Empirical analysis of data breach litigation

Romanosky, Sasha; Hoffman, David; Acquisti, Alessandro

Permalink

https://hdl.handle.net/2142/38380 Copy

Description

Title

Empirical analysis of data breach litigation

Author(s)

• Romanosky, Sasha
• Hoffman, David
• Acquisti, Alessandro

Issue Date

2013-02

Keyword(s)

• data breach litigation
• privacy
• empirical analysis
• information policy
• information systems
• research methods
• social and community informatics
• quantitative data analysis
• identity theft

Abstract

The surge in popularity of social media, cloud computing, and mobile services has created an unprecedented opportunity for the collection, use and sale of personal consumer information. While these services clearly provide many benefits to producers and consumers, individuals suffer harm when their personal information is lost, stolen, or improperly accessed, causing emotional distress or monetary damage from fraud and identity theft.1 Since 2005, an estimated 543 million records have been lost from over 2,800 data breaches,2 and identity theft caused $13.3 billion in consumer financial loss in 2010 (Bureau of Justice, 2011). In response, federal legislators have introduced numerous bills that define appropriate business practices regarding the collection and protection of consumer information, 3 and federal regulators have drafted privacy frameworks for consumer data protection (Department of Commerce, 2010; Federal Trade Commission, 2010). For instance, the Department of Commerce inquired: “should baseline commercial data privacy legislation include a private right of action?” (Department of Commerce, 2010, 30). At issue is the degree to which federal consumer litigation deters privacy harms, or whether a new federal privacy statute is required. However, little is known about the trends in data breach litigation – which breaches are litigated and which are not, and with what outcomes. Current scholarship examines only a narrow subset of lawsuits, usually focusing on high-profile cases or those with published opinions. And so, to our knowledge, no empirical research involving data breach lawsuits has been conducted. The purpose of this manuscript is to explore two questions. First, what kinds of data breaches are being litigated in federal court, and why? Second, what kinds of data breach lawsuits are settling, and why?

Publisher

iSchools

Type of Resource

text

Language

en

Permalink

http://hdl.handle.net/2142/38380

DOI

https://doi.org/10.9776/13162

Copyright and License Information

Copyright © 2013 is held by the authors. Copyright permissions, when appropriate, must be obtained directly from the authors.

Owning Collections