Data economy: the CNIL publishes its work program for 2026-2028

After a year of prefiguration in 2022, the CNIL established early 2023 a department responsible for the economic analysis of issues related to personal data and their regulation, in order to sustain and develop its expertise in this area.

Understanding the issues, managing the impacts

The CNIL's economic analysis team carries out impact studies, sectoral analyses and quantitative work to inform the institution's decision-making, including for the production of its positions (recommendations, guidelines, etc.). It also promotes cooperation with other regulators, linking data protection with innovation and competition policies.

By conducting in-depth studies and providing operational contributions, including statistical, this team supports the work of other departments and is also entrusted with the evaluation of certain CNIL decisions and actions.

More generally, it aims to contribute to the public debate on the data economy, in conjunction with ecosystems and academic research, by providing insights. Among these debates, the economic impact of the GDPR, the contribution of data protection authorities to legal certainty and the positive impact of regulation on AI development are particularly topical.

The CNIL's approach is based in particular on the premise that if individuals are better informed and have more control over their choices, they will have greater confidence in the digital economy, which is a necessary condition for its development.

Building expertise with previous projects

Prior to 2026, the work focused in particular on cross-regulation between data protection and competition (with a collaboration to the mission entrusted to Bruno Lasserre, whose conclusions were delivered in november 2024), the economic basis for penalty amounts (deterrence effect, harms to individuals, profits derived from breaches), and virtuous business models for privacy (including, for example, a study on alternative models to dominant solutions for targeted advertising, published in 2024, as well as work on the data economy in mobile ecosystems).

The economic analysis team also examined the secondary data market (data brokers), the costs and benefits of data protection officers for companies (with a publication based on a statistical survey demonstrating the economic benefits of having a DPO), and the economic impact of AI regulation (including the organisation of an internal workshop with the French competition authority on the subject in march 2025).

Finally, the CNIL worked on the economic impact studies of GDPR, with a publication in 2024 and the organisation of an international academic event in 2025. It published the conclusions of this event, which, in summary, show that:

• the cost of GDPR compliance for businesses, although real, was mainly temporary and lower than expected; 
• the research provides no evidence that this regulation has had a substantial impact on the turnover or profitability of the sectors concerned;
• the impact on innovation also has a positive component, through the development of compliance innovations;
• above all, there are positive impacts for businesses and, notably, on individual welfare, which academic research have only partially addressed.

Update the work program for renewed insights

Over the next three years, the CNIL's economic team will be stepping up its work on eight strategic topics for the institution, in line with its 2025-2028 strategic plan. Some of these correspond to projects already launched previously:

• Competition, consumption, contestability: the CNIL will continue its work with the French competition authority and within the framework of the EDPB, including the preparation of meetings of the High Level Group for the DMA.
• Economic impact studies of GDPR: the CNIL will continue its dialogue with researchers, including in order to better quantify the benefits of the GDPR for companies and individuals.
• Economics of sanctions: the CNIL will continue to incorporate economic and quantitative elements, based on a structured approach, in order to determine the amount of its sanctions.
• The uses of AI: based on a comprehensive understanding of the value chain and the economic impact of generative AI, the CNIL will work on the risks and benefits for the end user, which determine the deployment of AI, and the role played by trust in this area.

In addition, other topics of a more operational nature will be addressed:

• Value and price of personal data: the CNIL will deepen its work on the value of data for individuals, the quantification of this value, and its doctrine for the appropriate pricing of ‘consent or pay’ models, for example.
• Economics of health data warehouses: the CNIL will support its decisions on this subject with economic insights, in the context of the forthcoming entry into force of the European Health Data Space regulation.

Finally, some work will link economic analysis with other areas of interest to the institution:

• Compliance tools for investors: the CNIL, in consultation with the ecosystem, will develop simplified GDPR compliance tools, for investors and start-ups, tailored to these players in early stages of innovation.
• Evaluation of the CNIL by its audiences: the CNIL will launch an annual survey on the effectiveness of its actions and the satisfaction of its audiences.