Organizing attention in regulatory agencies: the case of regulating technology

Regulatory agencies have limited resources and must carefully choose what they prioritize. However, while there has been a growing scholarly attention on external factors driving organizational attention, such as agencies’ reputations with key audiences, we know much less about the internal mechanisms for how organizations prioritize their activities. This paper aims to open the black box of regulatory agencies to understand their internal dynamics of prioritization. In empirical terms, this study analyses the Norwegian Data Protection Authority (DPA) and its ability to understand, analyse and regulate technology. We compare the organization for learning about technology in the Norwegian DPA before and after the introduction of the General Data Protection Regulation (GDPR). This reform has removed reporting requirements, hence providing more leeway for the DPA to autonomously prioritize activities. We find that changes in agency role have resulted in a massive number of non-conformance reports, which provide in-depth insights into technologies in the market. Simultaneously, the removal of reporting requirements makes it more difficult for the DPA to know how companies process personal data. We use this empirical basis to theorize about attention and learning in regulatory agencies, while also gaining insights into the impact of European Union law-making on the decision-making behaviour of national regulatory agencies.