The Effect of State Data Breach Notification Laws on Medical Identity Theft

Abstract

As the number of breaches in the United States grows each year, cyber-security has become an increasingly important policy area. The primary mechanism for regulating and deterring breaches is the data breach notification law. Every U.S. state now has such a law that mandates that certain organizations disclose breaches to their subjects. Despite the popularity of these laws, there is relatively little evidence about their effectiveness at deterring breaches, and therefore reducing identity theft. Using medical identity theft panel collected from the Consumer Financial Protection Bureau (CFPB), this study implements an augmented synthetic control approach to analyze the effect of certain breach notification standards on medical identity theft.