Study - “The economic costs of weakening privacy and data protection” | Terms of Reference

Background

The Commission's recent ‘Digital Omnibus’ proposal puts forward a broad set of changes to the GDPR, which will enable companies to use personal data to train AI models, more easily implement cookies and tracking technologies, and broaden their use of legitimate interest as a means of utilising personal data. The proposed changes have the potential to greatly impact the privacy rights of European consumers, and in turn their ability to safely participate in the European economy.  

Previous studies have shown that compliance with privacy and data protection regulation has beneficial outcomes for the economy through competitive markets. In December 2023, the French Data Protection Authority, the Commission nationale de l’informatique et des libertés (CNIL), and Competition Authority, Autorité de la concurrence, published a joint declaration entitled “Competition and personal data: a common ambition.” The two regulators note that users will consider the "level of personal data protection” when making economic choices, and that innovations promoting better data protection will be "valued by users.” As well as consumers choosing services which offer increased levels of data protection, there are also the economic costs to companies of non-compliance, whether through fines imposed under the GDPR or the loss of users following a data breach.  

This twofold economic impact could be exacerbated should privacy and data protection regulation be weakened in the EU.  

Study overview

The objective of the study is to gain an understanding of the impact on the European economy of a failure to protect privacy and data protection (economic analysis), based on existing data and literature.  

In light of the proposed changes to Europe's privacy regulation framework, the study should consider three scenarios;  

•    The cost to consumers of inadequate privacy and data protection  
• The costs to companies of failing to properly implement privacy safeguards
• The potential economic benefits should higher standards be implemented

The study should assess the economic risks and costs to users of suffering from data breaches, the use of their data without proper legal basis, the resale of their data, and the costs of rectifying such instances. It should also consider the compliance costs for companies of failing to implement data protection measures, and the associated costs that arise from litigation and compensation.  

Lastly, the study should conduct an assessment of the potential benefits of a strengthened privacy framework.  

Tasks

The contractor is asked to answer the following questions:

1.    What are the economic costs to consumers of inadequate privacy and data protection measures?  

Task 1: The contractor should conduct an economic analysis of the estimated cost to European citizens of privacy breaches, based on an analysis of major incidents since the application of the GDPR.

Task 2: The contractor should assess, by using existing data, the monetary value of the secondary data market and the estimated average cost per European citizen of the resale of data. This value should reflect the material loss to the average user of having limited control over their data once it is placed on the market for data brokers, based on the price at which individual profiles are traded.  

2.    What are the costs to companies of failing to comply with privacy and data protection regulation?  

Task 3:  The contractor will provide a breakdown of costs to the European economy of breaches of data protection and privacy regulation, namely the average material cost to companies suffering breaches, the investigation and enforcement costs of regulatory authorities, the cost of litigation, and compensation paid to victims in a selection of Member States to be proposed by the contractor.  Where possible, this should be presented by the size of company (startup, SME, SMC etc).  

3.    What are the potential economic benefits of a stronger level of data protection?  

Task 4: The contractor should conduct an assessment of possible means to strengthen privacy protection, e.g. implementing a consent based framework for personal data use, and how these may provide economic benefits to both users and companies. These benefits may include, for example, reduced compliance costs, reduced risk of data breaches, or enhanced consumer trust.  

Deliverables  

(1)   A detailed report with the study’s findings. The report shall respect the following points:

•    A maximum of 30 pages, with necessary annexes for further details on the data collected and a literature review.
• The findings of each task should be clearly presented, with an explanation of the methodology and sources used to address the research question.  
• The report should be written in clear language (English) to be understandable by a non-expert readership.

(2)   A summary of 4 pages with the key findings of the study aimed at a non-expert audience.  

(3)   A presentation of the findings by the researcher(s) during a dedicated (online or physical) meeting with BEUC and its member organisations, and other relevant stakeholders, in 2026. The exact date and format of the meeting will be defined at a later stage.

Governance structure  

BEUC's Digital Policy team will be the primary contact point for the study. BEUC will act as an intermediary to facilitate any cooperation between national consumer organisations and the appointed contractor.  

Project planning and timeline

The study is expected to be completed within 4 months after the conclusion of the contract. The contractor shall account for an in-person or online meeting with the BEUC’s team to discuss the research approach at the beginning and at the end of the contract period.  

A draft report should be sent to the BEUC Digital team 3 months after the conclusion of the contract. At least one meeting should take place to discuss possible comments from the BEUC Digital team on the draft report.  

Timeline

•  Submission of proposal by 31 December 2025.
• Study starts on 2 February 2026.
• First draft of study shared with BEUC on 15 May 2026  
• Comments and feedback provided to the tenderer by 22 May 2026  
• The final draft of the study and the executive summary must be submitted by 29 May 2026

Budget

The budget is EUR 65,000 + VAT  

Publication and dissemination of the report  

The copyright of the report is granted to BEUC. The detailed report and the summary will be published by BEUC and BEUC’s members. The findings will be disseminated towards policymakers and key stakeholders at EU and national level.  

Submission of proposals

Interested researchers are invited to express their interest in this call by submitting the following documents:  

1.    An overview of the proposed research methodology, including information on how the objectives and scope outlined in the present Terms of Reference will be addressed.
2. A proposed schedule for the research activities;
3. A detailed CV, including any relevant experience in consumer law, EU privacy or digital policy, and the online ecosystem.
4. Contact information of the researcher.

The proposal should be submitted in electronic version to digital@beuc.eu no later than 31 December, 6pm CET. Late submissions will not be considered.

The selected researcher will be announced in mid-January.

Further information

For clarification of any of the above, please send an e-mail to: digital@beuc.eu  

Brussels, November 2025