Do Data Breach Disclosure Laws Reduce Identity Theft
Full Title of Reference
Do Data Breach Disclosure Laws Reduce Identity Theft?
Full Citation
Sasha Romanosky, Rahul Telang, Alessandro Acquisti, Do Data Breach Disclosure Laws Reduce Identity Theft ? (2007). (Workshop on the Economics of Information Security at Dartmouth College, Jun. 26, 2008). Web
Categorization
- Issues: Identity Management, Information Sharing/Disclosure
- Approaches: Regulation/Liability
Key Words
Credit Card Fraud, Disclosure Policy, Identity Fraud/Theft
Synopsis
Identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with about 30% of known identity thefts caused by corporate data breaches. Many US states have responded by adopting data breach disclosure laws that require firms to notify consumers if their personal information has been lost or stolen. While the laws are expected to reduce identity theft, their full effects have yet to be empirically measured. We use panel from the US Federal Trade Commission with state and time fixed effects regression to estimate the impact of data breach disclosure laws on identity theft from 2002 to 2007. We find that adoption of data breach disclosure laws have a marginal effect on the incidences of identity thefts and reduce the rate by just under 2%, on average. While this effect is marginal, reducing identity theft is only one means by which these laws can be evaluated: we appreciate that they may have other benefits such as reducing the average victim's losses or improving a firm's security and operational practices.
Additional Notes and Highlights
Outline:
1. INTRODUCTION 1.1 Motivation for data breach disclosure laws 1.2 Arguments against data breach disclosure laws 2. RELATED WORK 2.1 Information Economics and Disclosure Policy 2.2 Environmental Disclosure and Deterrent Policies 2.3 Criminal Deterrence Policies 3. DATA BREACHES AND BREACH LEGISLATION 3.1 Data Breaches 3.2 US Data Breach Disclosure Legislation 3.3 Conceptual Model 4. IDENTITY THEFT DATA 4.1 Data Sources and Summary Statistics 4.2 Causes of Identity Theft 5. DATA ANALYSIS 5.1 Effect of Law on Identity Theft: Basic Model 5.2 Extended Model 6. RESULTS 6.1 Effect of Law on Identity Theft 6.2 Awareness Bias 6.3 Endogeneity of the law 6.4 Sampling bias 7. DISCUSSION 8. POLICY IMPLICATIONS 8.1 Consumer losses and incentives 8.2 Firm losses and incentives 8.3 Recommendations 9. CONCLUSION