Why information security law has been ineffective in addressing security vulnerabilities: Evidence from California data breach notifications and relevant court and government records

Sangchul Park

International Review of Law and Economics, 2019, vol. 58, issue C, 132-145

Abstract: Why has the information security law been unsuccessful in having firms in possession of personal data take precautions against data breaches? Why are data breaches becoming more devastating notwithstanding law enforcement? This article seeks an answer from the legal system’s failure to draw a line between agency problems and externalities inherent in the information security market. Although a firm’s misaligned incentive to invest in security measures is basically an agency problem to be addressed by data breach litigation, the U.S. courts’ reluctance to grant Article III standing has reduced potential plaintiffs’ chance of winning and propensity to litigate, impairing the functionality of the private enforcement. As an exception, security vulnerabilities can have the nature of negative externalities to be addressed by the public enforcement, to the extent that those in “key holders” such as payment card processors enable intruders to easily circumvent the security measures taken by other firms in the same security chain, and that those in massive data aggregators undermine public trust in the whole data infrastructure. Government regulations, which need to be targeted at such sources of negative externalities, have actually been misaimed at a few cases arising from conventional agency problems. To test these hypotheses, this article presents an empirical study of security breach notifications filed in California during 2012–2016 and relevant court and government agency records produced until 2018.

Keywords: Information security law; Cybersecurity law; Data breach litigation; Data breach notification; Data protection; Article III standing; Public and private enforcement; Class action (search for similar items in EconPapers)
JEL-codes: K24 K42 L86 (search for similar items in EconPapers)
Date: 2019
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (4)

Downloads: (external link)
http://www.sciencedirect.com/science/article/pii/S0144818818302011
Full text for ScienceDirect subscribers only

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:eee:irlaec:v:58:y:2019:i:c:p:132-145

DOI: 10.1016/j.irle.2019.03.007

Access Statistics for this article

International Review of Law and Economics is currently edited by C. Ott, A. W. Katz and H-B. Schäfer

More articles in International Review of Law and Economics from Elsevier
Bibliographic data for series maintained by Catherine Liu ().