Data Breach Notification Research Articles

Data Breach Notification Laws and Corporate Tax Planning

ABSTRACTThis study explores the impact of data breaches on corporate tax planning in the United States. The results reveal that when a firm's headquarter is located in a state that has adopted a data breach notification (DBN) law, there is a significant 3.8% decrease in the long‐term effective tax rate. This reduction translates to annual tax savings of approximately $8.13 million. Furthermore, tax sheltering is found to decrease by 19.17% compared to the sample average. These effects are particularly pronounced in financially constrained firms and those operating in high‐tech industries. The findings suggest that after the introduction of mandatory data breach disclosure requirements, firms are less inclined to engage in aggressive tax avoidance practices, which could otherwise lead to increased litigation costs. Instead, they prioritize efficient tax planning strategies to improve after‐tax cash flows.

Normative Study of Law No. 27 of 2022 on the Protection of Personal Data and its Impact on the Fintech Industry in Indonesia

The enactment of Law No. 27 of 2022 on Personal Data Protection marks a pivotal moment in Indonesia’s regulatory framework, particularly for industries that handle significant amounts of personal data, such as the financial technology (fintech) sector. This study provides a normative juridical analysis of the PDP Law and examines its impact on the fintech industry. The research focuses on the law’s key provisions, including consent requirements, data breach notification, and data security obligations. Additionally, the study explores the operational challenges fintech companies face in complying with the law, such as the costs of compliance, technical requirements, and the need for employee training. While the PDP Law enhances consumer trust by offering greater protection and transparency, it also presents hurdles that fintech firms must overcome to ensure compliance. The analysis concludes with recommendations for fintech companies to balance legal obligations with innovation to maintain competitiveness in Indonesia’s evolving digital economy.

MANAGING INDONESIAN DATA BREACH NOTIFICATION IN THE FINANCIAL SERVICES SECTOR: A CASE FOR ONE-STOP NOTIFICATION MODEL

As a business of trust, the banking and financial services industry must protect its reputation to ensure consumer’s confidence. However, recent adoption of emerging internet communication technologies (ICT) have introduced new risks and challenges, such as safeguarding systems from cyberattacks and protecting consumer’s personal data. Cyberattacks, especially ransomware have shed new light on the importance of privacy and security throughout the banking and financial industry’s digitization efforts. Any organisation affected by cybersecurity attacks must face a twofold legal question. First, whether or not there has been a violation of the legal security requirements? Second, is to determine whether the attack triggers Data Breach Notification to the Data Protection Authority and/or Data Owners. This paper examines the complexity of maintaining security obligations under Indonesian Law (UU ITE, UU PDP, RPP PDP, and other relevant regulations) while also highlighting the common challenges in steering Data Breach Notification, with an enhanced perspective of the European General Data Protection Regulation (EU GDPR) practices. To address the challenges of patchwork data breach notification requirements in Indonesia, this paper proposes a proactive approach by Indonesia’s future Personal Data Protection Authority in creating a one-stop notification model to enable effective data breach incident management and notification.

Study of Cybersecurity Laws and Regulations

In the modern digital era, cybersecurity has become a crucial field due to the increase in cyberthreats and assaults, which pose serious hazards to people, businesses, and countries. To meet these changing difficulties, a wide range of national and international cybersecurity rules and regulations have been developed. This research paper explores a thorough analysis of these laws and regulations. The first section of the report gives an overview of the state of cybersecurity throughout the world, emphasising how frequently and how sophisticatedly cyber-attacks are becoming. After that, it takes a close look at the laws that control cybersecurity in both the public and private domains. The paper addresses the jurisdictional issues that emerge in the globally interconnected realm of cyberspace and investigates the fundamental ideas that support cybersecurity legislation, such as data protection, breach notification, and responsibility. Additionally, the study paper examines important cybersecurity laws from across the globe, such as the Cybersecurity Information Sharing Act of the United States, the California Consumer Privacy Act, and the General Data Protection Regulation (GDPR) of the European Union (CISA). The efficacy of these measures in protecting confidential data and reducing cyber risks is assessed.

Cybersecurity compliance in financial institutions: A comparative analysis of global standards and regulations

Cybersecurity is a critical concern for financial institutions worldwide, given the increasing frequency and sophistication of cyberattacks. This paper conducts a comparative analysis of global standards and regulations governing cybersecurity compliance in financial institutions. By examining the regulatory frameworks of key jurisdictions, including the United States, the European Union, and Asia-Pacific countries, this study aims to identify common trends, differences, and best practices in cybersecurity compliance. The analysis begins by outlining the regulatory landscape for cybersecurity in financial institutions, highlighting the key objectives and principles underlying these regulations. It then compares the regulatory frameworks of different regions, focusing on areas such as data protection, incident response, and risk management. By examining the specific requirements and guidelines set forth by each jurisdiction, this study identifies the strengths and weaknesses of current cybersecurity regulations and offers recommendations for enhancing compliance and resilience. One of the key findings of this study is the increasing convergence of global cybersecurity standards, driven by the interconnected nature of the financial sector and the need for harmonized regulatory approaches. While differences in regulatory frameworks still exist, particularly in areas such as data protection and breach notification, there is a growing recognition of the need for international cooperation and information sharing to combat cyber threats effectively. The study also highlights the challenges faced by financial institutions in achieving cybersecurity compliance, including resource constraints, evolving cyber threats, and the complexity of regulatory requirements. It underscores the importance of implementing robust cybersecurity measures, such as encryption, multi-factor authentication, and regular security audits, to mitigate these challenges. In conclusion, this comparative analysis provides valuable insights into the global landscape of cybersecurity compliance in financial institutions. By identifying common trends and best practices, this study aims to assist policymakers, regulators, and financial institutions in enhancing their cybersecurity posture and effectively addressing the evolving cyber threat landscape.

Data breach disclosures and stock price crash risk: Evidence from data breach notification laws

Exploiting the staggered adoption of data breach notification (DBN) laws, which obligate firms to disclose data breaches when they occur, as an exogenous shock to data breach disclosures, we find that the adoption of these laws leads to higher future stock price crash risk. The positive relation between DBN laws and crash risk is more pronounced for firms with weaker corporate governance, higher financial constraints, and higher information asymmetry. Our findings suggest that investors' concerns about the consequences of data breaches and the vulnerability of breached firms' data security heighten stock price crash risk.

The unintended cost of data breach notification laws: Evidence from managerial bad news hoarding

AbstractWe investigate how nonfinancial disclosure laws exacerbate agency issues in firms. Our analysis focuses on the staggered adoption of state‐level notification laws that require firms to disclose data breaches. Our findings reveal that the introduction of these laws increases the risk of stock price crashes. Managers appear motivated to accumulate unfavorable news in an effort to prevent market overreactions associated with the mandatory disclosure of data breaches. Cross‐sectional analyses also reveal that the impact is stronger when managers have a greater incentive, or greater ability, to hoard information. Our results highlight that nonfinancial disclosures can have unintended consequences for firm information asymmetries and potentially adverse market impacts in cases where the regulation is unable to consider all stakeholders.

European Union ∙ Security of Processing and Data Breach Notification: New Guidance in View of Decisions in the One-Stop-Shop Procedure

European Union ∙ Security of Processing and Data Breach Notification: New Guidance in View of Decisions in the One-Stop-Shop Procedure

The GDPR’s Rules on Data Breaches: Analysing Their Rationales and Effects

The General Data Protection Regulation (GDPR) requires an organisation that suffers a data breach to notify the competent Data Protection Authority. The organisation must also inform the relevant individuals, when a data breach threatens their rights and freedoms. This paper focuses on the following question: given the goals of the GDPR’s data breach notification obligation, what are its strengths and weaknesses? We identify six goals of, or rationales for, the GDPR`s data breach notification obligation, and we assess the obligation in the light of those goals. We refer to insights from information security and economics, and present them in a reader-friendly way for lawyers. Our main conclusion is that the GDPR’s data breach rules are likely to contribute to the goals. For instance, the data breach notification obligation can nudge organisations towards better security; such an obligation enables regulators to perform their duties; and such an obligation improves transparency and accountability. However, the paper also warns that we should not have unrealistic expectations of the possibilities for people to protect their interests after a data breach notice. Likewise, we should not have high expectations of people switching to other service providers after receiving a data breach notification. Lastly, the paper calls for Data Protection Authorities to publish more information about reported data breaches. Such information can help to analyse security threats.

Observing 2021–22 data breach decisions of the Irish Data Protection Commission

The Irish Data Protection Commission (DPC) regulates many of the top global technology companies and as such its decisions have a significant impact on the companies and on the many users of their platforms. This article examines a number of recent data breach decisions of the DPC and finds them forensic, focused, reasoned and formulaic in approach. The decisions deal with key General Data Protection Regulation (GDPR) provisions, notably on requirements for data breach notification and communication with data subjects. In a change of strategy earlier this year, the DPC no longer offers guidance to controllers dealing with a breach, as was its previous practice. Decisions such as these are likely to help fill that vacuum.

Do data breach notification laws reduce medical identity theft? Evidence from consumer complaints data

AbstractAs the number of data breaches in the United States grows each year, cybersecurity has become an increasingly important policy area. The primary mechanism for regulating and deterring data breaches is the “data breach notification law.” Every US state now has such a law that mandates that certain organizations disclose data breaches to their data subjects. Despite the popularity of these laws, there is relatively little evidence about their effectiveness at deterring breaches, and therefore reducing identity theft. Using medical identity theft panel data collected from the Consumer Financial Protection Bureau, this study implements an augmented synthetic control approach to analyze the effect of California's 2016 data breach notification standards on medical identity theft. This approach suggests that medical identity theft reports in California were reduced by 3.5 reports/100,000 people.

Amplifying victim vulnerability: Unanticipated harm and consequence in data breach notification policy

Loss of control over one’s identity through identity usurpation, or identity theft, results in victimization characterized by multiple species of harm: material harms such as financial loss; medical harms such as psychological distress and consequential physiological illness; and moral harms such as infringement of autonomy. Digital data breaches are a common means by which identity can be usurped and laws have been enacted requiring data-holders to notify data subjects when their personal information held on digital databases has been compromised. The intention is that victims should then be able to undertake their own mitigation measures. This paper explores the efficacy of this approach as a solution and argues that this policy – particularly in the light of new digital criminal methodologies – creates a conflict of victims’ interests. It is an unintended outcome of policy that exacerbates, rather than resolves, identity usurpation and associated victimization in the digital environment.

Information Assurance Technique for Mitigation of Data Breaches in the Human Service Sector

This research paper analyzes data breaches in the human service sector. The hypothesis for the solution to this problem is that there will be a significant reduction in data breaches in the human service sector due to an increase in information assurance. The hypothesis is tested using data from the United States Department of Health and Human Services data breach notification repository during January 2018-December 2020. Our result shows that without the increased mitigation of information assurance, data breaches in the human service sector will continue to increase.

Hong Kong's data breach notification scheme: From the stakeholders’ perspectives

Data breach notification laws have been enacted in an increasing number of economies around the world. These laws establish the requirement for notice in the event of a data breach incident. Although, there are a number of reasons for requiring data breaches to be notified, the primary objective of the laws is to regulate organizations’ data security practices in order to protect the data privacy of its customers. In so doing, the data reporting obligations promote accountability, transparency and trust, thereby improving the overall organizational data security environment. Opinions are, however, divided amongst various private sector stakeholders on the issue of mandatory data breach notification. Drawing on the interviews with 24 private sector representatives with interest in data breach issues, this article documents and examines their position on the appropriate regulatory approach for data breach notification in Hong Kong .

Psychological Data Breach Harms

Cybersecurity law, both in statutory and case law, is primarily based on the premise that data breaches result exclusively in financial harms. Intuitively, legal scholarship has largely been focused on financial harms to the exclusion of non-financial harms—emotional and mental—that also arise from data breaches. A critical mass of research in psychology, psychiatry, and internet studies shows that consumers whose information has been compromised suffer from serious emotional and mental conditions as a result. This Article seeks to evaluate cybersecurity law in light of this reality and proposes a framework to address these psychological data breach harms. Psychological data breach harms raise significant challenges for which the law does not adequately account. Consumers suffering these harms are unlikely to pursue litigation and, even if consumers do pursue litigation, are unlikely to prevail because of both standing and cause of action reasons. In a similar vein, different cybersecurity law frameworks, such as the Computer Fraud and Abuse Act, data security laws, data breach notification laws, and Federal Trade Commission enforcement, do not generally recognize any harms that are non-monetary in nature. Moreover, companies suffering data breaches are not legally required to offer any assistance or mitigation response for consumers who may suffer psychological harms. Contributing to these challenges is the fact that breached companies are often not even required to disclose breaches that are unlikely to cause future financial harm. Cybersecurity law currently overlooks a conceptual framework for psychological data breach harms; this Article offers that framework. First, this Article argues for the recognition of psychological data breach harms in the context of cybersecurity, from the very outset. Second, this Article makes concrete recommendations on how psychological data breach harms ought to be addressed, both by regulators and breached entities, as well as the appropriate remedies. Finally, this Article calls for a reconsideration of what we mean by “personal information” and for the expansion of information categories that cybersecurity law should protect.

Description of Data Breaches Notifications in France and Lessons Learned for the Healthcare Stakeholders.

Although the consequences of the General Data Protection Regulation (GDPR) have been widely discussed, the violations have not been described in medical literature. In this study, we focus our analyses on the data breach notifications, in France, defined in the article 4 of GDPR as "a breach of security resulting, accidentally or unlawfully, in the destruction, loss, alteration, unauthorized disclosure of personal data transmitted, stored or otherwise processed, or unauthorized access to such data." Among 3,824 data breach notifications reported between May 2018 and February 2020, 244 (6.4%) is related to the health sector. Loss of confidentiality is the most important breach (80.7%) in this sector, followed by the loss of availability (27.5%). Malicious cause occurred in 58.2% of them. We hypothesized a phenomenon of underreported data breach incidents in health due to a mismatch between cybersecurity and data privacy issues.

India’s Personal Data Protection Bill, 2019 Needs Closer Adherence to Global Standards (Submission to Joint Committee, Parliament of India)

This is a submission to the Joint Committee on The Personal Data Protection Bill, 2019 of the Parliament of India, which has invited submissions from the public. The submission argues that a stronger Bill is needed if the Indian government is to have reasonable prospects both to protect legislation and practices on which government programs depend against unconstitutionality, and in order to maximize India’s prospects of obtaining a positive ‘adequacy assessment’ from the European Union under the GDPR. The submission also argues that there are many aspects of the Bill which fall far short of the accepted international benchmarks for a high quality data privacy law. The submission argues that areas which need improvement in the government’s Bill include: (i) Data principals, and NGOs representing them, are given too little ability to enforce the law, both in the courts, and before the DPAI and its AOs. It must be clear that data principals can enforce, and seek remedies for, any breaches of obligations by data fiduciaries, as well as for any breaches of explicit rights of data principals. Breaches of rights and obligations should be treated alike. (ii) The guarantees of independence of the DPAI and its AOs are not strong enough. (iii) State powers to exempt government agencies from the law are too strong. (iv) The DPAI has too broad a discretion to authorise new grounds of non-consensual processing of personal data. (v) Obligations of data fiduciaries to give Data Breach Notifications, to both the DPAI and to data principals, should be stated as objective criteria. (vi) The rights of data principals are too weak, in relation to both rights to withdraw consent, and access rights. (vii) Requirements of ‘harm’ before some obligations/rights apply are inappropriate. ‘Harm’ should also be better defined. (viii) The ‘outsourcing exemption’ for data on foreigners being processed in India defeats India’s aspiration to be a global leader in ethical data protection. (ix) A number of aspects of the Bill concern non-personal data, including anonymisation of personal data, deserve further consideration. (x) The Bill’s provisions concerning data localisation, including data export restrictions, give the government and the DPAI a great deal of discretionary control, with few legislative constraints, and few guarantees that discretions will be exercised to benefit the privacy of data principals. These broad discretions may cause unnecessary problems, and a more legally constrained approach may be better. For clarity, there is a need to amend s. 34(1) in relation to the number of bases for data exports.

Hong Kong’s data breach notification framework — inadequacies and corrective actions required

ABSTRACT Data breaches resulting from information security failures continue to be a matter of pressing concern. Given the increasing number of compromised data security incidents globally, data breach notification has emerged as an issue of increasing urgency. In response, breach notification laws have been enacted to ensure individuals are appropriately informed when their personal identifiable information (PII) has been compromised, so as to enable affected individuals to mitigate any harm so arising. Mandatory data breach notification laws are an important development in this regard. Such laws mandate that an organization that has suffered a data breach involving personal identifiable information shall notify affected individuals and in some cases, regulators. This article argues that for Hong Kong to maintain its rightful place across international norms, as a modern, legally and commercially trustworthy and reliable jurisdiction, and at the same time continues to assure its citizens that the confidentiality of their PII is secure, a mandatory approach to data breach notification needs to be implemented.

Privacy and Security Issues with Mobile Health Research Applications

This article examines the privacy and security issues associated with mobile application-mediated health research, concentrating in particular on research conducted or participated in by independent scientists, citizen scientists, and patient researchers. Building on other articles in this issue that examine state research laws and state data protection laws as possible sources of privacy and security protections for mobile research participants, this article focuses on the lack of application of federal standards to mobile application-mediated health research. As discussed in more detail below, the voluminous and diverse data collected by some independent scientists who use mobile applications to conduct health research may be at risk for unregulated privacy and security breaches, leading to dignitary, psychological, and economic harms for which participants have few legally enforceable rights or remedies under current federal law. Federal lawmakers may wish to consider enacting new legislation that would require otherwise unregulated health data holders to implement reasonable data privacy, security, and breach notification measures.

Mobile Research Applications and State Data Protection Statutes.

This article focuses on state privacy, security, and data breach regulation of mobile-app mediated health research, concentrating in particular on research studies conducted or participated in by independent scientists, citizen scientists, and patient researchers. Prior scholarship addressing these issues tends to focus on the lack of application of the HIPAA Privacy and Security Rules and other sources of federal regulation. One article, however, mentions state law as a possible source of privacy and security protections for individuals in the particular context of mobile app-mediated health research. This Article builds on this prior scholarship by: (1) assessing state data protection statutes that are potentially applicable to mobile app-mediated health researchers; and (2) suggesting statutory amendments that could better protect the privacy and security of mobile health research data. As discussed in more detail below, all fifty states and the District of Columbia have potentially applicable data breach notification statutes that require the notification of data subjects of certain informational breaches in certain contexts. In addition, more than two-thirds of jurisdictions have potentially applicable data security statutes and almost one-third of jurisdictions have potentially applicable data privacy statutes. Because all jurisdictions have data breach notification statutes, these statutes will be assessed first.