Regulating Data Privacy

Regulating Data Privacy tells the behind-the-scenes story of the making of the world's two most influential data privacy laws: the European General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). Damira Khatam explores how these laws came to be, despite strong opposition from tech giants. It chronicles the remarkable, years-long marathon to pass the GDPR, then turns to the CCPA's policy sprint, and concludes with a comparative analysis of the scope of the laws and their enforcement to date. The book builds on three common themes. First, both policy processes bore the imprint of foreign influence. Second, the GDPR and CCPA proponents benefited from exogenous events—major data privacy scandals. For the GDPR process, that scandal was Edward Snowden's revelations about a US mass surveillance program based on information from American companies. For the CCPA, it was the Cambridge Analytica scandal. Both scandals underscored the urgency and necessity of policy change. Third, in both cases, policy entrepreneurs—individuals outside of lawmaking institutions or organized interest groups—played an important role. For the GDPR, one such individual was Max Schrems, and for the CCPA, it was Alastair Mactaggart. Both Schrems and Mactaggart were "outsiders" and "underdogs" who succeeded in taking on tech Goliaths.Regulating Data Privacy offers readers a window into how policy ideas are born, adapted, and negotiated in a democratic process. Drawing on original interview with key policymakers, internal documents, and archival history, it traces the events, politics, scandals, and the people that shaped them.