The Role of IS in the Conflicting Interests Regarding GDPR

Jakobi, Timo et al. Article — Published Version The Role of IS in the Conflicting Interests Regarding GDPR Business & Information Systems Engineering Provided in Cooperation with: Springer Nature Suggested Citation: Jakobi, Timo et al. (2020) : The Role of IS in the Conflicting Interests Regarding GDPR, Business & Information Systems Engineering, ISSN 1867-0202, Springer Fachmedien Wiesbaden, Wiesbaden, Vol. 62, Iss. 3, pp. 261-272, https://doi.org/10.1007/s12599-020-00633-4 This Version is available at: https://hdl.handle.net/10419/289115 Standard-Nutzungsbedingungen: Die Dokumente auf EconStor dürfen zu eigenen wissenschaftlichen Zwecken und zum Privatgebrauch gespeichert und kopiert werden. Sie dürfen die Dokumente nicht für öffentliche oder kommerzielle Zwecke vervielfältigen, öffentlich ausstellen, öffentlich zugänglich machen, vertreiben oder anderweitig nutzen. Sofern die Verfasser die Dokumente unter Open-Content-Lizenzen (insbesondere CC-Lizenzen) zur Verfügung gestellt haben sollten, gelten abweichend von diesen Nutzungsbedingungen die in der dort genannten Lizenz gewährten Nutzungsrechte. Terms of use: Documents in EconStor may be saved and copied for your personal and scholarly purposes. You are not to copy documents for public or commercial purposes, to exhibit the documents publicly, to make them publicly available on the internet, or to distribute or otherwise use the documents in public. If the documents have been made available under an Open Content Licence (especially Creative Commons Licences), you may exercise further usage rights as specified in the indicated licence. https://creativecommons.org/licenses/by/4.0/ DISCUSSION The Role of IS in the Conflicting Interests Regarding GDPR Timo Jakobi •Maximilian von Grafenstein •Christine Legner •Cle ´ment Labadie • Peter Mertens •Ayten O ¨ksu ¨z•Gunnar Stevens Published online: 9 March 2020 The Author(s) 2020, corrected publication 2021 1 Introduction Timo Jakobi, Information Systems esp. IT-Security and Privacy, University of Siegen Since May 25 2018, the General Data Protection Regulation (GDPR) regulates the handling of personal data both for companies in the European Union and European Citizens. It is part of the European Union’s Digital Single Market strategy and aims to create the conditions for an economy without barriers that would benefit individuals and companies as well as society as a whole (European Parliament and Council 2016). The protective purpose of the GDPR is to enable individuals, against the background of modern data processing possibilities and techniques and their risks, to decide for or against a consent to data processing on the basis of appropriate information on how their personal data are handled and in a self-determined manner. At the same time, the GDPR has established many fundamentally new concepts, thereby opening new leeway for legal, scientific and practical interpretation, providing both challenges and potential for renewal and innovation. Almost two years after the entry into force of the GDPR, it seems appropriate to reflect on first effects, suggestions for improvement and future high potential research areas. With Business and Information Systems Engineering research focusing on socio-technical systems for digital data processing for commercial or social purposes, it seems that it is the natural place for a transdisciplinary examination of the possibilities and challenges that this new regulation brings along. In this regard, BISE is – maybe better than any other field – suited to address such complex questions at the intersection of law, design, organizational research and information systems. However, with evolvement of its context, maybe also the field itself needs to adapt One sign for this simultaneous potential need and opportunity is the vivid research surrounding GDPR in the areas concerning the interdisciplinary field of BISE. In the vast majority of these contributions, a key question revolves around the interpretation of certain aspects of GDPR. On a more practical level, for example, there is an increasing body of practical guides or implementation guidelines, looking at how organizations will have to move forward to comply and avoid fines or negative publicity (Tankard 2016; Huth 2017; Voigt and Von dem Bussche The original online version of this article was revised due to a retrospective Open Access order. Dr. T. Jakobi (&)Prof. Dr. G. Stevens Information Systems esp. IT-Security and Privacy, University of Siegen, Siegen, Germany e-mail: [email protected] Prof. Dr. M. von Grafenstein Berlin University of the Arts, Einstein Center Digital Future, Berlin, Germany Prof. Dr. C. Legner C. Labadie Faculty of Business and Economics (HEC), University of Lausanne, Lausanne, Switzerland Prof. Dr. Dr. hc. mult. P. Mertens School of Business, Economics and Society and Faculty of Engineering, University of Erlangen-Nuremberg, Nuremberg, Germany Dr. A. O ¨ksu ¨z Consumer Association of North Rhine-Westphalia, Du ¨sseldorf, North Rhine-Westphalia, Germany 123 Bus Inf Syst Eng 62(3):261–272 (2020) https://doi.org/10.1007/s12599-020-00633-4 2017; Lambrinoudakis 2018). However, there is a lot of criticism remaining (Cvik et al. 2018). Organizational and management research likewise seeks to uncover and address organizational and business needs with regard to GDPR. These include, for example, the new requirements to react to data breaches (Karyda and Mitrou 2016). Researchers also try to make use of existing structures and processes such as from the information security management system (ISMS) context, to make transition for organizations easier (Lopes et al. 2019). Notably, the interpretation of a risk-based approach as used in ISMS is also present in the GDPR (Gellert 2018). But even if compliance has been reached, organizations still need support in how to communicate the measures taken effectively (Fox et al. 2018). From a technical perspective, GDPR also imposes technical challenges in information systems design, such as the implementation of making its system ‘‘forget’’ (Politou et al. 2018). Moreover, the implementation and benefits of different existing technical means such as pseudonymization or anonymization must be (re-)assessed with respect to demands in GDPR (Hintze and El Emam 2018). On the individual level, likewise, the need for interpretation is high: The newly provided rights of the data subject are being studied, e.g., from a HCI perspective (De Hert et al. 2018; Alizadeh et al. 2019). At the same time, GDPR has also given new drive to almost traditional research topics such as privacy policies as well as the issue of ‘‘informed consent’’ (Politou et al. 2018; Utz et al. 2019) and how to design for transparency (Jakobi et al. 2019a). Also, in absence of the ePrivacy regulation, online tracking has come to focus on the context of GDPR (Degeling et al. 2018; Ermakova et al. 2018; Schelter and Kunegis 2018; Jakobi et al. 2019b; Mhaidli et al. 2019). The margin opened up is also noticeable with regard to law research, where GDPR was and is heavily debated (De Hert and Papakonstantinou 2016; Mitrou 2017): The new regulation must be brought in line and act in concert with existing legislation (Diker Vanberg and U ¨nver 2017). The role of certification mechanisms as a regulatory instrument is one major concern here (Lachaud 2018). While the aforementioned contributions stem from a certain research field or perspective, they are not only interesting, but also highly relevant for the respective other ones, because of the fact that handling the GDPR is a multi-stakeholder task by nature. In this contribution to the ongoing discussion of the future of BISE and its relation to GDPR, we have summoned renowned experts from the fields of law, customer protection, economics, organizational and information sciences, as well as human–computer interaction to talk about how BISE research is interdependent with the GDPR in terms of contributing to an understanding of how to interpret regulation in the practice of BISE. We will particularly look at the question of which role BISE should take in the ongoing application and interpretation of GDPR. What are – before the background of its fields of expertise – meaningful, yes perhaps necessary contributions that the community can perform or must perform in the context of the GDPR? What can a research agenda therefore look like with respect to GDPR? For contributing to an answer to these questions, we summarize the discussion initially held at the 14. Internationale Tagung Wirtschaftsinformatik (WI2019) in Siegen, Germany, supplemented with additional insights from further perspectives of academia in the field of BISE. While previous sections of this discussion section have looked at digitalization as a technological mega-trend (Legner et al. 2017; Riedl et al. 2017; Urbach et al. 2019), this time the regulatory reaction shall be discussed regarding the implications for both economy and academia, and BISE in particular. In this regard, this updated summary especially provides the multitude of perspectives necessary to cover such an interdisciplinary issue as data protection is reflected by contributions from numerous fields. All experts share the notion that data protection is an important component of a modern society, but they may differ in how to practically apply data protection regulation. 2 The EU General Data Protection Regulation Outside the Box: Competitive Advantages and Openness to Innovation Maximilian von Grafenstein, University of Arts Berlin, Einstein Center Digital Future Long before its application in May 2018, the EU General Data Protection Regulation (GDPR) triggered numerous controversies (De Hert and Papakonstantinou 2016). The excitement about the GDPR is based on the novel regulatory approach, which follows from the special nature of its subject matter and environment. At first glance, the GDPR may regulate the processing of personal data. At second glance, however, this law is about controlling the risks that arise for people when data that relates to them is processed (Albrecht 2016). Furthermore, recognizing the dynamics of data-driven innovation as an essential element of our digital society, all involved actors – from the legislator and data protection authorities up to data controllers, processors and data subjects – face similar knowledge uncertainties. This understanding goes hand in hand with a fundamental change in the regulatory approach of the GDPR itself and its interpretation (Zarsky 2016). Business informatics (BI) can make a significant contribution to this change. 123 262 T. Jakobi et al.: The Role of IS in the Conflicting Interests Regarding GDPR, Bus Inf Syst Eng 62(3):261–272 (2020) 2.1 Lawmaking and Enforcement under Knowledge Uncertainties: From a Compliance Approach to a Proactive Application of Laws Schumpeter was one of the first economists to recognize innovation as the real driving force of social change (see the following line of arguments at von Grafenstein 2020). He saw ‘‘the new consumers’ goods, the new methods of production or transportation, the new markets, the new forms of industrial organization that capitalist enterprise creates’’ as the most important impulse ‘‘that sets and keeps the capitalist engine in motion’’ (Schumpeter 2003, pp. 82–83). A legislator who intervenes in such an evolutionary market inevitably faces the knowledge uncertainties created by its innovations. The regulation of risks and, more recently, the regulation of innovation put this kind of knowledge uncertainty into the center of their approach. While the regulation of risks addresses the question of the appropriateness of protection measures against such risks (Jaeckel 2010), the approach of innovation regulation raises the additional question of how such protection measures should be designed so that they do not unnecessarily hinder innovation or even promote it (Hoffmann-Riem 2006). Interestingly, economists deal with the phenomenon of knowledge uncertainty in an almost mirror-inverted way: The Discovery and Creation Theory, two economic approaches, both deal in particular with the knowledge certainty and uncertainty of the innovative entrepreneur, i.e. the actor who brings an innovation onto the market (Schumpeter 2003, p. 132). Both theories address the question of how entrepreneurs use business opportunities in their entrepreneurial process: Do they discover business opportunities or do they create these opportunities themselves (Alvarez and Barney 2007)? In both cases – and this is the crucial point – the law can be understood as a factor of the entrepreneurial environment (Gartner 1985), which does not have to be an obstacle to innovation, but can promote innovation if properly designed (Mayer-Schonberger 2010). Against this background, legal principles and undetermined legal terms are much better suited for designing a law that is open to innovation than specific ‘‘command and control’’ rules. The reason for this is that such legal instruments give an innovative entrepreneur, as the addressee of the regulation, much more leeway to find the best solution for implementing the law in his or her specific case. At the same time, however, this approach creates considerable legal uncertainty as neither the companies nor those affected, e.g. data subjects, can know with certainty whether or not the entrepreneur’s concrete implementation of the law meets the expectations of the regulator (Eifert et al. 2012). Applying these considerations to the GDPR, one recognizes immediately that this law is actually very open to innovations: it is literally peppered with legal principles and undetermined legal terms (see in particular the principles under Article 5 GDPR, for example, the purpose limitation principle, and under Article 25 GDPR, for example, the concept of risk). Here the GDPR leaves a considerable room for maneuver for the controller as well as the processors, which they can determine proactively under consideration of the characteristics of their specific case. However, this room for maneuver also leads, as already mentioned, to a considerable legal uncertainty. 2.2 Under Which Conditions Can the GDPR Offer Competitive Advantages? The Risk-Based Approach, Certificates and Codes of Conduct In fact, no observer sees the legal uncertainty associated with the GDPR as a competitive advantage. In contrast, empirical studies demonstrate that legal uncertainty generally has negative effects on companies (Hartog et al. 2011; Levie and Autio 2011). Interestingly, even if legal certainty is high, small and medium-sized enterprises hardly profit if compliance with the law means too much expenditure for them. Due to their small size, compliance costs are quickly disproportionately high (Levie and Autio 2011). This raises the question of how a legislator can design innovation-friendly laws while keeping legal uncertainty and bureaucratic costs low. With regard to the GDPR, this is possible in three ways: First, the so-called risk-based approach makes it possible to adapt the regulatory burden of the GDPR to the actual risk of the processing, which includes the amount of data to be processed (EDPB 2016). If thus the processing of personal data is not at the center of a company’s business model, its effort required to comply with the GDPR can be relatively low. This can be seen differently if the processing entails a high risk for the data subjects despite its small scope (e.g., a company processing sensitive data such as information on health or financial circumstances) or in a way that has a negative effect on data subjects. In such a case, however, the compliance effort is again proportionate due to the increased risk (Schro ¨der 2019). Second, the GDPR enables controllers and processors to proactively create legal certainty themselves. This is possible by specifying the undetermined provisions of the GDPR in two ways: either in relation to the processing of their specific products or services by means of a certificate, or together with other companies of a certain processing sector by means of a code of conduct (see Art. 40–43 GDPR). In each case, compliance with a certificate or code of conduct is considered to be an important factor in the verification of GDPR conformity (see, for example, Art. 24 (3), Art. 25 (3) and Art. 32 (3) as well as Art. 83 (3) (j) GDPR). In addition, compliance with a certificate or 123 T. Jakobi et al.: The Role of IS in the Conflicting Interests Regarding GDPR, Bus Inf Syst Eng 62(3):261–272 (2020) 263 code of conduct signals compliance with GDPR as a quality feature of their product, service or business to the consumer and/or business customer. Certificates and codes of conduct thus enable both the controller and the processor to reduce their legal uncertainty and to signal their GDPR conformity on the market. Both mechanisms, i.e. higher legal certainty and GDPR compliance as a quality feature, can be used as a competitive advantage for companies (von Grafenstein 2020). Naturally the auditing, which enterprises must accomplish in the context of a certification or a code of conduct, must not be disproportionate in itself. Therefore the GDPR makes explicitly clear that these auditing processes must take the needs of small and medium-sized companies into account (Art. 40 para. 1 a. E. and Art. 42 para. 1 sentence 2 GDPR). Also in this regard, the risk-based approach can play an important role, for example with regard to the depth of such an auditing (von Grafenstein 2020; Kamara 2017). Also, chambers of commerce and business associations play an outstanding role here. The reason for this is that they are mandated to coordinate and represent the interests of their members. Thus, to support their members setting up certificates and, even more so, codes of conduct to meet the society’s expectations of them, as well as to exploit competitive advantage, fits well in their mandate. 2.3 Business Associations as Interfaces Between Controllers, IT Providers and Customers: Coordinating the Implementation of Data Protection by Design Such a coordinating function, for example of business associations, is particularly necessary if several companies must cooperate to implement the GDPR (See Art. 25 GDPR). An important example in this regard are the requirements of data protection by design and security of processing. These provisions require the controller and partially the processor to implement the requirements of the GDPR into the technical and organizational design of their data processing. In most cases, however, the controller uses the technical solutions of third-party providers for its processing activities. These providers are not obliged or to a lesser extent to comply with the GDPR. This leads to the complex situation in which a data controller is primarily legally responsible, but can only fulfil its responsibility with the help of its IT provider. A prominent example for this situation is the Berlin-based property company Deutsche Wohnen that was recently fined 14.5 million euros by the Berlin data protection authority, particularly because they did not implement a data deletion concept on their servers. However, such a deletion concept was probably only possible for Deutsche Wohnen by using their third-party provider for their servers (Berlin Commissioner for Data Protection and Freedom of Information 2019). The interplay between the two actors does not seem to have worked sufficiently. Interestingly, IT providers can use this situation as a competitive advantage or business opportunity. The reason for this is that the main responsible controller must examine carefully which IT provider supports the controller’s activities best regarding the technical compliance of the GDPR. With legal questions, such as whether a technology corresponds to the state of the art, also here a certificate or code of conduct can act as an important element between the required and actual state (von Grafenstein 2020). With regard to its focus on the interconnection of business and internet technology, Business Informatics can pave the way for research into the development of such technical-organizational solutions and their effects on economic processes. 2.4 Three Strategies from the Point of View of the Company: From Avoidance and Prevention to Business Opportunity Following this understanding, both controllers and processors have three basic approaches for dealing with the GDPR in day-to-day business. The first strategy can be described with the expression ‘‘burying the head in the sand’’. Deutsche Wohnen probably applied this approach after the Berlin data protection authority had already pointed out the missing deletion concept during an on-site audit in 2017. The second approach follows the classic compliance logic: A data controller or processor only fulfills the GDPR requirements to the extent that it needs proof to defend itself against a ‘‘first-time fine’’ and immediately implements all additional measures if the competent data protection authority demands them. This approach has the advantage of initially low costs, but carries the risk of a competitive disadvantage if a competitor chooses the third strategy. This third strategy makes a virtue out of a necessity: A data controller or processor uses the leeway that the GDPR gives them to proactively find the best solution for their specific data processing. These controllers and processors see GDPR-compliance as a quality feature for their business customers or end users and generate a competitive advantage from it. This approach requires, however, businesses people – either working in academia or in practice – to see the GDPR not from a classical compliance perspective that hinders innovation but as an aspect in their entrepreneurial environment that they can use as a business opportunity. 123 264 T. Jakobi et al.: The Role of IS in the Conflicting Interests Regarding GDPR, Bus Inf Syst Eng 62(3):261–272 (2020) 3 Challenges with GDPR from the Enterprise Perspective – Building a Dedicated (Personal) Data Management Capability Christine Legner, Cle ´ment Labadie, Faculty of Business and Economics (HEC), University of Lausanne The GDPR represents a mindset shift in data protection regulation, and the controversial debates have not ended since it came into effect in May 2018. While some of the criticism is justified, the GDPR is a necessary and important step towards establishing data privacy in the digital economy. First, the regulation introduces greater accountability for organizations and enforces established data privacy principles that have hardly been respected in the past. Second, the GDPR gives individuals greater choice and control over their data, and thus promotes their data sovereignty. As the strictest and most farsighted approach to data protection, the GDPR has not only had a major impact on Europe, but also on an international scale and has become a ‘‘blueprint’’ for emerging data protection regulations in other countries. The GDPR has been heavily criticized, and part of the coverage it has received focuses on the difficulties in implementing it, with many considering the induced strain to be excessive, especially for small and medium size enterprises. Even more than one year after the GDPR came into effect, companies are far from being at ease with the regulation. A study conducted mid-2019 among more than 1100 executives across ten countries and eight sectors reported that only 28% of the responding organizations were compliant with the GDPR at that time, with 30% close to be compliant (Capgemini Research Institute 2019). The study also emphasizes that non-compliance is a worldwide, cross-sector issue, with increasing risks in terms of both direct fine costs and reputational damage. In dealing with the GDPR, enterprises mostly followed a pragmatic approach, addressing visible and pressing compliance issues (e.g. adapting web forms, newsletters and contracts), to achieve a basic level of compliance. However, with this approach, it is almost impossible to address the more sophisticated legal demands, specifically the information processing rights and accountability requirements, or to proactively react to violations. Fortunately, there are also some exceptions; i.e., organizations that are committed to their data responsibility and the ethical treatment of data beyond regulatory requirements, such as Mastercard 1 or Zurich Insurances, 2 that are using data protection as a competitive differentiator. The difficulties with the GDPR can be explained by the changing nature of data protection regulations. In contrast to previous regulations that could be addressed by amending contracts and general conditions, the GDPR requires companies to fundamentally rethink the way they store and process personal data on an enterprise-wide level. Hence, the GDPR is essentially about processing sensitive personal data in the enterprise – and more precisely data about customers, employees and vendors. Achieving enterprise-wide data transparency is challenging for organizations with distributed operations, that, as large as they may be, remain a single point of contact for individuals. Managers often do not have a complete picture of the data stored on heterogeneous systems and do not know how they are used in business processes either. How to correctly handle data access requests if it is not possible to locate all data records? How to explain to individuals how an organization will process their data if nobody actually knows? These questions illustrate the typical difficulties in dealing with the GDPR. Research in the Competence Center Corporate Data Quality (CC CDQ) reveals that the GDPR requires companies to build a dedicated data management capability (Labadie and Legner 2019). Based on the interpretation of legal texts and practical insights from focus groups and GDPR projects, we identified the required sets of organizational and system capabilities to comply with the regulation. The system capabilities require to redesign dataprocessing systems and are often emphasized in the GDPR debate. They comprise the abilities (1) to clearly identify, classify and locate personal data in system landscapes (Manage protected data scope); (2) to collect consent and ensure consent-based processing of information (Manage consent); and (3) to process data according to EU-GDPR’s data rights and principles (Enable data information rights). Besides these system-related capabilities, the organizational capabilities establish the required processes and responsibilities. They include the abilities (1) to coordinate and execute data protection activities (Orchestrate data protection activities); (2) to record and evaluate sensitive processing activities, as well as to document system landscapes (Demonstrate compliant data processing); and (3) to disclose information to individuals and authorities (Disclose information). In fact, these capabilities are meant to establish sustained and efficient practices. Implementing these capabilities leads to an enhanced knowledge of personal data in organizations, as well as the way it is used through its processes and systems. We argue in this way it can also support compliance with other regulations, as well as other data-related initiatives. For the BISE community, the emerging data protection regulations offer interesting research opportunities. From an enterprise perspective, key questions relate to both 1 https://newsroom.mastercard.com/press-releases/mastercard-estab lishes-principles-for-data-responsibility/. 2 https://www.zurich.com/en/about-us/corporate-governance/codeof-conduct. 123 T. Jakobi et al.: The Role of IS in the Conflicting Interests Regarding GDPR, Bus Inf Syst Eng 62(3):261–272 (2020) 265 organizational and system capabilities and their design for sustainable implementation of regulatory compliance. On the other hand, it would be interesting to conceptualize different levels of compliance for different contexts. Researchers could investigate whether and how data responsibility and ethical treatment of data translate into competitive advantages and operational excellence. 4 Ten Critical Aspects of the European General Data Protection Regulation from the Point of View of Information Systems Peter Mertens, School of Business, Economics and Society and Faculty of Engineering, University of ErlangenNuremberg 1. One critical aspect of the GDPR revolves around the high penalties a violation of this regulation may entail. According to article 83, companies violating the GDPR have to pay a fine of up to 4% of their annual sales. Considering that average profit margins in many economic sectors and industries are about 5%, with relative R&D investments being in a similar range, it becomes obvious that the maximal forfeit of 4% might jeopardize the existence of a firm. This is also why the penalty should be calculated not based on sales but on return on investment (ROI). In Germany, as of yet, the highest penalty amount (14.5 million €) has been imposed on Deutsche Wohnen, a German property firm. It had failed to delete files that were no longer needed. The fines associated with the GDPR have thus lead to a strong risk aversion among companies. 2. This risk aversion is further reinforced by legal uncertainty surrounding the GDPR. One reason for this uncertainty relates to the use of vague legal language and terms, such as ‘‘legitimate interest,‘‘‘‘under consideration of the special circumstances and general requirements,‘‘and ‘‘meaningful survey.‘‘Another reason, especially for companies operating abroad, relates to so-called ‘‘escape clauses’’ that allow for the integration of countryspecific laws and regulations in order to protect national privileges (e.g., freedom of the press). In this context, the EU Commission has criticized that some German regulations appear to be overly tight, while others seem to be overly loose, such as those regulating the appointment of data protection officers in small or medium-sized enterprises (SMEs) (Neuerer 2019). Further, in many functional areas (e.g., human resources) and industries (e.g., healthcare), the GDPR conflicts with the growing number of functionand/or industry-specific rules requiring companies to keep very detailed data records. Also, tax specialists are puzzled by the stark contrast between the far-reaching obligations around data safekeeping, on the one hand, and the ,,right to be forgotten‘‘stipulated in article 17 of the GDPR, on the other hand. For example, in Germany alone, there are 17 data protection authorities that sometimes contradict each other. Moreover, the enactment of new rules entails reciprocal effects or even additional conflicts. As a consequence, the European Court of Justice limited the ‘‘right to be forgotten’’ to the EU, which implies that Internet firms such as Google are not required to delete ‘questionable’ links entirely (Wieduwilt 2019). On the other hand, the same court ruled that a user’s explicit consent is needed, thereby making it harder for companies to use common web-tracking practices (Ritzer 2019). 3. The complexity of the GDPR also has major implications for the theory and practice of law in general (Kremer 2019; Hey 2019). For example, a survey conducted by BITKOM (‘‘Germany’s digital association’’) revealed that, one year after the GDPR came into effect, only about 25% of surveyed companies had been able to implement the GDPR rules. Additionally, in a related study, 95% of the interviewees indicated that a full implementation of the GDPR would be impossible (BITKOM e.V. 2019). 4. The goal to avoid unpredictable risks has provoked reactions that not always seem to be rational. For example, the explanatory statement of the GDPR suggests that reverting back from electronic files to paper files would not matter, since the regulation is neutral toward the ‘technology’ used. (More examples can be found in Mertens 2019 and Crocoll 2019.) 5. The GDPR implies a growing burden of fixed costs, mainly resulting from overhead expenses. While large-scale companies can spread these costs across a broad range of related business activities, SMEs often cannot. Thus, the GDPR is another factor promoting market concentration tendencies, which is not desirable in a free-market economy. Moreover, new problems surface in manufacturing units; for instance, errors detected through the collection of data during production may be traced back to flawed customer orders, inaccuracies in production planning and scheduling systems, deficiencies in raw materials and parts purchased from suppliers, logistical problems within the supply chain, as well as mistakes of machine operators. In all these cases, sensitive data may be reviewed by data protection 123 266 T. Jakobi et al.: The Role of IS in the Conflicting Interests Regarding GDPR, Bus Inf Syst Eng 62(3):261–272 (2020) officers, which in turn would lead to the revelation of company secrets (Mertens 2013; Software AG 2017; Rehaag 2019; Wuhrmann 2019). 6. The legal uncertainty surrounding the GDPR implies that firms active on the Internet will ask users/customers for increasingly detailed and therefore very comprehensive expressions of consent, written in sophisticated legal jargon. Against this backdrop, it would be naı ¨ve to assume that users will read this language thoroughly; quite the contrary, most users are likely to merely ‘‘click it away‘‘without paying closer attention, also referred to as ‘‘tiredness to agree‘‘in recent literature. This is consistent with the general observation that many citizens perceive the GDPR bureaucracy as rather annoying than helpful (Triumph-Adler 2019). 7. In some industries, the GDPR may actually turn into an ‘‘innovation barrier’’. One symptom of such a development can be seen in political efforts in the area of public health to follow through with exceptions for the collection of ‘big’ patient data in order to not impede R&D efforts concerning computerassisted diagnosis through artificial neural networks (‘‘balance between protection of data and health‘‘). Here, the German Secretary of Health argues that data protection is ‘‘something for healthy people’’ (Waschinski 2019; Knodt 2019) and has thus initiated the ‘‘digital health law’’. 8. The ‘‘backstop’’ strategies along with the additional costs and potential innovation barriers associated with the GDPR will arguably cause a loss in growth and productivity at the level of the national economy. One indicator for this is the declining number of new start-ups in Germany (-15% from 2016 to 2018) (Theile and Creutzburg 2019). An interview study with young people found that concerns about data protection bureaucracy represent one key reason for this downward trend (Koch 2019). 9. The manifold drawbacks of the GDPR seem to motivate German politicians to suggest exceptions, for example, related to work safety, finance/taxation, health (see also point 7 above), education (e.g., finegrained databases to analyze reasons of early school leaving), housing and protection of tenants, homeland security, or defense. For Germany and Austria, one potential solution to this problem may be found in the use of escape clauses (see point 2 above) in order to ‘‘take the fright from the GDPR’’. Or, more generally, to protect citizens and companies alike from ‘shady’ law firms. In this regard, it is noteworthy that very different organizations – such as the Social Democratic Party (SPD), the Christian Democratic/Social Unions (CDU/CSU), the Association of Self-Employed Entrepreneurs, the Union of Liberal Middle Class, and other powerful interest groups – are aiming at making amendments to the GDPR (Heide and Neuerer 2018). The uncertain outcomes of these efforts, however, further contribute to the overall legal uncertainty. 10. Finally, at a more abstract level, the GDPR mirrors a general problem with the EU: Given the gigantic bureaucracy in Brussels (with around 50,000 people currently being employed across all EU institutions, agencies, and bodies), there are many politicians and employees who – because of their education, socialization, and professional experience – seem to have difficulties in understanding and relating to the day-to-day problems of German entrepreneurs in general, and those of SMEs in particular. This phenomenon, for example, may be explained by Parkinson’s law, which has been applied to the growth of bureaucracy in all kinds of organizations. In conclusion, numerous present challenges resulting from the GDPR can be attributed to the problem that too many guidelines, decrees, and court decisions are intertwined and, in the worst case, contradict one another. In addition, GDPR rules require careful consideration within a short time span, straining the capacities of specialists in corporate management, legislative bodies, public administration, and the system of justice. Recent examples include the EU regulation concerning the use of electronic evidence, the decision of the European Court of Justice concerning the detailed documentation of working hours, the complex regime of country-by-country reporting, the EU guideline PSD2 concerning online payments, the A1 certificate to document the social security status of crossborder commuters, as well as the EU money-laundering guideline. To address existing GDPR challenges, one not trivial but feasible approach might be that the European Commission decided on clear priorities based on urgency. Similar to a state-of-the-art production planning and supply chain system in manufacturing, this approach would help prevent overburdening the above-mentioned national organizations, especially in critical situations, and also help ensure that the overall ‘quality’ of politics, law, public administration, and corporate management does not suffer. 4.1 What Can BISE Do? A first step could be to develop a cost–benefit analysis or a forecast of the implications for modules of regulations where several alternatives exist. For example, Germany could have one data protection institution at the federal level versus one data protection office in each state. This task is not trivial, but seems feasible. Maybe knowledge 123 T. Jakobi et al.: The Role of IS in the Conflicting Interests Regarding GDPR, Bus Inf Syst Eng 62(3):261–272 (2020) 267 from the research field ,,centralization or decentralization of the IT function’’ could be used. In a second step, one could aim at transferring knowledge from computer-assisted production planning to something that could be called ‘‘computer-assisted legislation planning‘‘or ‘‘computer-assisted administration planning‘‘. The process could be to develop – together with accountants as well as specialists for production planning in the manufacturing industry and specialists for data processing in public administration – a prototype to adjust the load of new bureaucratic regulations to enterprises of different sectors. This algorithm should be based on empirical estimations of the person-hours in firms of various industries and size. Then the so-called capacity profile can be calculated by adding the capacity needs of different regulations over the time axis. Depending on the results in terms of ‘‘summits’’ and ‘‘valleys‘‘, the European Commission would plan its own activities, e.g. sessions in the EU-Parliament, and postpone or bring forward the publication and effective date of laws and regulations, whereby the restrictions of the Commission and of the firms should be considered. 5 Information Systems and the General Data Protection Regulation – A Consumer Protection Perspective Ayten O ¨ksu ¨z–Consumer Association of North RhineWestphalia (Verbraucherzentrale Nordrhein-Westfalen) From the perspective of consumer protection, the General Data Protection Regulation (GDPR; Directive (EU) 2016/679) is a step in the right direction which updates our data legislation. This is why the consumer association of North Rhine-Westphalia welcomes the GDPR. The regulation entails several new principles that aim to empower individuals in gaining more control over their data in a world of growing technological complexities. 5.1 Why is This So Important? Technologization and digitization are increasingly affecting all areas of life. We shop online, network on social media, use wearables and fitness trackers to keep an eye on our activities and health, and turn the lights on or off with the help of smart speakers. All these new technologies and services can be seen as significant advances which are creating opportunities for people such as simplification of daily life and more convenience. A side-effect is the great amount of data produced through the use of these numerous smart devices and services. With the help of big data analytics, large volume of data can be examined to bring to light information such as unknown correlations or hidden patterns. On the one hand, this information can be used in a positive way. The application of big data in healthcare, for example, can save life as analyzing specific health data of a population has the potential to prevent epidemics or to cure diseases. On the downside, in many cases, this data is collected and examined by companies, which do not always act transparently. Parts of the data may seem harmless enough on their own. However, most of the consumer data allows companies to draw conclusions about, e.g., personal preferences, lifestyle habits, religious confessions or diseases, which can also have negative consequences for consumers such as unwanted personalized ads, profiling or discrimination (e.g., in terms of insurance). This is why big data also brings along great privacy concerns. Merging and linking user data that was collected over a long period of time and across distinct devices, products or services even intensifies these privacy concerns. As digitization is progressing steadily, data is being collected at an incredible rate, and thus consumers are unable to keep track of which and by whom personal data relating to them is stored and analyzed. A recently published report of Amnesty International even concludes that the business model of Google and Facebook threatens human rights (Amnesty International 2019). In this context, the non-governmental organization warns against – what they call – the ‘‘omnipresent surveillance of billions of people’’. Therefore, it is necessary to increase the attention everyone pays to data and to reduce bad practice and the bad players by regulating how data is being used in a reasonable, legal and ethical way. This applies to the person who decides on the business model behind an offered service or product as well as to the person who develops the tools, technologies, and algorithms capturing and analyzing data about their users. The GDPR opens up new possibilities to deal with these emerging challenges by making it easier to demand greater transparency and accountability from those who collect and use data. It also provides consumers with more control over their data. For example, requirements for the comprehensibility of privacy policies have increased and information about how and by whom data is collected and used has to be properly disclosed to consumers. Companies that violate the principles of GDPR face higher monetary penalties so that also big players in the market, which do not act in accordance to data protection law yet, are now forced to change their behavior. According to the ‘‘privacy by default’’ obligation, which is one of the key requirements of the GDPR, data controllers must implement appropriate technical and organizational measures ensuring that only such personal data is collected that is necessary for the specific purpose mentioned. Thus, the minimum amount of personal data 123 268 T. Jakobi et al.: The Role of IS in the Conflicting Interests Regarding GDPR, Bus Inf Syst Eng 62(3):261–272 (2020)