Internalizing the Harm of Privacy Breaches: Do Firms Have an Incentive to Improve Data Protection? An Event Study

Abstract

Big data, combined with machine learning and artificial intelligence, is expected to increase the bulk of personal data in the hands of private and public entities, presenting a unique challenge to policymakers. Therefore, the question of how to incentivise firms to protect personal information is more relevant today than ever before. This study attempts to associate privacy breach announcements with the drop in share price using an event study. The results show that firms suffer a significant and immediate share price depreciation over a short window, and this is sustained over the entire forecast window after the event. Furthermore, this effect is greater when a larger number of customers are affected and the information exposed is financially sensitive. This represents a departure from previous studies, which found only a mild negative and temporary market reaction following a breach. These findings, using data from 2014-2018, will encourage policymakers to consider strict disclosure policies, thereby encouraging firms to invest in best data security practices.