A Welfare Economic Analysis of Data Breach Disclosure Policy in the United States

Research Areas: Prevention, Detection and Response, Policy, Law and Management, Human Centric Security,

Principal Investigator:

In the past six years, 44 states in the United States have embraced a new form of privacy and identity theft regulation – mandatory disclosure of data breach information. Information disclosure regulation is a form of legislation considered effective for issues that span consumer protection and risk and where market mechanisms would/could work effectively to shape consumer and producer behavior and bring about allocative efficiency. Informational regulation is a new approach in the data privacy milieu, but has a precedent in environmental and health policy. While data breach information disclosure policies intend to have an impact on consumer and producer behavior, little is known about the costs and benefits of these policies and whether they are in fact enhancing social welfare in the area of identity theft and privacy. This project investigates the conditions under which mandatory information disclosure will lead to 1) a reduction in identity theft, 2) enhancement of privacy, and ultimately the conditions under which it will enhance social welfare.

Personnel

  • George Bailey

Keywords: privacy, policy, identity theft