Buckley, Gerard; (2025) Privacy at the intersection of technology, business and regulation: A case study of the GDPR. Doctoral thesis (Ph.D), UCL (University College London).

Preview

Text GBThesis_Final.pdf - Accepted Version Download (1MB) | Preview

Abstract

Technological advances have outpaced privacy safeguards, enabling unprecedented corporate and government surveillance that threatens fundamental human rights. Individuals can counter with privacy-enhancing technologies (PETs) and legal options but face an unequal battle. This thesis investigates the effectiveness of the General Data Protection Regulation (GDPR) in redressing this power imbalance by analyzing its impact on key stakeholders since 2018. First, it presents new insights into why business embraced the GDPR. While the benefits to consumers (increased rights) and regulators (stronger powers) are well-documented, the upside for business is less understood. Interviews with senior executives reveal that the threat of fines acted as a catalyst for data infrastructure modernization, strengthening the compliance function and yielding multiple direct and indirect benefits. Second, a consumer survey investigates if those who had worked before, during, and after 2018 in companies that had implemented the GDPR perceived the regulation as beneficial in hindsight. Findings show the regulation sensitized employees to responsible data management within their companies, raising expectations of companies at large. This, in turn, cultivated public support. Third, the research expands our understanding of how regulators are judged. Surveys and interviews with information security executives, digital rights advocates, and regulators unpack subjective effectiveness assessments. A crucial finding is the weak feedback loop: regulators lack robust accountability mechanisms. The thesis proposes standardized reporting practices and Key Performance Indicators (KPIs) to facilitate benchmarking and improve transparency. Finally, new ground is broken by imagining the evolution of the GDPR using future-thinking theory. It identifies four lead indicators to monitor and forecast its positioning and relevance in changing environments. Overall, this thesis deepens our understanding of the success of the GDPR model. It sheds light on the factors underpinning its ongoing support by stakeholders and proposes a framework for evaluating future data protection regulator performance

Download activity - last month

Export as JSONCSVXML

Download activity - last 12 months

Export as XMLJSONCSV

Downloads by country - last 12 months

Export as XMLJSONCSV

Archive Staff Only

View Item