The paradox of privacy compliance: a better understanding of company infractions with the General Data Protection Regulation (GDPR)[Le « privacy compliance paradox » : mieux comprendre les infractions des entreprises au Règlement Général sur la Protection des Données (RGPD)]

Although companies are paying attention to GDPR regulations, many are not complying with them systematically (privacy compliance paradox). Between 2018 and 2022, more than €2 billion in fines were issued across Europe, and 2023 is likely to be a record year. In this context, we are trying to better identify the various sources of corporate privacy violations that can impact the customer relationship. The results of a qualitative study conducted with data management experts show that, between the perceived benefits and risks, some companies make the deliberate choice of breaking the law, either by malicious acts or passive omissions (privacy compliance calculus). However, other violations may be unintentional. Despite companies' best attempts to incorporate the GDPR into their operations, we observe mistakes and inactions due to the difficulties encounter in understanding and applying existing regulations (privacy compliance gap).