Financial data breaches in the U.S. retail economy: Restoring confidence in information technology security standards

Abstract

Managing effective security of personal customer data located in computer networks has become a strategic business and public policy issue for the U.S. retail sector. The article discusses the global credit card payment industry self-regulation regime established by the Payment Card Industry Security Standards Council (“Council”) to combat cybercrime, comparing and evaluating the Council's existing standards regime to the theory and practices found in the industry self-regulation literature. A review of national cybercrime trends in both the volume and financial impacts (“losses”) of electronic financial record breaches on the U.S. retail sector is presented. After identifying the primary areas of retail electronic records breach vulnerability, an improved industry standards framework is developed that proposes to enhance security and minimize data privacy compromises through the adoption of recommended pure industry self-regulation (improved “security standard”) and market force mechanisms (mandatory “cyber liability insurance coverage”). The article concludes with a discussion of the implementation of the proposed industry self-regulation and market force framework; its current limitations; and what technology advancements may bring in the future to provide more effective security and protection for consumers' personal data and financial transactions.