Do Data Breach Disclosure Laws Reduce Identity Theft - Revision history

WikiSysop: /* Additional Notes and Highlights */

2010-08-19T20:36:36Z

Additional Notes and Highlights

← Older revision		Revision as of 20:36, 19 August 2010
Line 37:		Line 37:

	==Additional Notes and Highlights==		==Additional Notes and Highlights==
			Expertise Required: Economics - Moderate

	[http://www.networkworld.com/newsletters/sec/2008/072808sec1.html/ Paper review from networkworld.com: "Do data-breach-disclosure laws reduce identity theft? Research attempts to answer the question"]		[http://www.networkworld.com/newsletters/sec/2008/072808sec1.html/ Paper review from networkworld.com: "Do data-breach-disclosure laws reduce identity theft? Research attempts to answer the question"]

Felix: /* Synopsis */

2010-06-28T22:05:17Z

Synopsis

← Older revision		Revision as of 22:05, 28 June 2010
Line 21:		Line 21:
	==Synopsis==		==Synopsis==

			===The Purpose of Data Breach Leglisation===
	The paper starts by outlining that identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with about 30% of known identity thefts caused by corporate data breaches. Many US states have responded by adopting data breach disclosure laws that require firms to notify consumers if their personal information has been lost or stolen. According to the authors, the rationale behind such laws is that they will create incentives for firms to internalize more of the cost of a breach through notification		The paper starts by outlining that identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with about 30% of known identity thefts caused by corporate data breaches. Many US states have responded by adopting data breach disclosure laws that require firms to notify consumers if their personal information has been lost or stolen. According to the authors, the rationale behind such laws is that they will create incentives for firms to internalize more of the cost of a breach through notification
	letters, customer support call centers, and mitigating actions such as marketing campaigns and free credit monitoring.		letters, customer support call centers, and mitigating actions such as marketing campaigns and free credit monitoring.

Felix: /* Categorization */

2010-06-28T21:50:48Z

Categorization

← Older revision		Revision as of 21:50, 28 June 2010
Line 11:		Line 11:
	==Categorization==		==Categorization==

	*Issues: [[~~Identity Management~~]]; [[Information Sharing/Disclosure]]		*Issues: [[Incentives]]; [[Information Sharing/Disclosure]]
	*Approaches: [[Regulation/Liability]]		*Approaches: [[Regulation/Liability]]

Felix: /* Categorization */

2010-06-28T21:21:30Z

Categorization

← Older revision		Revision as of 21:21, 28 June 2010
Line 11:		Line 11:
	==Categorization==		==Categorization==

	*Issues: [[Identity Management]], [[Information Sharing/Disclosure]]		*Issues: [[Identity Management]]; [[Information Sharing/Disclosure]]
	*Approaches: [[Regulation/Liability]]		*Approaches: [[Regulation/Liability]]

Felix: /* Key Words */

2010-06-28T21:21:22Z

Key Words

← Older revision		Revision as of 21:21, 28 June 2010
Line 16:		Line 16:
	==Key Words==		==Key Words==

	[[Keyword_Index_and_Glossary_of_Core_Ideas#Credit_Card_Fraud \| Credit Card Fraud]], [[Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy \| Disclosure Policy]], [[Keyword_Index_and_Glossary_of_Core_Ideas#Identity_Fraud.2FTheft \| Identity Fraud/Theft]]		[[Keyword_Index_and_Glossary_of_Core_Ideas#Credit_Card_Fraud \| Credit Card Fraud]], [[Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy \| Disclosure Policy]], [[Keyword_Index_and_Glossary_of_Core_Ideas#Identity_Fraud.2FTheft \| Identity Fraud/Theft]],
	[[Keyword_Index_and_Glossary_of_Core_Ideas#Transparency \| Transparency]]		[[Keyword_Index_and_Glossary_of_Core_Ideas#Transparency \| Transparency]]

Felix: /* Key Words */

2010-06-28T21:21:12Z

Key Words

← Older revision		Revision as of 21:21, 28 June 2010
Line 17:		Line 17:

	[[Keyword_Index_and_Glossary_of_Core_Ideas#Credit_Card_Fraud \| Credit Card Fraud]], [[Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy \| Disclosure Policy]], [[Keyword_Index_and_Glossary_of_Core_Ideas#Identity_Fraud.2FTheft \| Identity Fraud/Theft]]		[[Keyword_Index_and_Glossary_of_Core_Ideas#Credit_Card_Fraud \| Credit Card Fraud]], [[Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy \| Disclosure Policy]], [[Keyword_Index_and_Glossary_of_Core_Ideas#Identity_Fraud.2FTheft \| Identity Fraud/Theft]]
			[[Keyword_Index_and_Glossary_of_Core_Ideas#Transparency \| Transparency]]

	==Synopsis==		==Synopsis==

Felix: /* Policy and Research Implications */

2010-06-28T21:18:55Z

Policy and Research Implications

← Older revision		Revision as of 21:18, 28 June 2010
Line 33:		Line 33:
	According to the authors, the effectiveness of data breach disclosure laws relies on actions taken by both firms and consumers. Certainly firms must improve their controls, but regardless, once notified consumers must themselves take responsibility to reduce their own risk of identity theft – something which only a minority appears to be doing. It may be that only with time we see more firms internalize the costs, more consumers respond to the risks, and the victimization rates decline.		According to the authors, the effectiveness of data breach disclosure laws relies on actions taken by both firms and consumers. Certainly firms must improve their controls, but regardless, once notified consumers must themselves take responsibility to reduce their own risk of identity theft – something which only a minority appears to be doing. It may be that only with time we see more firms internalize the costs, more consumers respond to the risks, and the victimization rates decline.
	The authors also underline the need for better data collection, measurements and more studies that can inform policy makers, consumer groups and industry participations regarding the role of regulations in this domain. Otherwise, they say, policy decisions will be made by partisan debates, lobbying efforts and unmeasured and conflicting outcomes.		The authors also underline the need for better data collection, measurements and more studies that can inform policy makers, consumer groups and industry participations regarding the role of regulations in this domain. Otherwise, they say, policy decisions will be made by partisan debates, lobbying efforts and unmeasured and conflicting outcomes.




	==Additional Notes and Highlights==		==Additional Notes and Highlights==

Felix: /* Other Effects of Laws Data Breach Legislation */

2010-06-28T21:18:46Z

Other Effects of Laws Data Breach Legislation

← Older revision		Revision as of 21:18, 28 June 2010
Line 27:		Line 27:
	While the laws are expected to reduce identity theft, their full effects have yet to be empirically measured. The authors use panel from the US Federal Trade Commission with state and time fixed effects regression to estimate the impact of data breach disclosure laws on identity theft from 2002 to 2007. The authors find a small effect of law on the incidences of identity thefts (it reduces their rate by just under 2%, on average).		While the laws are expected to reduce identity theft, their full effects have yet to be empirically measured. The authors use panel from the US Federal Trade Commission with state and time fixed effects regression to estimate the impact of data breach disclosure laws on identity theft from 2002 to 2007. The authors find a small effect of law on the incidences of identity thefts (it reduces their rate by just under 2%, on average).

	===Other Effects of ~~Laws~~ Data Breach Legislation===		===Other Effects of Data Breach Legislation===
	While the incidence of laws on data breaches is minimal, reducing identity theft is only one means by which these laws can be evaluated: the authors also appreciate that they may have other benefits such as reducing the average victim's losses or improving a firm's security and operational practices. Also, the small incidence does not necessarily suggests that the laws are ineffective for there are other dimensions to the effects of law. For example, the laws naturally lead to more disclosures, and it is also conceivable that the laws may not reduce identity thefts but may decrease the economic losses associated with these thefts, or may reduce of the severity of losses from identity thefts. But overall, data are inconclusive.		While the incidence of laws on data breaches is minimal, reducing identity theft is only one means by which these laws can be evaluated: the authors also appreciate that they may have other benefits such as reducing the average victim's losses or improving a firm's security and operational practices. Also, the small incidence does not necessarily suggests that the laws are ineffective for there are other dimensions to the effects of law. For example, the laws naturally lead to more disclosures, and it is also conceivable that the laws may not reduce identity thefts but may decrease the economic losses associated with these thefts, or may reduce of the severity of losses from identity thefts. But overall, data are inconclusive.

Felix at 21:18, 28 June 2010

2010-06-28T21:18:29Z

@@ Line 20: / Line 20: @@
 ==Synopsis==
-Identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with about 30% of known identity thefts caused by corporate data breaches. Many US states have responded by adopting data breach disclosure laws that require firms to notify consumers if their personal information has been lost or stolen. While the laws are expected to reduce identity theft, their full effects have yet to be empirically measured. We use panel from the US Federal Trade Commission with state and time fixed effects regression to estimate the impact of data breach disclosure laws on identity theft from 2002 to 2007. We find that adoption of data breach disclosure laws have a marginal effect on the incidences of identity thefts and reduce the rate by just under 2%, on average. While this effect is marginal, reducing identity theft is only one means by which these laws can be evaluated: we appreciate that they may have other benefits such as reducing the average victim's losses or improving a firm's security and operational practices.
+The paper starts by outlining that identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with about 30% of known identity thefts caused by corporate data breaches. Many US states have responded by adopting data breach disclosure laws that require firms to notify consumers if their personal information has been lost or stolen. According to the authors, the rationale behind such laws is that they will create incentives for firms to internalize more of the cost of a breach through notification
 ==Additional Notes and Highlights==

Felix at 19:41, 28 June 2010

2010-06-28T19:41:33Z

@@ Line 16: / Line 16: @@
 ==Key Words==
-[[information security]], [[disclosure policy]], [[identity theft]], [[security breach notification]]
+[[Keyword_Index_and_Glossary_of_Core_Ideas#Credit_Card_Fraud | Credit Card Fraud]], [[Keyword_Index_and_Glossary_of_Core_Ideas#Disclosure_Policy | Disclosure Policy]], [[Keyword_Index_and_Glossary_of_Core_Ideas#Identity_Fraud.2FTheft | Identity Fraud/Theft]]
 ==Synopsis==
@@ Line 27: / Line 27: @@
 [http://www.consumeraffairs.com/news04/2008/06/data_breaches.html/ Paper review from consumeraffairs.com: "Data Breach Disclosure Laws Don't Slow Down Identity Theft; Results of recent legislation called 'statistically insignificant'"]