Breach Disclosure Research Articles

Strategic news bundling and privacy breach disclosures

I examine how firms strategically bundle news reports to offset the negative effects of a privacy breach disclosure. Using a complete dataset of privacy breaches from 2005 to 2014, I find that firms experience a small and significant 0.27% decrease in their stock price on average following the breaking news disclosure of the privacy breach. But controlling for media coverage, this small decline is offset by an increase in the effect of a larger than usual number of positive news reports released by the firm on that day, which could increase the returns by 0.47% for every additional positive news report compared to their usual media coverage. I further find that disclosure laws have a significant and negative effect on the returns, even when news releases are used to alleviate the decrease. Moreover, a portfolio constructed with breached firms controlling for state disclosure laws outperforms the market over the 2007–14 period, especially in the case of breached firms in mandatory disclosure states.

Strategic News Bundling and Privacy Breach Disclosures

Strategic News Bundling and Privacy Breach Disclosures

Strategic News Bundling and Privacy Breach Disclosures

Strategic News Bundling and Privacy Breach Disclosures

About Our Authors

About Our Authors

Confronting the Legal Liabilities of IT Systems

The legal liability resulting from data breach or un-authorised information disclosure is emerging as a threat to the financial stability of many business. Recent studies and court cases are demonstrating that poorly maintained information systems, a lack of security polices and procedures have resulted in awarding victims large settlements. Professional firms with a responsibility to protect client confidential information are being victimised by criminal hackers and a growing militant activist sub-culture. Insurance companies, activist share holders and identify theft victims are exerting tremendous pressure on victimised business to demonstrate a level of care and concern for personal and proprietary data. So, what happens when it all goes completely wrong? Firms will be called upon to demonstrate that “reasonable care” had been taken to secure the disclosed information and the disclosure was not foreseeable. Failure to patch and update systems and maintain robust security against cyber-attacks can have severe financial and reputation consequences.

Do Data Breach Disclosure Laws Reduce Identity Theft?

In the United States, identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with up to 35 percent of known identity thefts caused by corporate data breaches. Many states have responded by adopting “data breach disclosure laws” that require firms to notify consumers if their personal information has been lost or stolen. While the laws are expected to reduce identity theft, their effect has yet to be empirically measured. We use panel data from the U.S. Federal Trade Commission to estimate the impact of data breach disclosure laws on identity theft from 2002 to 2009. We find that adoption of data breach disclosure laws reduce identity theft caused by data breaches by 6.1 percent, on average.

Do data breach disclosure laws reduce identity theft?

AbstractIn the United States, identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with up to 35 percent of known identity thefts caused by corporate data breaches. Many states have responded by adopting data breach disclosure laws that require firms to notify consumers if their personal information has been lost or stolen. Although the laws are expected to reduce identity theft, their effect has yet to be empirically measured. We use panel data from the U.S. Federal Trade Commission to estimate the impact of data breach disclosure laws on identity theft from 2002 to 2009. We find that adoption of data breach disclosure laws reduce identity theft caused by data breaches, on average, by 6.1 percent. © 2011 by the Association for Public Policy Analysis and Management.

Private Ordering in Light of the Law: Achieving Consumer Protection Through Payment Card Security Measures

A private ordering regime has developed within the payment card industry to define appropriate security practices and to monitor compliance by network participants. Market demands for trustworthy systems upon which consumers and merchants could rely provide incentives for security, which the card brands supplement by privately designed fines and sanctions imposed through contract. Although private ordering has functioned sufficiently well to make payment cards a trusted payment method, the system is not completely secure, as data security breaches continue to occur. This is not surprising, as complete security is not a feasible goal. Nevertheless, some have questioned whether additional government regulation is necessary to protect consumers. This article explores the effects of legal intervention, including disclosure laws, on this private ordering system. It questions whether additional government intervention would enhance consumer welfare, particularly when consumers will likely bear the ultimate costs of such regulation. It recommends modifications in breach disclosure laws to eliminate individual notice requirements in favor of public notices, which may reduce costs and enhance consumer welfare. It challenges “bounty” enforcement regimes, such as FACTA, which offer little marginal benefit to consumers while substantially raising costs. It identifies practical and political problems presented by the different capacities of large and small firms to bear security costs, which are not easily solved under either private ordering or legislative approaches. Finally, it offers a set of policy issues as a possible agenda for consideration by policy makers and researchers in this domain.

Poised on the Precipice: A Critical Examination of Privacy Litigation

A collection of factors has caused the United States to be poised on the precipice of a new wave of litigation - litigation arising from the improper use or collection of information. Public concern over is ever increasing while, and some would say because, information has become critical to our everyday existence. In what is now a self-reinforcing cycle, increased public concern has caused an exponential increase in regulations, and the new regulations have caused increased attention and public concern because many of the new laws require public disclosure of security breaches, which increases societal concerns over privacy. Security breach laws, the laws that mandate public disclosure of data incidents, provide the best example of the increase in regulation - Just a few short years ago California passed the first security breach law. Now, 43 other states, the City of New York, Washington, D.C., and Puerto Rico, have adopted laws and many other countries have either adopted, or are likely to adopt, security breach laws as well. Restrictions on the collection and use of Social Security number laws provide another such example as now more than 35 states have adopted these type of laws. Whether the increasing public concern over is caused by, or reflected in, the new laws, the phenomenal expansion in the number of laws will have a predictable effect - a geometric increase in the number of laws will result in an equally geometric increase in the number of violations of laws. As violations increase there is an equally predictable consequence - increased incentives for individuals to attempt to enforce these new rights. One of the first challenges in litigation is to define what privacy litigation actually is. While consumer-based litigation gains much of the attention, to focus exclusively on consumer-oriented litigation misses half the picture. The increase in value of information has increased the number of businesses that are bringing litigation to protect their intellectual capital and their networks. Though these claims are not thought of as privacy litigation in the traditional sense, these claims are no less about the improper use of information than actions brought by individuals. This litigation is frequently brought under the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, CAN-SPAM, the unfair competition law, including portions of the Lanham Act. In the realm, the Federal Trade Commission (FTC) serves as the primary federal enforcer. However, the FTC does not have unlimited resources, is not its only responsibility, and the actual number of enforcement actions is not as high as one might guess. As a result, state attorney generals have an important role to play in enforcement. However, with limited exceptions, state attorney generals have not brought a significant number of matters. As a result, enforcement in many cases falls to private plaintiffs, and they play a role in enforcing laws where violations are alleged to have occurred. However, the road to plaintiffs' recovery in litigation is littered with a number of issues that can derail a case before it truly starts, not the least of which is that plaintiffs in many cases cannot prove actual damage, and may actually lack standing to bring an action. Moreover, even if the case clears this hurdle, many class actions fail the certification requirements because of issues unique to litigation. This article examines the common theories of litigation, the issues faced by plaintiffs, and examines class action issues generally, as well as some class issues that are unique to litigation. While cases have had mixed success, the increased importance of information, coupled with increased public attention, and the ever-increasing number of laws guarantees that we will be stepping off of the precipice and into litigation.

Customer Information: Protecting the Organization’s Most Critical Asset from Misappropriation and Identity Theft

Identity theft is on the rise, evidenced by the increased complaints of such incidences reported to the Federal Trade Commission in 2004. One estimate is that 10 million customers are victims of identity theft each year. In fact, it is difficult to avoid news on public disclosure of security breaches to corporate databases that companies made in 2005. A typical example was the backup computer tape containing personal data for 3.9 million customers that was lost by the world’s largest financial services company in transit by courier to a credit reporting bureau. Consumers are clearly alarmed and some are switching banks or changing their online behavior in order to protect their identity. As a result, there is increased pressure on organizations to improve data security and therefore provide customers with some assurance that their personal information will not be misappropriated.This paper discusses identity theft and the risk to consumers as well as current efforts by federal and state governments to protect the privacy of their constituents. It offers steps that could be taken by organizations to protect their most critical asset - customer information — against identity theft.

Giving notice: why privacy policies and security breach notifications aren't enough

Anecdotal evidence suggests that although consumers say they want companies to post privacy policies and make security breach disclosures, these notices are not actually having much of an effect on consumers. A number of further steps may be needed to realize the potential of transparency to improve the privacy and security of personal information. Companies are urged to go beyond notices and actually improve their privacy and security practices so that consumers have meaningful privacy choices and personal information is adequately protected.

The Impact of Product Recalls on the Wealth of Sellers

What happens to the wealth of shareholders of firms producing defective products? Our answer-for producers of drugs and autos that were recalled from the market-is that the shareholders bear large losses. They are substantially greater than the costs directly emanating from the recall-for example, costs of destroying or repairing defective products. In fact, they are plausibly larger than all the costs attributable specifically to the recalled product; the losses spill over to the firm's "goodwill." They also spill over to competitors. This negative externality may even be larger in the aggregate than the losses to the producer of the recalled product.