Data Privacy and Medical Innovation: The Case of GDPR
Abstract
We examine how data privacy regulation affects healthcare innovation and researchcollaboration. The European Union’s General Data Protection Regulation (GDPR)
aims to enhance data security and individual privacy, but may also impose costs to
data collection and sharing critical to clinical research. Focusing on the
pharmaceutical sector, where timely access and the ability to share patient-level data
plays an important role drug development, we use a difference-in-differences design
exploiting variation in firms’ pre-GDPR reliance on EU trial sites. We find that GDPR
led to a significant decline in clinical trial activity: affected firms initiated fewer trials,
enrolled fewer patients, and operated at fewer trial sites. Overall collaborative clinical
trials also declined, driven by a reduction in new partnerships, while collaborations
with existing partners modestly increased. The decline in collaborations was driven
among younger firms, with little variation by firm size. Our findings highlight a trade-
off between stronger privacy protections and the efficiency of healthcare innovation,
with implications for how regulation shapes the rate and composition of subsequent
R&D.