How Should Data Security Breach Notification Work?
posted by Daniel Solove
In 2005, a series of data security breaches affected tens of millions of records of personal information. I blogged about them here, here, here, here, and here.
One of the major issues with data security breaches involves what kind of notification companies should provide. The spate of data security breach announcements began in February 2005, when ChoicePoint announced its breach pursuant to California’s data breach notification law. At the time, California was the only state that mandated individual notice following a breach. Subsequently, numerous states passed laws requiring that companies notify individuals of breaches. Federal legislation is currently being considered to create a national security breach provision. But key questions remain in hot contention. First, what kind of breach should trigger a notification? If the risk of harm is low, some companies contend, then providing notice can be quite costly with little benefit in return. Second, what kind of notice should be given? Notice to each individual affected? Notice to the media or FTC only?
Professors Paul Schwartz (law, Berkeley) and Ted Janger (law, Brooklyn) have posted on SSRN their article, Notification of Data Security Breaches, 105 Mich. L. Rev. 913 (2007), which seeks to answer these questions. From the abstract:
The law increasingly mandates that private companies disclose information for the benefit of consumers. The latest example of such regulation through disclosure is a requirement that companies notify individuals of data security incidents involving their personal information. In the wake of highly publicized data spills, numerous states have now enacted such legislation, and federal legislation in this area has also been proposed.
These statutes seek to punish the breached entity and protect consumers by requiring that a breached entity disclose information about the data spill. There are competing possible approaches, however, to how the law is to mandate release of information about data leaks. This Article finds that a reputational sanction from breach notification can be important, but not for the reasons conventionally discussed. Moreover, a further function of breach notification is mitigation of harm after a data leak. This function requires a multi-institutional coordinated response of the kind that is absent from current policy proposals. To fill this gap, this Article advocates creation of a coordinated response architecture and develops the elements of such an approach.
For anybody interested in data security, this article is definitely worth checking out.
March 4, 2007 at 11:07 pm
Posted in: Privacy, Privacy (Consumer Privacy), Privacy (ID Theft)
Print This Post
Responses (1)
Adam - March 5, 2007 at 10:53 pm
Schwartz and Janger’s work is impressive and worth reading. I don’t agree with their recommendation for model 4. I think that we need a competitive, open research landscape, and that the embarrassment argument about breaches fell to the wayside several hundred reported breaches ago.
I blogged about this at http://www.emergentchaos.com/archives/2006/09/the_futures_so_bright_let.html
Leave a Reply