Breach Notification Research Articles

Privacy and security: Best practices for global security

A legal obligation to adopt reasonable information security procedures exists in a variety of laws around the world, such as the EU Data Directive (Directive 95/46), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and sectoral and state privacy laws in the U.S. The latter include security breach notification laws, and laws establishing a general duty of security. This paper compares and contrasts the privacy and information security landscape inside and outside the U.S. and offers suggestions for corporate “best practices” in data security designed to enhance consumer trust and minimize liability.

Giving notice: why privacy policies and security breach notifications aren't enough

Anecdotal evidence suggests that although consumers say they want companies to post privacy policies and make security breach disclosures, these notices are not actually having much of an effect on consumers. A number of further steps may be needed to realize the potential of transparency to improve the privacy and security of personal information. Companies are urged to go beyond notices and actually improve their privacy and security practices so that consumers have meaningful privacy choices and personal information is adequately protected.

Internet break-ins: new legal liability

Victims of identity theft must act quickly to minimize the damage; therefore expeditious notification of possible misuse of a person's personal information is imperative – California Legislature explaining why it enacted Database Breach Notification Act (Senate Bill 1386) For the first time, companies are legally required to go public with internet hacking incidents that compromise customer databases. California's Database Breach Notification Act (SB 1386) dramatically escalates the need for companies to secure their key customer data such as credit card numbers and social security numbers. The Act represents a wave of new law that penalizes the failure to secure databases containing personally identifiable information.

Suit, Settlement, and Trial: A Theoretical Analysis under Alternative Methods for the Allocation of Legal Costs

Suit, Settlement, and Trial: A Theoretical Analysis under Alternative Methods for the Allocation of Legal Costs