The Global Diffusion of the 'General Data Protection regulation' (GDPR)

On May 25th, 2018, the European Union’s ‘General Data Protection Regulation’ (GDPR) went into effect. The EU regulation placed stricter rules regarding the controlling and processing of individuals’ data. The GDPR made a lot of noise because suddenly all companies, organizations and public bodies holding and processing personal data of European citizens, regardless of geographical location, had to comply with the requirements of the EU law. The extraterritorial impact of the regulation was very much apparent as countries around the globe are increasingly adopting similar standards set by the GDPR into their domestic law. The EU is a powerful economic and political actor and can pressure or coerce non-EU countries to align with the GDPR. On the other hand, the GDPR is currently the most innovative and comprehensive data protection model in the world, and countries might want to associate themselves with having the same high standards. The main aim of this research was to examine how the EU created a global data protection standard through the GDPR. The chosen research design is a co-variation analysis. The thesis analyzed the economic, political, cultural and legal factors of why countries beyond the EU would want to adopt GDPR-like standards. Moreover, whether the diffusion happened through processes of coercion or attraction. Japan and the United States have been selected as case studies to determine why both countries have aligned with principles set by the GDPR. The research findings revealed that the diffusion of the GDPR to Japan and the US occurred through processes of economic coercion rather than attraction. The results indicated that data protection is extremely important, not only for increasing bilateral relations, but also as an instrument to reinforce international trade. Furthermore, the diffusion of the GDPR is part of the global trend, caused by major data scandals, to take the protection of personal data more seriously, as well as pushing companies toward greater accountability when using consumers’ data. The EU effectively used bilateral negotiations and economic incentives to promote the GDPR in Europe and beyond, and in this way created a global standard on data protection.