Much Ado About Notification

Full Title of Reference

Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers?

Full Citation

Thomas M. Lenard and Paul H. Rubin, Much Ado About Notification: Does the Rush to Pass State-Level Data Security Regulations Benefit Consumers?, Regulation, Vol. 29, No. 1 (2006). Web

BibTeX

SSRN

Categorization

• Issues: Information Sharing/Disclosure
• Approaches: Regulation/Liability

Key Words

Credit Card Fraud, Disclosure Policy, Identity Fraud/Theft

Synopsis

Data security breaches have received considerable public attention of late, and have prompted several states to mandate that firms whose data may have been compromised to notify their customers of the security breaches. This study, based on a [article] by both authors, finds that the costs of a notification requirement are likely to be substantially higher than the benefits. Even for consumers whose data have been compromised, the probability of being a victim of fraud is so low - only 2 percent - that little action is justified. Overall, the authors estimate that the expected benefits of mandatory notification are very small - less than $10 per compromised individual.

Additional Notes and Highlights

Outline:

 The Costs of Security Breaches
 Market Responses
    Improved Security
    Notification
 Benefits of Notification
    Reduced Benefits
    Consumer Response
 Costs of Notification
    Direct Costs
    Costs of Consumers' Actions
    Information Costs
 Are the Benefits Greater Than the Costs?
 Federal Preemption
    Federalism's Benefits
    Inconsistencies
    Effect of Inconsistencies
 Conclusion