The New Arizona Date Security Breach Law: A Step in the Right Direction, But Unlikely to Prevent Identity Theft or Compensate Consumers

Abstract

Identity theft is a growing problem because of the increased electronic storage of personal information. Confidential personal information is available to anyone with the desire and skill to hack into a computer system. In addition, businesses routinely allow employees to maintain customers' personal information on laptops, compromising the stored information when the laptops are stolen or misplaced. When thieves obtain personal information they usually resell it, and the buyers use the information to assume a person's identity for pecuniary gain. The effects of identity theft are serious. In addition to financial harm, identity theft can impair a victim's credit history. Data security breaches also impose costs on businesses, including replacement of credit cards, lost customers, declining consumer confidence in electronic transactions, damage to reputation, and even a drop in stock price. Moreover, there is cost to all of society because people concerned about identity theft will avoid activities that require the disclosure of personal information; for example, internet banking and registering to vote. The law has taken different approaches, with mixed results, to prevent data security breaches and compensate consumers for the harm caused by the breaches and the subsequent identity theft. This Comment focuses on the new Arizona data security-breach law, Arizona Revised Statutes section 44-7501, and discusses its shortcomings in curbing identity theft and protecting consumers. Part II defines and discusses the identity theft problem in Arizona. Part III argues that a strong data security-breach law is necessary because criminal and civil remedies have failed to curb identity theft or to compensate consumers. Part IV introduces section 44-7501, discusses its shortcomings in protecting consumers, and presents recommendations to strengthen the Arizona law.