Do Data Breach Disclosure Laws Reduce Identity Theft?

42 Pages Posted: 16 Jul 2010 Last revised: 22 Oct 2010

See all articles by Sasha Romanosky

Sasha Romanosky

RAND Corporation; Carnegie Mellon University - Heinz College of Information Systems and Public Policy

Rahul Telang

Carnegie Mellon University - H. John Heinz III School of Public Policy and Management

Alessandro Acquisti

Carnegie Mellon University - H. John Heinz III School of Public Policy and Management

Date Written: July 15, 2010

Abstract

In the United States, identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with up to 35 percent of known identity thefts caused by corporate data breaches. Many states have responded by adopting “data breach disclosure laws” that require firms to notify consumers if their personal information has been lost or stolen. While the laws are expected to reduce identity theft, their effect has yet to be empirically measured. We use panel data from the U.S. Federal Trade Commission to estimate the impact of data breach disclosure laws on identity theft from 2002 to 2009. We find that adoption of data breach disclosure laws reduce identity theft caused by data breaches by 6.1 percent, on average.

Keywords: Data breach disclosure, security breach notification, economics of information security, identity theft, fixed effects regression, difference in difference estimation

JEL Classification: C23, K10, L51

Suggested Citation

Romanosky, Sasha and Telang, Rahul and Acquisti, Alessandro, Do Data Breach Disclosure Laws Reduce Identity Theft? (July 15, 2010). 5th Annual Conference on Empirical Legal Studies Paper. Available at SSRN: https://ssrn.com/abstract=1640805 or http://dx.doi.org/10.2139/ssrn.1640805

Sasha Romanosky (Contact Author)

RAND Corporation ( email )

1776 Main Street
P.O. Box 2138
Santa Monica, CA 90407-2138
United States

Carnegie Mellon University - Heinz College of Information Systems and Public Policy ( email )

Pittsburgh, PA 15213-3890
United States

Rahul Telang

Carnegie Mellon University - H. John Heinz III School of Public Policy and Management ( email )

4800 Forbes Ave
Pittsburgh, PA 15213-3890
United States
412-268-1155 (Phone)

Alessandro Acquisti

Carnegie Mellon University - H. John Heinz III School of Public Policy and Management ( email )

Pittsburgh, PA 15213-3890
United States
412-268-9853 (Phone)
412-268-5339 (Fax)

Register to save articles to
your library

Register

Paper statistics

Downloads
10
Abstract Views
294
PlumX Metrics
!

Under construction: SSRN citations will be offline until July when we will launch a brand new and improved citations service, check here for more details.

For more information