Notification of Data Security Breaches
Full Title of Reference
Notification of Data Security Breaches
Full Citation
Paul Schwartz and Edward Janger, Notification of Data Security Breaches (2007), 105 Michigan Law Review, 913. Web
Categorization
- Issues: Incentives; Information Sharing/Disclosure
- Approaches: Regulation/Liability
Key Words
Credit Card Fraud, Disclosure Policy, Identity Fraud/Theft, Transparency
Synopsis
The law increasingly requires private companies to disclose information for the benefit of consumers. The latest examples of such regulation are state and federal laws that require companies to notify individuals of data security incidents involving their personal information. These laws, proposed in the wake of highly publicized data spills, seek to punish the breached entity and to protect consumers by requiring the entity to notify its customers about the security breach. There are competing approaches, however, to how the law is to mandate release of information about data leaks. This Article finds that the current statutes’ focus on reputational sanction is incomplete. An important function of breach notification is mitigation of harm after a data leak. This function requires a multi-institutional coordinated response of the kind that is absent from current policy proposals. This Article advocates creation of a coordinated response architecture and develops the elements of such an approach. Central to this architecture is a coordinated response agent (CRA) that oversees steps for automatic consumer protection and heightens mitigation. This Article also proposes a bifurcated notice scheme that lets firms know that the CRA is watching and is scrutinizing their decision whether or not to disclose information about a breach to the affected individuals. Moreover, the CRA will set in motion automatic protective measures on behalf of the breached consumers. Finally, the CRA will regulate the content of notification messages to reflect the nature of the data breach.
Additional Notes and Highlights
Outline:
Introduction
I. How We Live Now: The New Risk Environment of Data Security Breaches and Identity Theft
A. The Legal Environment for Data Security
1. B2C-Financial
2. B2C-Retail
3. Outsourcing Entities
4. Data Brokers
5. Tort Law, Sarbanes-Oxley, and State and City Breach Notification Laws
B. Regulatory, Economic, and Reputational Pressures on the Firm
1. Regulatory Forces
2. Economic Forces
3. Reputational Forces
II. Three Models of Informing About Data Security Leaks
A. The Three Models in a Nutshell
B. Comparing the Models
1. Reputational Information
2. Delegation of Discretion
3. Coordination of Post-Breach Mitigation Efforts
4. Delay to Allow Investigation
5. Damages and Other Enforcement Rights
6. The Culture of Compliance
III. Defining Ideal Behavior for the Consumer and the Data Processor
A. The Ideal Consumer and Reputational Information: Shopping for Data Security
1. Lack of B2C Relationship
2. Consumer-Side Shortcomings and Fuzzy Notification Letters
B. The Ideal Consumer and Mitigation: From Self-Protection to Automatic Protection
1. The Shared Recommendations
2. Particularized Notice
3. Best Practices Independent of Notification
4. Fuzzy Notification Letters Redux
C. The Ideal Data Processor: Private-to-Public Information and the Improvement of Organizational Practices
1. Notification and Reasonable Data Security
2. Private-to-Public Information
3. Inside the Black Box
IV. Notification and Mitigation
A. Model Four: The Coordinated Response Architecture
1. Supervised Delegation and Coordinated Response
2. Tailoring Notice to Consumers
3. Minimizing Additional Data Storage and Decentralization
4. Enforcement and the Disclosure Disincentive
B. Unpacking Model Four
1. Reputational Information
2. Supervised Discretion
3. Coordination of Post-Breach Mitigation Efforts
4. Delay to Allow Investigation before Consumer Notification
5. Provision for Damages and Other Enforcement Rights
6. The Culture of Compliance
Conclusion
Appendix