Comparative Analysis of Data Privacy Laws in the European Union and the United States

Thesis Abstract

The rapid proliferation of digital technologies and the consequential surge in data collection have heightened the importance of robust data privacy frameworks, yet the divergence between regulatory approaches in the European Union and the United States remains a significant challenge for international data governance and cross-border data flows. This study aims to conduct a comprehensive comparative analysis of the legal structures, enforcement mechanisms, and policy paradigms underpinning data privacy regulations in these two jurisdictions, thereby illuminating their strengths, weaknesses, and implications for stakeholders. Specifically, the research objectives include (1) examining the historical development and philosophical foundations of the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), (2) assessing the substantive legal provisions and enforcement practices, (3) analyzing the socio-economic and technological factors influencing policy formulation, and (4) identifying the practical challenges and opportunities for harmonization and global cooperation in data privacy governance. Employing a qualitative research design, the study adopts a doctrinal legal analysis complemented by comparative policy analysis. The population comprises legal documents, legislative records, policy reports, and scholarly articles from both the European Union and the United States. A purposive sampling technique is used to select 50 key legal texts and 30 expert interviews with policymakers, legal practitioners, and data privacy advocates. Data collection instruments include document analysis protocols and semi-structured interview guides. Validity and reliability are ensured through triangulation of sources and iterative coding procedures. Thematic analysis, employing NVivo software, is applied to qualitative data to identify recurring themes, patterns, and divergences, while cross-case synthesis elucidates underlying conceptual differences. To structure the analysis, the study incorporates two relevant theories the Privacy Calculus Theory, which explores user decision-making in data sharing, and the Normative Regulatory Theory, which examines the legitimacy of legal interventions. It is anticipated that key findings will reveal that the GDPR emphasizes comprehensive data protection grounded in individual rights and imposes stringent compliance obligations, thereby establishing a robust normative framework, whereas the CCPA adopts a more flexible, market-oriented approach emphasizing consumer rights and corporate transparency within a lighter regulatory regime. The study expects to find substantive differences in enforcement strategies, with the GDPR's centralized enforcement model contrasted against the decentralized, industry-led approach under the CCPA. Furthermore, the research anticipates identifying contextual factors—such as cultural values, economic priorities, and technological infrastructure—that shape each legal system's policy choices and implementation efficacy. The findings will contribute to scholarly debates on the efficacy of different regulatory models in safeguarding data privacy while promoting innovation. This research advances knowledge by providing an empirically grounded, theoretically informed comparison that uncovers the nuanced interactions between legal provisions, enforcement dynamics, and socio-economic contexts. It offers practical insights for policymakers seeking to balance privacy protections with economic growth, especially amid ongoing discussions about international data transfer standards and the potential for regulatory convergence. The main conclusion underscores that both legal frameworks possess distinct advantages and limitations, necessitating a nuanced approach to international harmonization that respects jurisdictional differences. Recommendations include fostering bilateral and multilateral cooperation to develop interoperable standards, enhancing enforcement mechanisms through capacity building, and promoting a participatory policymaking process inclusive of technological stakeholders. It is also suggested that future research focus on the impact of these laws on innovation, consumer trust, and cross-border data flows, with particular attention to emerging technologies like artificial intelligence and blockchain. The study ultimately aims to bridge theoretical understanding and practical policymaking, supporting the development of cohesive, effective data privacy regimes adaptable to an increasingly interconnected digital landscape.