share personal infor-

mation is significantly affected by the default

option and framing effect. For example,

individuals are more likely to share personal

information when facing an opt‐out choice

than an opt‐in choice. In the former, data

collection is the default setting while, in the

205Das Chaudhury and Choe: Digital Privacy: GDPR and Its Lessons for Australia

© 2023 The Authors. The Australian Economic Review published by John Wiley & Sons Australia, Ltd on behalf of The

University of Melbourne, Melbourne Institute: Applied Economic & Social Research, Faculty of Business and Economics.