In industries that successfully self-regulate we find that good products that follow regulations out compete those that don't. In those cases politicians also t

In industries that successfully self-regulate we find that good products that follow regulations out compete those that don't. In those cases politicians also tend to avoid adding regulations in order to not disrupt a working system. In industries that don't successfully self-regulate we get politicians that force a regulation in order to have good product out compete bad ones. It is especially common with lemon markets where information asymmetry between buyers and sellers is a significant reason of good products being unable to fairly compete with bad ones. The value of personal information is a notoriously lemon market where the buyer, ie users, are not aware of the actually cost to themselves or to whom they are selling their information. One of the first requirements in GDPR is fixing part of this by forcing companies to disclose to whom the information is sent to. Secondly it partially address the cost aspect by forcing companies to disclose how the information get used and thus what the real cost to the user is. A bit like how banks need to disclose what the interest of a loan actually will be before the consumer signs the contract. What makes privacy issues an even bigger issue is that the cost is not carried by the party who decide and benefits from the choice of analytic software. This is similar to environmental issues where the cost of a decision is not carried by the company that made it, but rather by those around them. Environmental issues is a typical example where self-regulations do not seem to work, as the end consumer has no information if a certain clothing item is made from child labor or by a eco friendly operation. A regulations job there is to put down some minimum standards that everyone need to follow, including information disclosure so that end users can actually know what they are paying for and how much.