Regulating personal data protection and its challenges in the context of the (anti)commons tragedy - avoiding the tragedy of distrust

Abstract

This study carries out an economic analysis of regulatory frameworks for privacy and personal data protection, taking the classic text "The Tragedy of the Commons" as a reference. The methodology was based on national and foreign literature. A presentation was made of the characteristics and stages of regulation on the subject, in order to begin an economic analysis of privacy. The aim is to study how the "Tragedy of the Commons" model can help to critically investigate the regulation of the subject and identify improvements and ways of making them operational. The research is relevant in the context of the need for more efficient regulation of personal data protection in Brazil and the difficulties of informed consent by personal data subjects in the face of asymmetrical relationships with controllers and processors. In conclusion, the regulatory mission is  incomplete and there's a need to hold controllers accountable, as well as to foster the trust of data subjects. Some proposals were put forward for technological solutions to foster such trust, in the form of the so-called PETs, even considering that the diffusion of these technologies comes up against the lack of adherence due to the absence of binding regulation on the subject.