The objectives of this book are threefold. First, we provide a concise overview of the crowdsourcing markets in China, Germany, and the United States and highlight recent market trends. Second, we examine the data protection laws in these three jurisdictions and show the extent to which crowdworkers and other platform users (website vistors, clients) are protected. Third, we analyze and compare data privacy practices on crowdsourcing platforms and highlight how they relate to legal rules. Finally, we provide a conclusion and, based on our functional and empirical legal investigations, show where there is a need for improvement in the legal rules and data protection practices.

Data has been dubbed the “new oil” (Economist, 2017) driving the business models of the digital economy, but there are considerable privacy risks for those operating in the digital space. People whose livelihoods depend on crowdworking can be particularly affected, since the use of their data can be essential for them, namely when data processing no longer opens up any employment opportunities for them or their wages are reduced to a minimum (Kittur et al., 2013). Given the paucity of research on the extent of crowdworking markets, we provide a brief overview of the phenomenon in Chap. 2. For this purpose, a systematic analysis of academic literature and industry reports is carried out. Chapters 3 and 4 constitute the core of this book. The analysis of data protection laws in Chap. 3 is based on a rigorous legal analysis. Like others before us in different areas of law (Kraakman et al., 2017), we have chosen a functional approach to examining the legal rules. In our study on privacy practices in Chap. 4, we follow Dorfleitner and Hornuf (2019) and empirically examine the privacy statements of crowdsourcing platforms. We extend their study by comparing privacy statements across three different countries and by comparing the crowdsourcing industry to another industry in which sensitive data is processed: the financial technology industry. In line with the classification of Boudreau and Lakhani (2013), we also examine differences between crowd complementor, crowd labor market, collaborative community, and crowd contest platforms. The analysis of privacy statements enables us to examine, among other things, which data platforms process, why they process this data, and to whom they transmit it. Based on the empirical analysis, conclusions can be drawn regarding ways in which transparent platforms deal with data processing and inform users through privacy statements. Assuming that platforms are transparent in their privacy statements, conclusions can also be drawn about how fairly crowdworkers are treated in the respective jurisdictions.

We have chosen China, Germany and the U.S. for our comparison because these countries are home to some of the largest crowdsourcing platforms. They are also among the four largest economies in the world, alongside Japan. All three countries have made significant legislative advances in the area of data protection. Although we generally follow the alphabetical order throughout this book, putting China first and the U.S. last, we deviate from this order in Chap. 3, Data Protection Law in Germany, the United States and China. The reason for this is that our legal analysis follows the chronological development according to which the EU General Data Protection Regulation (GDPR), which is applicable in Germany, has represented a decisive step in terms of data protection and became binding on May 25, 2018. The state of California followed suit and enacted a consumer protection law similar to the GDPR, which went into effect on August 14, 2020. The Chinese Personal Information Protection Law (PIPL), a unified and comprehensive data protection instrument, became effective on November 1, 2021. Since some of the individual laws have very similar content, a chronological presentation makes sense in Chap. 3, particularly because the question of legal adaptations is best answered in this way.

In sum, we find that as of now, there are no specific regulations for protecting data on crowdsourcing platforms in China, Germany, or the U.S. However, in all three countries, there has been an increase in the number of laws and regulations being developed to address the handling of data on these platforms in recent years. In studying how crowdsourcing platforms handle data protection and analyzing information from 416 privacy statements, we find that German platforms tend to rely mostly on the GDPR for their data processing, while U.S. platforms refer to a variety of international, European, and state-level legal sources on data protection. Chinese crowdsourcing platforms, which are often not accessible to foreign users, do not generally reference the GDPR in their privacy statements. Some U.S. platforms were particularly clear about which data they do not process, as indicated in their privacy statements. When we compared the privacy practices of crowdsourcing platforms with those of the German financial technology sector, we observed that pseudonymization and anonymization are used much more frequently on crowdsourcing platforms in Germany. Most privacy statements did not provide a thorough explanation of which personal data are shared with third parties, despite mentioning that data is shared with such parties. We believe that these findings have important implications for the crowdsourcing industry, and the policymakers and scholars concerned with data privacy and crowdsourcing.