Consequences of Resorting to Fines and Investments to Regulate Data Portability

Many jurisdictions have implemented data portability regulation (DPR) that requires that Data Controllers (DCs) enable users to download their personal data so that they can port their data to competing DCs. The intention of DPR is to return partial control of data to users, improve user choice of DCs, increase DC participation in the market, and reduce industry concentration. To achieve this, if nonmonetary corrective measures (e.g., warnings, orders to comply) to obtain portability compliance fail, then DPR allows policy-makers to impose fixed or variable (based on revenue) fines on DCs that do not comply. Additionally, policy-makers may invest to decrease compliance costs for DCs. We model this interaction as a two-stage game where in the first stage the policy-maker sets fines and makes investments. In the second stage DCs decide whether to participate in the market, and if so whether to comply with DPR. Contrary to the current regulatory objectives, we find that with partial compliance both fines and investments decrease DC participation and increase industry concentration. Comparing the use of fines and investment to achieve a predetermined level of compliance, the use of fixed fines has a smaller (larger) collateral effect on concentration (participation) than either variable fines or investment. Once all DCs that participate comply—full compliance—then additional investment increases participation. Moreover, full compliance and full participation can occur only if there is a DPR-induced demand expansion, such as from multihoming, and investment is the only instrument that can attain this outcome. This paper was accepted by Hemant Bhargava, information systems. Funding: This work was supported by Natural Sciences and Engineering Research Council of Canada [Grant RGPIN/06571-2015]; Social Sciences and Humanities Research Council of Canada [Grant 435-2022-0460]. Supplemental Material: The online appendix is available at https://doi.org/10.1287/mnsc.2024.08404 .