A central concern of interest group scholars is the question of how interest groups align on different sides of a lobbying battle. Specifically, are interest group mobilisation patterns skewed or biased towards one set of interests and not another? This question, while relevant in various lobbying systems,Footnote 1 is particularly salient in the case of the European Union (EU). EU interest group scholars have long characterised the EU lobbying system in terms of elite pluralism, where business interests are systematically advantaged over citizen groups and non-governmental organisations (NGOs) (Streeck and Schmitter Reference Streeck and Schmitter1991; Mazey and Richardson Reference Mazey and Richardson1997; for a competing view see Eising Reference Eising2007). Indeed, empirical surveys of the EU interest group population consistently show how business interests are better represented in Brussels than their not-for-profit counterparts (Broscheid and Coen Reference Broscheid and Coen2007; Berkhout and Lowery Reference Berkhout and Lowery2008; Messer et al. Reference Messer, Berkhout and Lowery2010; Wonka et al. Reference Wonka, Berkhout, Baumgartner and Mahoney2010; Rasmussen and Carroll Reference Rasmussen and Carroll2014; Berkhout et al. Reference Berkhout, Carroll, Braun, Chalmers, Destrooper, Lowery, Otjes and Rasmussen2015). Rather than being fair and equal, ‘one of the most consistent findings in interest group research’ is that interests are rarely, if ever, aligned evenly on different sides of an issue and that lobbying patterns in the EU tend to be highly skewed (Berkhout et al. Reference Berkhout, Carroll, Braun, Chalmers, Destrooper, Lowery, Otjes and Rasmussen2015, 12).
The issue of skewed alignment has given rise to an impressive amount of empirical research. Scholars take up the fundamental task of mapping out the EU lobbying footprint by attempting to establish the population of interest groups active in Brussels (Kohler-Koch Reference Kohler-Koch1997; Berkhout and Lowery Reference Berkhout and Lowery2008; Wonka et al. Reference Wonka, Berkhout, Baumgartner and Mahoney2010; Greenwood Reference Greenwood2011). Others, assessing a host of structural and actor-level variables, examine when and why interest groups mobilise as well as how “diverse” (i.e. how many different types of groups mobilise) this set of actors tends to be (Broscheid and Coen Reference Broscheid and Coen2007; Berkhout and Lowery Reference Berkhout and Lowery2008; Messer et al. Reference Messer, Berkhout and Lowery2010; Rasmussen and Carroll Reference Rasmussen and Carroll2014; Chalmers Reference Chalmers2015). Scholars have also linked alignment patterns to interest group success in lobbying, showing how success is a function of the aggregate resources (e.g. finances, personnel, information and expertise) of interest groups aligned on competing sides of an issue (Baumgartner et al. Reference Baumgartner, Berry, Hojnacki, Kimball and Leech2009; Klüver Reference Klüver2013). Finally, a recent contribution by a group of leading interest group scholars examines the question of alignment from the perspective of what an “unbiased” lobbying system would look like in an ideal interest group system (Lowery et al. Reference Lowery, Baumgartner, Berkhout, Berry, Halpin, Hojnacki, Klüver, Kohler-Koch, Richardson and Schlozman2015).
There is thus no paucity of research on the question of alignment. The existing scholarship is impressive and has led to some cumulative findings about the EU lobbying system. Nevertheless, we argue that one fundamental question still tends to be overlooked. Specifically, which factors determine lobbying sides in the first place? Where scholars have sought to map out and explain mobilisation patterns, they have occluded the alignment of groups on different sides of an issue. And where scholars have painstakingly coded group alignment on different sides of an issue, these data are used as independent variables explaining some other phenomenon (e.g. group success). The main contribution of this analysis is that we take alignment patterns (understood in terms of lobbying sides, or how groups align either in support of a policy or in opposition to it) as our dependent variable. Our central goal is to discern the factors that explain alignment patterns assessed at the level of the individual interest group and examined with regard to a specific EU policy proposal.
The one study, to our knowledge, that does take alignment patterns as a dependent variable, Bunea (Reference Bunea2015), explains alignment in terms of formal coordination amongst interest groups via their membership in national and European associations. While presenting a compelling argument, one shortcoming of this study, and something that we seek to address here, is its perfunctory treatment of factors explaining alignment that are unrelated to explicit coordination. This includes how alignment results from interest groups sharing similarities in terms of group organisation structure or type. While these factors are included as part of our analysis, we build on Bunea (Reference Bunea2015) by explaining interest group alignment not only in terms of what groups are (e.g. group type) but also in terms of what groups do (e.g. their activity across different economic sectors). Importantly, and as we discuss in greater detail below, we find that what interest groups do tends to matter considerably more than what groups are.
Our analysis of alignment begins with the observation that policy context matters. Each lobbying battle is over a set of specific issues that, in turn, impact lobbying behaviour, lobbying strategies, the extent of group influence and more importantly patterns of interest group alignment (Klüver et al. Reference Klüver and Mahoney2015).Footnote 2 To hold the policy context constant we have opted to narrow the empirical focus of this analysis to lobbying on one specific, highly salient, and recent EU regulatory issue: namely, the proposed General Data Protection Regulation (GDPR). Aimed at shoring up critical weaknesses in the existing 1995 Data Protection Directive – like suspending the current EU-United State (US) Safe Harbour Agreement that allows American companies to handle European citizens’ data without using the EU’s stringent data protection rules – the proposed regulation ‘has been one of the most lobbied pieces of European legislation in European Union history’ (Long Reference Long2014, 1).Footnote 3 Indeed, there is widespread conjecture that the GDPR has been subject to excessive and undue lobbying pressure levelled at weakening the new regulation and, in particular, shaping it in the interests of a small number of very powerful private-sector firms (see Anonymous 2013, 180). A high-profile scandal in 2012 is a case in point: several Members of the European Parliament were caught ‘copying-and-pasting’ industry policy requests directly into legislative amendments for the GDPR (for an overview see Clark Reference Clark2013). The scandal captured news headlines, and highlighted the lobbying power exerted by US internet and retail giants, like Amazon and eBay.
This article seeks to explain interest groups’ preference alignment for the GDPR, either lobbying for or against it. Our main argument is that interest group preference alignment is a function of industry-specific costs related to regulatory change. Generally speaking, there is a surprising paucity of research seeking to explain interest group preferences (Newman Reference Newman2010, 1289). The work that does exist tends to focus on national institutional contexts (where groups operate) and interest groups’ permanent characteristics, whether business associations or NGOs (what groups are). While presenting a compelling picture, we argue that these explanations only take us so far in understanding how groups align on different sides of a lobbying battle, expressing support or opposition for some new proposal. In addition to “where groups operate” and “what groups are”, we argue that preferences are a function of “what groups do”. In specific terms, support for or opposition to a new legislative proposal is related to the immediate costs that regulatory change imposes on a specific industry. Industries that anticipate immediate cost increases will lobby to oppose change or will lobby in favour of retaining the status quo, while industries that anticipate cost decreases or no increases will lobby to support change. Our argument, while straightforward, marks an important advance on existing work. First, we suggest that industry costs are not country specific, but rather have a transnational character. While state institutions may moderate preferences, industry actors express preferences that are not circumscribed by state boundaries. Second, studies that rely on permanent interest group characteristics to explain group preferences, making a key distinction between business and NGOs, occlude important intra-business differences. Our explanation takes these differences seriously, focussing on the different “costs” that specific industries face in light of regulatory change.
The basis of our analysis is a novel data set derived from interest group lobbying on the European Commission’s GDPR consultations. This consists of lobbying positions taken by 279 individual interest groups on three separate GDPR consultations over a three-year period (2009–2011). Statistical analyses reveal several key findings. We find some evidence that preference alignment is a function of industry-specific costs. In particular, groups representing the interests of the financial and retail sectors are much more likely to wage a trenchant defence of the status quo than other sectors. Both sectors routinely handle vast amounts of sensitive personal data, are the primary targets of cybercrime and data breaches, and also stand to face high fines for failing to comply with the new EU rules. As such, groups representing finance and retail are highly incentivised to lobby against the GDPR. Nevertheless, we also find these effects are not consistent across other sectors that are susceptible to such fines. Instead, lobbying in support of the GDPR is far more widespread and involves a large, heterogeneous group of interests. In other words, when it comes to choosing sides, in this case lobbying is highly skewed towards support for the GDPR. These conditions, we argue, are conducive to substantial policy change and help explain why the defence of the status quo, commonly a strong position from which to lobby, failed in this case.
Explaining patterns of support and opposition for the GDPR
The EU has long acted as a global standard setter for internet privacy and data protection. Its 1995 Data Protection Directive enshrined in law the individual’s right to control the collection, dissemination and storage of personal information. Perhaps most innovative, the Directive, through its “extraterritorial clause”, applies equally to personal data disseminated across EU member state borders as well as data shared with third-party countries. Indeed, the Directive has become the de facto international standard with more than 30 countries now following the EU’s approach (Newman Reference Newman2008, 104; De Hert and Papakonstantinou Reference De Hert and Papakonstantinou2012, 131). Since 2012, efforts to strengthen the Directive and increase its scope and power have been underway. The proposed GDPR increases legal harmonisation across the EU’s member states, strengthens monitoring and compliance mechanisms, closes legal loopholes that allow for the existence of “data havens”, and even suspends the current EU-US Safe Harbour Agreement (Voss Reference Voss2014; Gyves Reference Gyves2015). For Kuner (Reference Kuner2012), the new Regulation marks nothing less than a “Copernican revolution” in EU data protection law.
The importance and scope of the GDPR for both EU member state and third countries help explain intense lobbying efforts to shape the new Regulation. Nevertheless, despite considerable conjecture about lobbying on the GDPR, there is as yet very little scholarly work addressing this issue. The scant work that has been done can be categorised into two broad explanations, one related to differences across countries and their existing institutions, and the other related to differences among different types of interest groups.
First, scholars have long acknowledged that market integration in Europe creates new sets of “winners” and “losers”, both inside and outside of the Union. For EU members, the Europeanisation literature suggests that when there are changes at the European level, how closely these changes fit with what already exists at the domestic level defines the member state’s reaction to the new policy (Risse et al. Reference Risse, Cowles and Caporaso2001; Börzel and Risse Reference Bouwen2003; Ladrech Reference Ladrech2010). Poor fit implies strong adaptational pressure while good fit implies weak pressure. Where there is strong pressure, we would expect more interest group resistance and activism towards the proposed measure. Adaptational pressures are also felt by non-EU member states. Powerful states can seek to limit adjustment costs, ensuring that new (international) arrangements correspond as closely as possible to their pre-existing national regulatory frameworks (see Simmons Reference Simmons2001). More often, however, new EU standards often “force global competitors […] to meet similar requirements at home” (Vogel Reference Vogel2012, 8). Once again, pressure corresponds to the gap between existing third-country domestic rules and EU rules.
In the particular area of data protection, the fit/misfit between EU and third country rules has been used to explain the considerable resistance of the US government and US-based firms towards the EU’s 1995 Directive. The Directive favoured a top-down, government-led approach, while the US drew on its longstanding tradition of self-regulation and limited government involvement. While in Europe privacy is considered a fundamental right to be protected by the state, the US “prefers a more market-oriented approach to data protection” (Bessette and Haufler Reference Bessette and Haufler2001). These differences across the two systems translated into adjustment costs that were unfavourable to US firms. To adopt EU rules would have effectively imposed a high “regulatory tax” on companies accustomed to less stringent rules (Bessette and Haufler Reference Bessette and Haufler2001, 71). The resulting Safe Harbour compromise applied EU rules to US firms but via a self-regulatory approach. Since first being introduced in 1998, Safe Harbour has been the subject of much criticism, with several studies revealing serious compliance issues of many US firms handling personal data but not meeting the EU’s minimum requirements (European Commission 2002a, 2004; Rossi Reference Rossi2014, 70f).
A second explanation for variation in interest group lobbying demands is related to interest groups’ permanent characteristics. Most importantly, different types of interest groups are expected to have certain regulatory preferences based on the costs imposed by a new regulation (Dür and Mateo Reference Dür and Mateo2016). A central distinction is made between so-called diffuse interest groups (like cause groups and NGOs) and concentrated interest groups (like business associations and firms). Diffuse groups, insofar as they represent the interests of broad segments of society and lack a well-delineated constituency (Walker Reference Walker1991; Beyers Reference Beyers2002, 589, Reference Beyers2004, 216; Baroni et al. Reference Baroni, Carroll, Chalmers, Muñoz Marquez and Rasmussen2014, 145), have “diffuse” preferences that tend to focus on “general principles like equity, social justice, and environmental protection” (Dür and Bièvre Reference Dür and Bièvre2007, 82). Concentrated interests, by contrast, represent narrow, socio-economically defined and concentrated constituencies (Beyers Reference Beyers2004, 216), and hence reflect industry-specific preferences, most often articulated in the form of expert and technical information about policy proposals (Bouwen Reference Börzel and Risse2004). In broader terms, diffuse interests tend to express preferences that advocate on behalf of the public good, while concentrated interests express preferences that serve their own narrow interests. How do these assumptions work in the context of regulatory issues and, specifically, the GDPR?
The collection, storage and use of personal data is big business and the GDPR will change the way this business is done, striking a new balance between economic winners and losers. Former European Commission Vice President in charge of fundamental rights Vivienne Redding puts this in perspective: “the estimated value of EU citizen’s data was €315 billion in 2011” and “has the potential to grow to nearly €1 trillion annually in 2020” (cited in Voss Reference Voss2014, 19). Private-sector interests therefore have a clear incentive to “acquire as much information about their customers as possible” as this “information-gathering facilitates marketing and sales strategies” (Drezner Reference Drezner2007, 103). In protecting an individual’s right to manage their own personal data and imposing more stringent rules on firms seeking to profit from the use of this personal data, the new regulation clearly presents different costs for different types of interest groups. Specifically, there is good reason to expect a marked difference in support for the GDPR between concentrated interest groups (like individual firms and business associations) and those groups representing diffuse interests (like NGOs, consumer protection groups and citizen groups). Indeed, for concentrated interests more stringent regulations can set a limit to potential earnings from the use of personal data. According to the new regulation, large companies with over 250 employers will need to take on the additional cost of employing an in-house “data protection officer” with expertise in data protection law (GDPR, Article 35). Further, more stringent mechanisms for ensuring compliance to the GDPR could see firms facing fines up to 20 million euro for instances of noncompliance. Finally, the GDPR has been criticised for doing little to streamline the protection of “employee data”, which for most companies constitutes their “biggest database”, and hence biggest challenge (Mooney Reference Mooney2013). The Brussels European Employee Relations Group, a Brussels-based think tank, estimates that “the employee related data provisions alone could add €3 billion each year, in additional costs to business” (Mooney Reference Mooney2013). The GDPR clearly imposes high costs to private sector interests. By contrast, NGOs, including consumer protection groups and citizen groups, do not face any of these increased costs. What is more, NGOs are well positioned to represent the “public interest” when it comes to protecting personal data and should therefore welcome the new regulation.
Industry-specific costs and lobbying preferences
The national institutional context and assumptions related to interest group type take us some distance in understanding group preferences. However, we argue that this is only part of the story. In addition to “where groups operate” and “what groups are”, we argue that lobbying preferences are largely shaped by “what groups do”. In other words, lobbying preferences are shaped by industry-specific factors that transcend the specifics of national institutional context and assumptions about the permanent characteristics captured by “group type”. Different industries are differently impacted by regulatory change, imposing higher immediate costs on some industries, and lower (or no) immediate costs on others. These costs may be mediated by national institutions, but tend to operate primarily at a transnational level. Further, we acknowledge that there is a clear overlap between concentrated interest groups and groups that represent industry preferences. Nevertheless, our argument about industry-specific costs presents a far more nuanced picture of how costs are distributed not only across concentrated and diffuse groups, but across different industries within the umbrella category of concentrated interest groups. As such, our approach marks an advance on existing studies.
How do industry-specific differences translate into differences in lobbying preferences? First, it is important to note that a sector-specific explanation of firm-level preferences is already commonplace in scholarship explaining global trade patterns. For instance, the well-established Heckscher-Ohlin factor endowments theory explains support for free trade as a function of the perceived costs and benefits of trade policies to specific firms in different sectors. Firms operating in sectors with abundant endowments stand to gain more and therefore offer more support than firms in less well-endowed sectors.
Internet governance is far less static than more traditional economic sectors, like resource extraction or manufacturing. As such, when it comes to the Internet and the use of personal data, it is more difficult to assess differences in terms of factor endowments. Newman (Reference Newman2010) makes an important contribution to this line of inquiry. Examining firms’ preferences for earlier attempts to regulate the use of private data, Newman argues that preferences are determined by a firm’s “stock of information assets”. Firms that are rich in information assets will treat information as a private good and will therefore support efforts to limit information access. In other words, they will support more stringent data protection regulation. Firms that have few information assets will treat information as a public good and will resist efforts to limit information access (Newman Reference Newman2010, 1287). Newman’s approach marks an important advance on existing studies, especially on research that relies heavily on a national institutional context explanation. In particular, Newman stresses the potentially transnational nature of firm preferences. However, Newman’s research limits itself to an examination of the financial services sector and examines variation in “information assets” by comparing countries with a large number of large banks (a proxy for a greater amount of information assets) versus countries with more small- and medium-sized banks (a proxy for fewer information assets). While focussing on industry-specific costs, Newman’s research is constrained in what it can tell us about variation in information assets across different industries.
Anecdotal evidence from recent reports is able to shed some light on industry specific differences, examining how IT firms, like Facebook and Twitter, operating in sectors that presumably stand to lose the most from the new regulation, behave differently when it came to lobbying on the GDPR. First, evidence from recent lobbying campaigns places these specific firms at the heart of recent lobbying efforts (Clark Reference Clark2013). After all, social media represent a massive and relatively untapped source of valuable information on personal and consumer habits. Recent studies also suggest that financial industry firms as well as retailers will also be hit hard by the GDPR (European Data Protection Supervisor 2014; Long Reference Long2014; Rogers and Carman Reference Rogers and Carman2015). Financial industry firms and retailers host a vast wealth of information on sensitive bank account data, including credit and debit card purchases as well as data stored in data payment systems. In handling “billions of financial records and transactions” daily, the finance and retail sectors are at risk of cyber-attacks, data breaches and identity theft. A 2014 report on data breaches by industry type shows that data breaches have not only increased by nearly 49% since the previous year, but that most breaches occur in the financial services sector (about 12% of all data breaches) and, in a close second place, in the retail sector (Breach Level Index 2014). These increased occurrences of data breaches would constitute a lack of compliance under the GDPR. Drawing on this knowledge, a recent survey of European professionals had many experts predicting that a financial firm would be the first to face noncompliance fines imposed by the European Commission after the GDPR takes effect (Dunn Reference Dunn2015; Green Reference Green2015). Taking these insights together, we posit our central hypothesis:
Industries facing the largest potential immediate costs related to a new regulation will oppose the new regulation while those facing fewer or no immediate costs will support it.
Research design
In what follows we will provide details concerning data collection and operationalisation for our hypothesis, alternative explanations, as well as for several control variables. We begin with a discussion of the dependent variable.
Lobbying preferences
Data for this analysis is largely derived from the European Commission’s public consultations on the GDPR.Footnote 4 The Commission is mandated to consult widely on important legislative measures, inviting a broad range of individuals and groups to weigh in on new policies or policy changes (European Commission 2002b). The GDPR was no exception, with the Commission holding three consultations over a 32-month period starting in 2009 and ending in 2011. This includes: (1) “Consultation on the legal framework for the fundamental right to protection of personal data”; (2) “Consultation on the future European Union (EU) – United States of America (US) international agreement on personal data protection and information sharing for law enforcement purposes”; and (3) “Consultation on the Commission’s comprehensive approach to personal data protection in the European Union”.Footnote 5
Consultation data are useful insofar as they provide an accurate picture of lobbying patterns on the GDPR, including which specific groups lobbied and what their preferences were regarding the new regulation. Consultation data are now a relatively well-established approach to assessing interest group lobbying patterns as well as lobbying influence. Lobbying patterns evinced in consultation participation offer several empirical advantages for research. Namely, barriers to participation are low since lobbying briefs are submitted via an online tool, ensuring that lobbying is not skewed towards those groups with superior resources (e.g. concentrated interest groups) or privileged access to decisionmakers (e.g. the social dialogue mechanism). Second, consultation documents give us direct insight into the lobbying preferences of individual groups on specific policy issues. We code Lobbying preferences as they are articulated in the GDPR consultation documents on an ordinal scale where 1=preference for less stringent regulation, 2=preference for retaining the existing 1995 EU directive (status quo) and 3=preference for more stringent regulation (i.e. for the new GDPR). This approach to coding preferences is based on Yackee and Yackee (Reference Yackee and Yackee2006). However, rather than coding preferences for more or less regulation, we adapt Yackee and Yackee to capture preferences for degrees of stringency. A similar approach is used in Young and Pagliari (Reference Young and Pagliari2017).Footnote 6 To ensure data quality, we engaged in a test for inter-coder reliability (with two additional coders each coding 20 randomly selected consultation documents from the complete data set) and can report a Krippendorff’s α of 0.755 (for nominal data).
Industry-specific costs
Our hypothesis predicts that an interest group’s lobbying preference is a function of the specific costs regulatory change would impose on certain industries. Some industries will face higher costs than others. A central challenge of operationalising this hypothesis is to accurately and reliably pinpoint industries that stand to face the highest costs with the implementation of the GDPR and differentiate these from other, less threatened industries. Some industry-specific differences were already intimated above, especially as they relate to the immediate costs associated with noncompliance. In other words, certain industries, due to the nature of their work and their access to and use of data, are simply more likely to find compliance to the new GDPR guidelines more difficult than others. Our approach to pinpointing these industries is to use data from the Breach Level Index, a centralised database that records publicly disclosed data-breaches of differing severity (including identity theft, financial access, account access, existential data and nuisance) across the globe and spanning 2013–2017.Footnote 7 The Breach Level Index also disaggregates data breaches by industry, indicating the specific industries for which breaches pose the most formidable challenge. Aggregating data from 2013 to 2017, the Index provides a list of the most impacted industries based on the total percentage of breaches over the four-year period: technology (including social media) (43%), retail (9%), financial services (including insurance) (7%), entertainment (5%), health care (3%), education (2%) and hospitality (1%).Footnote 8 To classify each of the 279 interest groups that lobbied on the GDPR according to these industry categories required several steps. First, we coded each interest group by their main industry activities according to the International Standard Industrial Classification scheme (ISIC rev. 4), a United Nations system for classifying diverse economic sector activities. This approach to coding is consistent with a growing body of interest group research (e.g. see Beyers et al Reference Beyers, Chaqués Bonafont, Dür, Eising, Fink-Hafner, Lowery, Mahoney, Mahoney and Naurin2014). The results of our coding are outlined in Table 1.
Interest groups by economic activity
Note: ISIC=International Standard Industrial Classification.
Next, we used this ISIC coding to generate industry sector dummy variables for those industries identified in the Breach Level data set: Finance (financial service activities, except insurance and pension funding; insurance, reinsurance and pension funding, except compulsory social security; activities auxiliary to financial service and insurance activities); Retail (retail trade, except of motor vehicles and motorcycles); Technology (telecommunications; manufacture of computer, electronic and optical products); Health (human health activities); Entertainment (motion picture, video and television programme production, sound recording and music publishing activities; programming and broadcasting activities); and Hospitality (travel agency, tour operator, reservation service and related activities). The reference category for all of these binary indicators is based on the industry categories not identified by the Breach Level Index (and hence those industries facing fewer potential costs related to the new GDPR rules).
Alternative explanations
To get a sense of the relative explanatory power of our hypothesis, we also examine the two main alternative explanations discussed above: country-level institutional context and interest group type.
First, differences related to national institutional context were operationalised by focussing on each country’s relative adjustment costs vis-à-vis the GDPR and especially each country’s position on the status quo, namely the 1995 directive. First, the US would face considerable adjustment costs with the new GDPR insofar as American firms were protected under the Safe Harbour agreement. Using the list of all US organisations that fall under this agreement we created a dummy variable (Safe Harbour) for all organisations in our data set that operated under Safe Harbour.Footnote 9
In addition to Safe Harbour, there are also some important differences among EU member states when it came to transposing the 1995 directive into national law. In particular, France, Germany, Ireland and the Netherlands were delayed in the process of transposition and even faced legal challenges levelled by the European Court of Justice.Footnote 10 While all five of these member states ended up transposing the directive into national law, the fact that these states were late compliers suggests some level of adjustment costs in each instance. We coded each interest group in our data set first according to their country of origin and then we created a dummy variable, Late compliers, for groups from France, Germany, Ireland and the Netherlands.
Second, we control for interest group permanent characteristics, or, in other words, interest group type. To this end we coded each interest group that lobbied on the three GDPR consultations in terms of “interest group type” using data and categories of interest groups derived from the European Commission’s Transparency Register.Footnote 11 Specifically, coding required matching the 279 groups that participated in GDPR consultations to data from the Commission’s Register. The categories of interest group type used in the Register include trade, business and professional associations, companies, NGOs, trade unions, law firms, think tanks, consultancies, public authorities and public/mixed entities. An overview of this coding can be found in the Online Appendix. Using these data, we recoded interest group types into two categorical indicators: first, one indicator for Concentrated Interest Groups (a category including companies, trade business and professional associations, professional consultancies, law firms and self-employed consultants); second, an indicator for Diffuse Interest Groups (NGOS, cause groups, citizen groups, religious organisations).
Control variables
First, we include a control variable for Public Salience, or public awareness of the GDPR. Greater public awareness of a given legislative proposal can have the effect of shaping interest group lobbying preferences. When awareness is high, it brings lobbying debates and lobbying practices into the light of day and might make lobbying to oppose legislative change more difficult. This is especially the case when these changes entail a move towards more stringent regulation. We measure Public Salience using data from the Special Eurobarometer 359, Attitudes on Data Protection and Electronic Identity in the European Union.Footnote 12 Specifically, we recorded individual responses for the question: “How important or not is it for you to have the same rights and protections over your personal information regardless of the EU country in which it is collected and processed?”. Higher levels of importance attached imply higher levels of support for the harmonisation of EU data protection rules, as proposed in the GDPR. Data for Public Salience are measured at the country-level.
A further control variable is related to the “level of interest” for each interest group in our data set: either European Interest or National Interest. In general terms, interest groups with European-level interests could be expected to demand further European integration and regulatory harmonisation than those with National-level interests, who tend to be more reluctant to see power shift from national governments to the EU-level. These insights lead to a specific expectation with regard to the link between level of lobbying and preferences concerning the GDPR. Namely, the 1995 Data Protection rules took the form of an EU directive, leaving considerable discretion in the interpretation and implementation to national governments. By contrast, the proposed GDPR is a regulation, shifting more power to the EU and promising a much greater level of harmonisation and compliance across member states (see Hix and Høyland Reference Hix and Høyland2011, 78).
Finally, we include a control variable for interest group staff: the number of people employed by an interest organisation involved in lobbying activities. Interest groups with more staff have certain informational and strategic advantages over other groups. They tend to be better informed, are better able to engage in meaningful lobbying activities, and are also better connected to other interest groups. Staff-related advantages do not have a deterministic effect on an interest group’s lobbying preferences. However, these advantages may allow an interest group to overcome or defray adjustment costs captured in our variables Safe Harbour and Late compliers, as well as expected differences related to interest group type. Data are derived from the European Union Transparency Register. Descriptive statistics for all indicators used in this analysis can be found in the Online Appendix.
Analysis
To examine our central hypothesis, we test a series of multilevel regression analyses where we use random intercepts at the consultation and country levels as we expect lobbying preferences to vary across the specifics of each consultation and also be shaped by country-level factors that are otherwise not captured by our other indicators. As our dependent variable, Lobbying preferences, is measured on an ordinal scale (taking three ordered values) we estimate models using ordered logistic regression analysis. Results for five regression models are presented in Table 2. To test the robustness of our results, we also estimate the same models using logistic regression analysis (and a recoded version of our dependent variable) and multinomial logistic regression analysis (using our original dependent variable but ignoring the ordering of its values). Results of these robustness tests are consistent with our main findings, and are presented in full in the Online Appendix.Footnote 13 Model 1 is a baseline model; Model 2 adds indicators to test assumptions about national institutional context; Model 3 tests assumptions about the differences between interest group types (concentrated versus diffuse): Model 4 tests our hypothesis about industry-specific costs; and finally Model 5 tests all indicators together in a single model. Importantly, due to a lack of data, two sectors, namely health and hospitality, were dropped from this analysis. Finally, a test for multicollinearity among our independent variables revealed no issues.
Ordinal logistic regression analysis of the determinants of interest group preferences
Note: Odds ratios with standard errors in parentheses.
*p<0.05, **p<0.01, ***p<0.001.
To begin with the broader context, our regression results provide some interesting and unexpected results related to our control variables. First, we find no significant differences related to Staff or Public Salience. Having more lobbying staff may afford interest groups certain lobbying advantages, but it does not shape their preferences in a meaningful way. Similarly, public awareness about harmonising data protection rules across the EU does little to shape lobbying preferences. Second, we do find that having European-level interests matters. Nonetheless, contrary to our expectations, interest groups representing European-level interests are more likely to prefer the status quo, a finding that is consistent across all of our regression models. One explanation for this result is that having European-level interests does not categorically exclude groups that might oppose integration. A group’s interest in European-level lobbying may also be to lobby for less integration. This is essentially about the extent to which our indicator for “level of interest” only captures groups that support integration. For instance, looking closely at the consultation data, some of these European-level interest groups are based in the financial sector, favouring the status quo. Similarly, in their consultation input, some European-level groups, like the European Privacy Association, comment on the implications of the GDPR both for citizens and multinational companies, while a “global-level” group, Privacy International, focusses solely on citizens.
Second, we find some support for alternative explanations. Specifically, our results suggest that national institutional factors shape lobbying preferences. As we can see in model 2, while Safe Harbour shows no significant differences in any of the models, interest groups from so-called Late complier countries (EU member states that were hesitant in the transposition of the 1995 Directive) tend to be more likely to support the GDPR. Figure 1 plots the marginal effects of Late compliers on Lobbying preferences. Not only is the probability of supporting the GDPR about 10% more likely for late compliers, but the tendency to support the status quo is about 20% lower.
Effects of late compliers on lobbying preferences. Note: Based on estimations in model 2. Markers depict the marginal effects on the dependent variable. Vertical lines depict the 95% confidence intervals. GDPR=General Data Protection Regulation.
These findings challenge our expectation that interest groups in states facing high adjustment costs will oppose regulatory change and greater regulatory stringency. How did late compliers become supporters of the new Regulation? One explanation is that these member states, having already capitulated on any sticking points regarding data protection rules, were now in a good position to adopt the new GDPR rules. In other words, the adjustment costs of implementing the 1995 directive had already been paid. The widespread support for the GDPR in our data gives some purchase to this interpretation. In fact, interest groups from the so-called late compliers, namely France, Germany, Ireland and the Netherlands, show some of the highest levels of support for the GDPR compared to interest groups from other countries.
Our expectations regarding interest group type were also partially met. The results in model 3 for diffuse interest groups (NGOs, cause groups and citizen groups) do not seem to have any significant bearing on lobbying preferences. Concentrated interests, however, like firms and business associations, are, as anticipated, more likely to oppose the GDPR than to support it. Again, plotting marginal effects for Concentrated interest groups (Figure 2) helps us interpret these results. We can see that the probability of supporting the GDPR is about 20% lower for Concentrated interest groups than other types of interest groups. At the same time, the probability of lobbying in defence of the status quo is about 10% higher.
Effects of concentrated interest groups on lobbying preferences. Note: Based on estimations in model 3. Markers depict the marginal effects on the dependent variable. Vertical lines depict the 95% confidence intervals. GDPR=General Data Protection Regulation.
Our results support the notion of a status quo bias in public policy. As Baumgartner et al. (Reference Baumgartner, Berry, Hojnacki, Kimball and Leech2009, 19f) explain, whatever power advantages concentrated interest groups have is already reflected in existing policies. If wealthy and powerful concentrated interests are “more prone to get what they want” in terms of policy outcomes, “they should already have gotten what they wanted in previous rounds of the policy process”. The implication is not only that public policy is shaped by powerful interests, but these same powerful interests have a considerable incentive to protect the status quo. And this is precisely what we are seeing in our results.
Coming to our central argument, our regression results provide some support for our hypothesis. Results presented in models 4 and 5 suggest, indeed, that organisations operating in several industries that are uniquely susceptible to data breaches are more likely to oppose the GDPR. Specifically, our results show a strong negative correlation between organisations in finance and retail and preferences concerning the GDPR. Results for technology and entertainment, however, show no significant differences in our models. Marginal effects for all four industries are plotted in Figure 3.
Effects of sector-specific costs on lobbying preferences. Note: Based on estimations in model 4. Markers depict the marginal effects on the dependent variable. Vertical lines depict the 95% confidence intervals. GDPR=General Data Protection Regulation.
We can see that the probability of lobbying to support the GDPR decreases considerably for organisations operating in finance and retail. Specifically, for finance, the odds of supporting the GDPR are about 30% lower than for other sectors; for retail the odds decrease by more than 40%. We can also see that interest groups from these two same industries are more likely to lobby in defence of the status quo. For both finance and retail, the odds of supporting the status quo are about 40% higher compared to other sectors. Nevertheless, these effects are absent for the technology and entertainment sectors.
These results confirm our expectations that firms from finance and retail are important handlers of personal data and, what is more, uniquely vulnerable to cyber-attacks and data breaches (Breach Level Index 2014). This coupled with potential fines for noncompliance introduced in the GDPR explains why firms from both of these economic sectors would lobby to weaken the new regulation. To provide an example of these concerns from the final set of GDPR consultations, on the “European Commission’s comprehensive approach”, Eurofinas (the European Federation of Finance House Associations) argued strongly that the 1995 Directive was the “gold standard in data protection”, suggesting that it is premature for the European Commission to propose a new Regulation on the subject.Footnote 14 On the principle of accountability, they “‘oppose any general obligation for the data controller to take appropriate measures to ensure and demonstrate data protection compliance”. On personal data breach notifications, they suggest that “there would be real difficulty in establishing thresholds for any obligation to report personal data breach notifications due to the mix of different factors involved” and believe that “Member State regulators are best placed to determine where notification or other action may be appropriate, on a case by case basis”. They similarly warn against the new rules on transparency, data ownership and the right to be forgotten. As for profiling and risk assessment, they argue that “profiling should not mean risk assessment; risk assessment must not be prohibited, and lenders need to assess risk as part of their sound lending practices, which can help reduce levels of consumer overindebtedness”. In short, we can see a focussed lobbying effort to undermine the conditions for enforcing GDPR fines for noncompliance.
To take an example from retail, EMOTA, the European E-commerce and Mail Order Trade Association, supports the status quo, suggesting that the core principles of the 1995 Directive are still valid and that “its technologically neutral character should be persevered”.Footnote 15 Specifying that “the comprehensive approach on personal data protection has raised several concerns among EMOTA’s members”, it warns that “specific actions suggested by the Commission may not be in the interest of a fair balance between economic interests and the protection of personal data” and that “overly strict, static and bureaucratic data protection rules would have a detrimental impact on the economy”. For instance, on informed and free consent (getting permission before disclosing personal information), EMOTA warns that “changing to a requirement of explicit consent would be totally impractical and have huge economic implications, affecting all free media and threatening the whole advertising industry, the advertising financed creative content industry and small and medium sized companies”. EMOTA also argues that changing the current provisions would contradict the principle of free movement of personal data. Its overall recommendation is thus self-regulatory initiatives led by data controllers, proposing that “self-regulation represents an efficient tool to ensure effective application and implementation of the data”. These quotes portray the objection of the retail sector to increasing advertisement and bureaucratic costs.
The picture painted above is one of focussed resistance to the GDPR and a determined defence of the status quo (the 1995 Directive) by those working in finance and retail as well as by concentrated interest groups more broadly speaking. However, this defence was not sustained across other industries and group types. Comparing lobbying demands in defence of the status quo versus support for the GDPR, as presented in Figure 4, helps explain why the GDPR passed into EU law.
Mean lobbying preferences across sectors and concentrated and diffuse interests. Note: GDPR=General Data Protection Regulation.
Our data show that finance and retail stand alone in their preference for retaining the status quo. Other industries, like entertainment and technology were more in favour of the GDPR than not. In fact, these industries are more aligned with the likes of diffuse interest groups (like NGOs and consumer protection groups) than other industries that are highly susceptible to data breaches.
The defence of the status quo levelled by finance and retail was ultimately counterbalanced by considerable lobbying efforts to change the status quo. We also saw important differences at the country-level, where former “late compliers” became, on balance, proponents of the GDPR. Moreover, this push in support of the GDPR was coming from a heterogeneous group of concentrated interest groups and sectors as well as diffuse interests. Taking all of these factors together, the EU’s success in passing the GDPR may well have been helped along by strong lobbying efforts from the right mix of actors and from the right countries.
Conclusions
Our analysis examines how interest group preferences align on different sides of lobbying battles. Taking the GDPR as our case, we assessed preference alignment as a function of industry-specific costs related to regulatory change. In the case of the GDPR, industries most susceptible to increasing costs and to potential data breaches inviting substantial fines for noncompliance are therefore highly incentivised to lobby against the new GDPR rules. Our approach builds on current research that tends to explain preferences and preference alignment either in terms of country-specific institutional context or interest group type. Our explanation tempers expectations that preferences are circumscribed by national borders and also offers a more nuanced perspective to studies that focus on the blunt distinction between concentrated and diffuse interest groups.
Regression analysis presents some support for our argument. Specifically, we find that groups representing the interests of the financial and retail sectors are more likely to oppose the GDPR and to level a strong defence of the status quo. Nonetheless, these same trends do not extend to other sectors sensitive to GDPR costs, namely technology and entertainment. At the same time, we do find sustained lobbying efforts by a heterogeneous group of interests in support of the GDPR. Hence, despite resistance of finance and retail, lobbying on the GDPR did much more to support its passing into EU law than to weaken or oppose it.
The question of preference alignment is underpinned by broader questions of interest group influence. These, however, are not explored in the present analysis. Ultimately, empirical research could take up the more explicit task of directly assessing interest group influence over the GDPR. Answering this question could build on our data set, using our coding on lobbying demands for a weaker or stronger regime as a proxy for interest group preferences. This approach to measuring influence, and using consultation data to this end, is already well-established in the existing interest group literature (see Klüver Reference Klüver2013) and would provide a prudent approach for future research.
Additionally, such a consideration of influence might well include an analysis of how interest groups use framing to affect policy outcomes. Recent research examines the framing processes through which interest groups attempt to draw attention to their preferred frames on a policy issue and thus away from those of rivals. Framing processes have been widely studied in the public opinion and social movements literatures (e.g. Goffman Reference Goffman1974; McAdam et al. Reference McAdam, McCarthy and Zald1996; Tarrow Reference Tarrow1998; Benford and Snow Reference Benford and Snow2000; Entman Reference Entman2004; Polletta and Ho Reference Polletta and Ho2006; Soroka Reference Soroka2006; Chong and Druckman Reference Chong and Druckman2007a, Reference Chong and Druckman2007b; Atikcan Reference Atikcan2015) as well as in the interest group literature (Klüver and Mahoney, Reference Klüver, Braun and Beyers2015). Detailed research designs, mostly on EU environmental and transport policy, demonstrate that policymakers are indeed influenced by the most effective framers (Mahoney Reference Mahoney2008,; Baumgartner et al. Reference Baumgartner, Berry, Hojnacki, Kimball and Leech2009; Boräng et al. Reference Boräng, Eising, Klüver, Mahoney, Naurin, Rasch and Rozbicka2014; Klüver and Mahoney Reference Klüver, Braun and BeyersForthcoming). Our data set, derived from consultation data, could be extended to code for these framing processes. Different players emphasise different aspects of data protection. For instance, in our consultation data, while Skype frames data protection mostly around the subissues of technological innovation and the risk of inflexibility, Facebook puts the emphasis on the development of their personalised privacy policy. Indeed, a more complete picture of influence would consider interest groups’ framing strategies along with an analysis of how demands and resources are aligned on different “sides” of the GDPR.
Supplementary material
To view supplementary material for this article, please visit https://doi.org/10.1017/S0143814X18000223
Acknowledgements
An earlier version of this article was presented at the 2015 ECPR conference in Montreal, the 2015 APSA conference in San Francisco, and the 2016 SGEU conference in Trento, Italy. The authors would like to thank discussants and panel participants at all three conferences for their helpful suggestions.
Data
Replication files are available at https://doi.org/10.7910/DVN/HKRSBN
