38
The Economic Impact of Data Regulation Liad Wagman Stuart School of Business Illinois Institute of Technology
The Economic Impact of Data Regulation
Liad WagmanStuart School of Business
Illinois Institute of Technology
Consumer Information is Already Available
FTC (2014): “One data broker held information on more than 1.4 billion consumer
transactions and 700 billion data elements; another broker added more than 3 billion
new data points to its database each month.”
IAB/PwC (2018): Digital ad spending in the first half of 2018 reached $49.5B in US, up
23% YoY, with mobile accounting for 63% of the total, up from 54% last year
Questions
Given the unprecedented availability of consumer information...
� Is there a demand for privacy without taste for privacy?
� Which consumers benefit from privacy? Who loses?
� What is the impact of consumer privacy on firm profits?
� What are the efficiency implications of consumer privacy?
Four workhorse oligopoly models commonly used in the litera-ture (and in class): Linear City, Circular City, Vertical Differ-
entiation, Strategic Complements
Consumer Preferences over Privacy
Monopoly setting: Consumer surplus, welfare non-monotonic
Conitzer, Taylor and Wagman (2012)
^
α=0,prices increase
0 c
0<α<1
c_ c
α=0, Full Recognition
α=1, NoRecognition
...
c
ConsumerSurplus
Oligopolistic Competition1. Horizontally differentiated duopoly (Hotelling)2. Horizontally differentiated oligopoly w/ entry (Circular City)3. Vertically differentiated duopoly4. Horizontally & vertically differentiated duopoly
Suppose firms have detailed records about consumer preferences. What happens when access to data is cut off?
Restricting Data Accessto Prevent Individualized Offers:
Taylor & Wagman (2014)
Extended:Data restrictions impact merger considerations
Oligopolistic Horizontal Mergers When Firms Do/Do Not Have Data
Kim, Wickelgren and Wagman (2018)
Difference in Consumer Surplus (Pre-Merger CS – Post-merger CS)
Merger Cost Efficiencies
Mergers when Firms Do/Do Not Have Data
Depending on specific market structure, less restrictive data access can actually make otherwise contested mergers less contested (darker-
shaded areas of figure)
Continues to Hold even when firms have
asymmetric access to data, or when upstream
data brokers can sell data exclusively downstream or vertically integrate, as
long as weaker downstream firms can
survive
Competitive Markets
Competition drives firms to collect too much information; however, consumers benefit from lower prices
Burke, Taylor and Wagman (2012)
Competitive Markets AND Data Sold Downstream
Consider a market with many upstream firms (e.g., banks) and downstream firms (e.g., insurance providers)• Upstream firms screen applicants for (e.g., financial) products• Information about applicants could be traded downstream
Empirical Validation
Validated using data from local opt-in/opt-out ordinances:
Kim & Wagman (2015)
Connecting Data and Innovation
Krasteva, Sharma and Wagman (2015): Compliance costs both deter innovation and shift some of it into established firms
Campbell, Goldfarb and Tucker (2015): Identical compliance costs disproportionately burden smaller firms
Hypothesis: data regulation, while it may benefit consumers (e.g., intrinsic value of privacy and control, lower risk of malicious exposure), it may also hinder the operations of technology ventures, particularly new ventures
à Can test empirically by looking at the effects of GDPR
Background• GDPR mandates: data management, auditing and classification;
data risk identification and mitigation; interfaces for users’ own
data + obtain granular informed opt-in consent + allow deletion;
train or hire qualified staff; or face severe penalties (can be ~$23m
or 4% of annual revenue)
• Bloomberg: “500 biggest corporations are on track to spend a total
of $7.8 billion to comply”
• Theory: Young ventures are more susceptible to increases in
compliance costs (Campbell et al., 2015; Krasteva et al., 2015)
• Who better to assess those costs than investors?
GDPR’s Implementation Stage: May 2018
• SafeDK, 1/25/18: More than half of mobile applications are not GDPR ready
• 5/9/18, 5/23/18: Apple removes apps that share location data w/o consent, updates privacy terms
• 5/10/18: Facebook: “Businesses may want to implement code that creates a banner and requires affirmative consent… Each company is responsible for ensuring their own compliance”
• 5/24/18: Shopify updates app permissions for merchants/developers
• 5/24/18: Google releases consent SDK for developers
• 5/25/18: GDPR takes effect
Data• Venture deals in EU & US taking place in July 2017 through end of
2018 from Crunchbase– Firm information (name, location, category, founding date, financing dates,
employee range)
– Deal information (size & date of deal, funding stage such as Seed/Series
A/etc, participating investors)
• Venture deals in EU & US taking place in July 2017 through end of
2018 from VentureXpert– Investor information (geographical preference, founding date, industry
preference, portfolio size, location)
• We merge these two dataset by matching investors in each deal.
– Grueling task
Summary Statistics
Summary by Venture Age
Funding Stage (Firm Age, Average $ Raised)
Summary by Location ($ amount)
# Deals/Week/State/Category, EU & US:
0
0.5
1
1.5
2
2.5
2017
/720
17/7
2017
/720
17/8
2017
/820
17/9
2017
/920
17/1
020
17/1
020
17/1
020
17/1
120
17/1
120
17/1
220
17/1
220
18/1
2018
/120
18/1
2018
/220
18/2
2018
/320
18/3
2018
/420
18/4
2018
/520
18/5
2018
/620
18/6
2018
/720
18/7
2018
/720
18/8
2018
/820
18/9
2018
/9
GDPR takes effect
# of
dea
ls
Total $ Raised Per Week, EU & US
0
2000
4000
6000
8000
10000
12000
2017
/720
17/7
2017
/720
17/8
2017
/820
17/9
2017
/920
17/1
020
17/1
020
17/1
020
17/1
120
17/1
120
17/1
220
17/1
220
18/1
2018
/120
18/1
2018
/220
18/2
2018
/320
18/3
2018
/420
18/4
2018
/520
18/5
2018
/620
18/6
2018
/720
18/7
2018
/720
18/8
2018
/820
18/9
2018
/9
GDPR takes effect
$MM
Empirical Methodology
• Difference-in-difference framework– EU ventures after May 25 2018 as treatment, US ventures as control group
• Tobit for $ amount (0 censored), Poisson for # of deals (count data)
• Macroeconomic controls (unemployment, CPI, interest rate, GDP, exchange rate)
• Time (week) and state (US) /country (EU) fixed effects
• Log linear at deal level, control for investor type, firm age, funding stage, category
GDPR Effect on $MM Raised Per Week Per Member State Per Category (Average EU)
• We consider two categories: (i) Health/Finance & (ii) Everything else
• On average, each category in each EU member state incurs a $13.90m overall decrease per week after the rollout of GDPR.
• After reducing the influence of outliers, a $3.38m decrease.
• This aggregate $ amount estimation combines extensive margin (# of deals) and intensive margin ($ raised per deal) effects.
• We further decompose these two effects.
GDPR Effect on # of Deals (Extensive Margin)
Our baseline Poisson regression suggests a 17.6% decrease in the
number of EU venture deals following the rollout of GDPR.
An OLS specification indicates a 9.07% decrease in EU venture
deals.
GDPR Effect on $MM Raised per Deal (Intensive Margin)
Log-linear specification suggests a 39.6% decrease
in the dollar amount raised per deal after the
rollout of GDPR
Group-Level Results
Category or Age Group
Percentage change in # of deals Aggregate $mm per week per state change
$mm amount per deal change
Healthcare& Financial -18.86% -5.22m
($30.1m avg)-56.6%
($24.79m avg)
All Other Categories-16.69% – -28.4%
($20.39m avg)
0-3 Year-Old Firms-19.02% -0.9m
($14.82m avg)-27.1%
($7.94m avg)
(Recently confirmed: All of the results hold when we extend the sample to the end of December 2018)
Robustness – Treatment & Outliers
• The treatment period – dropped the month of May & tried other start weeks.
• Outliers in $ raised amount: top-coded observations at 95% to mitigate influence of outliers.
-0.4-0.3-0.2-0.1
00.10.20.30.40.5
8/1/2017
9/1/2017
10/1/2017
11/1/2017
12/1/2017
1/1/2018
2/1/2018
3/1/2018
4/1/2018
5/1/2018Lo
g poi
nts
-200
-150
-100
-50
0
50
100
150
8/1/2017
9/1/2017
10/1/2017
11/1/2017
12/1/2017
1/1/2018
2/1/2018
3/1/2018
4/1/2018
5/1/2018
Log p
oint
s
Vertical bands represent ± 1.96 times the standard error of each point estimate
Weekly # of deals pre-treatment test Weekly $ raised pre-treatment test
Robustness – Groups, Seasonality, Brexit
• Category grouping: Switched to unsupervised industry categorization– K-means clustering approach, results unchanged
• Seasonality:– Effective date of GDPR is EU’s summer holiday – DID design between Q3 2017 and Q3 2018, results unchanged
• Brexit:– In our sample, UK is a member state, bound by GDPR + adopted its own similar
regulation– Control for country fixed effects, linear time trends– Test whether effects kick in any time before May 2018
– If Brexit is the driving factor, should notice effects in prior months; we did not
Rough Bound Estimates of Annual EU Tech Jobs Lost
3,604 29,819
0-3 Year Old EU Ventures
Range estimate of potential job losses
Represents a short-term reaction
Could be indicative of a wait-and-see
approach by investors
4.09-11.20% of overall 0-3 year old venture tech jobs in the EU in our sample
The Short-Run Effect of GDPR on FOREIGN Investment
• Differential effect on foreign vs domestic investors?
• Investors have better access to information about companies located nearthem (Coval and Moskowitz, 1999)
• Aside from proximity, there are other dimensions that may play a role in investment decisions: Cultural, industry preference, familiarity with legal regimes
• Did GDPR have an impact on these dimensions?
• Categorize venture deals into three types:
– Foreign investment: Ventures and investors are in a different union (e.g., EU venture + US investor).
– Same union different member states (e.g., a UK venture has an investor from France).
– Same member state: Domestic investment.
• Use haversine distance (using long/lat coordinates) to calculate the distance between venture and its investor. – The middle point of each country/state to capture the distance.– The middle point of each city to capture the distance– Results are similar
Preliminary Tests
Investor in NY invests in a venture in UK
Investor in France invests in a venture in
UK
Investor in SF invests in a venture in LA
Summary Statistics
Deal type EU deal distribution US deal distribution
Foreign investment deals 10.33% 15.67%
Same-union investment deals 44.79% 46.78%
Same-state investment deals 44.88% 37.55%
Deal type Avg $MM raised per deal in EU Avg $MM raised per deal in US
Foreign investment deals 1.43 2.02
Same-union investment deals 2.77 3.35
Same-state investment deals 3.05 4.67
# of Deals in EU # of Deals in US
Median | Average distance, country middle 835 | 1242 miles 1977 | 2315 miles
Median | Average distance, city middle 633 | 797 miles 1195 | 1483 miles
Effect of GDPR on Investment Categories:
Deal Type % Change In # of Deals % Change In $mm Amount Per Deal
Foreign deals -21.04% -37.88%
Same union deals -17.64% -29.12%
Same member-state deals -16.40% -17.35%
• Foreign investors invest less in both the extensive and intensive margins.
• Foreign investment in EU ventures has gone down relative to foreign investment in US.
Distance type Distance change between ventures and investors
Distance calculated by country middle -130.65 miles
Distance calculated by city middle -122.48 miles
• Proximity increases (distance shrinks) between investors and EU ventures relative to their US counterparts post GDPR
• The short-run impact of GDPR may be asymmetric
• Under works: Differential cultural & industry impact of GDPR
Effect of GDPR on Investment Distance:
Limitations • Short-run analysis. Mid-run and long-run effects remain to be seen.
• Some investment $ may be flowing to the US, may overstate DID results
• Did not examine ventures in non-EU/US countries that serve EU citizens, could understate results
• Investors may fear rising costs / legal barriers / uncertainty / etc – we aim to disentangle these effects
• Small part of the full picture (CB/VE are not a complete data universe)
Data Regulation: Lessons Observed
• Regulatory approach should embrace nuance, dynamism, and be market specific
• Strike a balance between data usability and data security• Data privacy as a means for data security seems intuitive but a proper
balance is needed
• Account for data considerations in merger review; consider potential overlaps in consumer protection and antitrust
• Seek to avoid burdening smaller ventures with disproportionate costs of compliance, seek to inform foreigners
