GDPR: The Battle for European Consumer Data

Introduction

In 2017, The Economist published an article titled “The world's most valuable resource is no longer oil, but data” (The Economist, 2017), reflecting the transformation of our modern economies, in which massive data collection and analysis have become a key competitive advantage. This transformation of market features kicked off the major reform of data protection framework in the EU which resulted in the adoption of the General Data Protection Regulation (“GDPR”) in 2016. Since its enforcement in May 2018, EU-GDPR has been widely accepted as a paradigm of new rules in the field of data protection - towards a greater choice and sovereignty for individuals, and more accountability for organizations. A Study of Companies in the United States & Europe (The Race to GDPR: A Study of Companies in the United States & Europe. Ponemon Institute Ponemon Institute, 2018) conducted in April 2018 among more than 1,000 European and US companies reported that 40% of respondent organizations would not comply on May 25th, 2018. And even if companies have started to address GDPR, only 23% of US-based companies and 31% of EU-based companies stated that they were confident with their ability to comply. Data protection has become a truly global phenomenon as people around the world increasingly cherish and value the protection and security of their data.

Many countries have adopted or are in the process of adopting comprehensive data protection rules based on principles similar to those of the regulation, resulting in a global convergence of data protection rules. This offers new opportunities to facilitate data flows, between commercial operators or public authorities, while improving the level of protection for the personal data in the EU and across the globe. A new framework for data privacy affected everyday lives of 500 million customers in the European market by strengthening and unifying the aspect of data privacy rights of individuals as a data subject. No matter if they are in early position as suspect, prospect or act as a consumer, re-buyers in Customer Lifecycle Management (“CLM”) - GDPR has a big effect on how businesses collect, store and secure customers' personal data. Consumers compare the value proposition with data privacy in every stages of this lifecycle. Many definitions of value proposition concept have been made, and the concept is widely used. Value proposition is an explicit promise made by a company to its customers that delivers a particular bundle of value creating benefits (Buttle, 2009). In other words, “value proposition is a written statement focusing all the organization’s market activities onto customer critical elements. That creates a significant differential within the customer’s decision process, to prefer and/or purchase the organization’s offering over a competitor’s” (Fifield, 2007). The value proposition was defined (Lanning, 2000) as an entire set of experiences, including value for money that an organization brings to customers. Customers may perceive this set or combination of experiences to be “superior, equal or inferior to alternatives”. In early stage of applying CLM to customers and users (Medha Gore, 2013) customers were just a 'suspect' for marketers as someone who potentially may benefit from acquiring a physical product, non-physical product and/or service offering but may not be aware of it 'prospects' who may be ready, willing and able to acquire an offering and need to decide on a purchase – e.g. (1) actual customers who were prospects who 'signed up' (2) repeat customers who made more purchases and use more than one product or service. Even though customer satisfaction (“CS”) has long been regarded as the key determinant of behavioral intentions (Xu et al., 2007; Ladhari et al., 2008; Jen et al., 2011; Chiabai et al., 2014; Sohn et al., 2016; Azizi et al., 2017) academic researchers and managers firmly believe that CS is an essential predictor of lasting customer behavior (Vera & Trujillo, 2017; Wieseke, Geigenmüller, & Kraus, 2012). This conventional belief has been challenged by recent empirical studies due to this evolution of today’s competitive service sector, companies are striving hard to retain and hold their customers (Aksoy, 2013; Giovanis & Athanasopoulou, 2018; Tsoukatos & Rand, 2006). Although EU-GDPR was finalized in 2016 and presents a major paradigm shift in data protection, it has attracted relatively little attention in IS literature so far (see Table 1).