Privacy, Property, and Discovery

Abstract

This chapter considers the institutions of control of personal information used by private firms. The chapter begins by considering the EU’s General Data Protection Regulation (GDPR), which became enforceable in 2018. The GDPR is the most ambitious attempt to regulate the use of personal data and provides consumers with a range of rights about how data may be used and how consumers might withdraw their consent for data use. However, the regulatory approach taken by the GDPR falls far short of a property rights regime in personal data, preventing consumers from exploiting and monetizing information about themselves. The chapter contrasts this approach with an evolutionary approach, focused on case-by-case legal change and emphasizing education, empowerment, and enforcement of existing laws.