An analysis of the effectiveness of the EU data breach notification obligation

An analysis of the effectiveness of the EU data breach

notification obligation

Citation for published version (APA):

Nieuwesteeg, B. F. H., & Faure, M. (2018). An analysis of the effectiveness of the EU data breach

notification obligation. Computer Law and Security Review, 34(6), 1232-1246.

https://doi.org/10.1016/j.clsr.2018.05.026

Document status and date:

Published: 01/12/2018

DOI:

10.1016/j.clsr.2018.05.026

Document Version:

Publisher's PDF, also known as Version of record

Document license:

Taverne

Please check the document version of this publication:

• A submitted manuscript is the version of the article upon submission and before peer-review. There can

be important differences between the submitted version and the official published version of record.

People interested in the research are advised to contact the author for the final version of the publication,

or visit the DOI to the publisher's website.

• The final author version and the galley proof are versions of the publication after peer review.

• The final published version features the final layout of the paper including the volume, issue and page

numbers.

Link to publication

General rights

Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights.

• Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain

• You may freely distribute the URL identifying the publication in the public portal.

If the publication is distributed under the terms of Article 25fa of the Dutch Copyright Act, indicated by the “Taverne” license above, please follow below link for the End User Agreement:

www.umlib.nl/taverne-license Take down policy

If you believe that this document breaches copyright please contact us at:

[email protected]

providing details and we will investigate your claim.

Availableonlineatwww.sciencedirect.com

journalhomepage:www.elsevier.com/locate/CLSR

An

analysis

of

the

effectiveness

of

the

EU

data

breach

notification

obligation

Bernold

Nieuwesteeg

_,

_Michael

_Faure

a _{ErasmusUniversityRotterdam,TheNetherlands}

b _{ErasmusUniversityRotterdamandMaastrichtUniversity,TheNetherlands}

a

r

t

i

c

l

e

i

n

f

o

Keywords:

Databreachnotificationobligation GDPR

Socialwelfareanalysis Dataprotectionauthority Deterrence

Disclosurethreshold Digitalfirstaidkit

a

b

s

t

r

a

c

t

InthispaperwestudythelawandeconomicsoftheEUdatabreachnotificationobligation (EUDBNO),whichispartofthegeneraldataprotectionregulation.Westartour discus-sionwiththeoriginsandaimsoftheEUDBNO.Followingthis,westudythesocialbenefits oftheDBNO andthe conditions forthesesocialbenefits toemerge.Next,we analyse whethertherewouldbespontaneousnotificationwithouttheexistenceofaDBNO.We dis-cusshowthenationalDPAs,thatareresponsiblefortheexecutionoftheEUDBNO,can suf-ficientlyinducedatacontrollerstocomplywiththeregulation.Wealsodiscussthescopeof theregulationfromasocialwelfareperspective,inparticulartheconditions,whichtrigger anotificationfromdatacontrollers.

© 2018BernoldNieuwesteegandMichaelFaure.PublishedbyElsevierLtd.Allrights reserved.

1.

Introduction

InNovember 7,2016theErasmusUniversity Rotterdam ex-perienced alargedata breachaffecting17,000individuals.1

Thedata breach wasnotified tothe Dutch DataProtection Agency(DPA)andtotheindividualsaffected.2_Wewerealso

affected and notified and experienced the practicaleffects ofdatabreachdisclosure.Thispaperwillperformalawand

economicsanalysisontheEuropeanUniondatabreach noti-ficationobligation(Hereafter‘EUDBNO’or‘theDBNO’)as in-corporatedinArticles33and34oftheGeneralDataProtection Regulation2016/679,hereafter:GDPR).3_{TheEUDBNOimposes}

anobligationonorganizationstodisclosecertainbreachesof personaldatatoanotificationauthorityandtoaffected indi-viduals(hereafter:datasubjects).Wewillanalysewhetherthe EUDBNOiseffectiveinincreasingsocialwelfare.Inaddition, wewillproposerecommendationsfortheexpostexecution andenforcementofthisimportantpieceoflegislation.4

∗_{Correspondingauthor:ErasmusUniversityRotterdam,BurgemeesterOudlaan50,3062PARotterdam,TheNetherlands.} E-mailaddress:[email protected](B.Nieuwesteeg).

1_{SeeJPBuntinx,‘ErasmusUniversityDataBreachExposesStudents’MedicalandFinancialInformation’(TheMerkle,30November2016)}

https://themerkle.com/erasmus-university-data-breach-exposes-students-medical-and-financial-information/accessed16May2018.

2_{TheDutchDataProtectionAuthorityiscalledtheAutoriteitPersoonsgegevens,seewww.autoriteitpersoonsgegevens.nlaccessed16} May2018.

3_{Regulation(EU)2016/679ontheprotectionofnaturalpersonswithregardtotheprocessingofpersonaldataandonthefreemovement} ofsuchdata,andrepealingDirective95/46/EC[2016]OJL119/1.

4_{Those breaches of personaldata canbe both analogue and digital.In practice, losses of personal data are mostly occurring} within a digital infrastructure, because the majority of personal data recordsis storedonline in our digitalizedsociety. In this paperwewillprimarilyfocusonpersonaldatabreachesinthedigitalsociety.

https://doi.org/10.1016/j.clsr.2018.05.026

Ourcoremethodologywillbealawandeconomics anal-ysisofincentivesandoptimalenforcement.5 _{Unfortunately,}

thereislittleempiricalresearchavailable,especiallyonthe EUDBNO,sinceatthetimeofconductingthisresearch,the EUDBNOdidnotyetapplyandhencenodatabreachdatahad beengenerated.Moreover,thereisnoreliabledata,for exam-pleconcerningtheeffectsofobligationstodisclosebreaches ofpersonaldataintheEU.TheentireEUDBNOistherefore largelybasedonassumptionsonhowdatacontrollerswill re-acttotheDBNO,giventheparticularsanctioningregime.Even theoretically,itisdifficulttopredicttheeffectsoftheregime asitstronglydependsonspecificassumptions.Whileour con-tributionaimstoexplainandanalysethevariouseffectsof theEUDBNO,wewillalsostatewhenwemakethesespecific assumptions.Inaddition,wewillutilizetheliteratureonthe effectivenessofDBNOsintheUS.IntheUS,moststateshavea DBNOandconsequentlythereisempiricalresearchregarding thedatabreachnotifications.6_{Thisstreamofliteraturehas}

coveredregulatoryimpact,7_{effectivenessinreducingidentity}

theft,8 _{economiceffects,}9 _{perceptionsfrom theprivate}

sec-tor10_{andthe need tointegratetheUSstatelevellawsintoa}

federallaw.11

Tothebestofourknowledge,alawandeconomics analy-sisofthenewDBNOintheEuropeanUnionhasnotyetbeen performed.12_{Athorough(exanteandexpost)scrutinyofthe}

effectsoftheDBNOcontributestothedevelopmentofEUlaw andimplementingEUdataprotectionpolicy.13

Thispaperisstructuredasfollows.InSection2,we intro-ducetheEUDBNO,itsorigins,aimsanditsembedded posi-tionintheGeneralDataProtectionRegulation.Wealsodiscuss otherbreachnotificationobligationsintheEUandcompare

5_{SeeinthisrespectalsoA.MitchellPolinskyandStevenShavell,} HandbookofLawandEconomics(vol.1,1st_{edn,Elsevier2007)chapter} 6.

6_See http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx

(accessed16May2018)forabriefoverviewregardingthe legisla-tivestatusofUSDBNOs.

7_{JaneWinn,‘Are“Better” SecurityBreachNotificationLaws} Pos-sible?’(2009)24BerkeleyTechnologyLawJournal1133.

8_{SashaRomanosky,RahulTelangandAlessandroAcquisiti,‘Do} Data Breach Disclosure LawsReduceIdentity Theft?’ (2011) 30 JournalofPolicyAnalysisandManagement256.

9_{ThomasLenard andPaul Rubin,‘MuchAdoAbout} Notifica-tion’(2016)29Regulation44;StefanLaubeandRainerBöhme,‘The economicsofmandatorysecuritybreachreportingtoauthorities’ (2016)2JournalofCybersecurity29,usesatheoreticalmodeland alsoinvolvesEUlaw.

10_{DeirdreMulliganandFredSchneider,‘Doctrinefor} Cybersecu-rity’(2011)140Daedalus70.

11_{FabioBisogni,‘ProvingLimitsofStateDataBreachNotification} Laws:IsaFederalLawtheMostAdequateSolution?’(2016)6 Jour-nalofInformationPolicy154.

12_{SuchananalysisdidnottakeplaceataMemberStatelevel} ei-ther.SomeEUcountries,suchasGermany,Ireland,Italy,Lithuania, Luxemburg,MaltaandtheNetherlandsindependentlyadopteda DBNObeforetheentryintoforceoftheGDPR.

13_{TheonlyresearchweareawareofscrutinizingtheEUDBNOis} fromPauldeHertandVagelisPapakonstantinou,‘ThenewGeneral DataProtectionRegulation:Stillasoundsystemfortheprotection ofindividuals?’(2016)32ComputerLawandSecurityReview179, 191,whotakeamorelegalapproach.

theEUDBNOwithstatelevelDBNOsintheUS.InSection3, wediscussthesocialcostsandbenefitsoftheDBNOrelative tothethresholdofnotification.Section4discusseswhether organizationswould have sufficient incentivesto notify,in theabsenceoftheregulation.Wediscussthereasonsto be-lieve thatthese incentives are likelyto beinsufficientand conclude that amarket failure is likelyto exist inthe ab-senceofregulation.InSection5,wediscusswhetherandin whichcasestheDBNO isjustifiedincorrectingthis market failure.Indoingso,wealsotakethepubliccostsofthe regu-lationintoaccount.InSection6,wecontinueourdiscussion byanalysingwhetherthecurrentlegislativedesignofthe up-comingDBNOiscapableofinducingorganizationstonotify atanacceptablesocialcost.Thesectiondiscussesseveral so-ciallyidealdesignchoicesforoptimizingthesocialpotential oftheDBNOandcomparesthemwiththeactualchoicesmade bytheEUlegislator.Wewillalsodiscussincentiveschemes relatedtotheimplementationoftheDBNOthattheEU leg-islatordidnotincludeintheactualtextoftheDBNO,such asrewardingcomplianceandtheenforcementofsanctions.

Section7discussestheoptimalnotificationthresholdforboth Article33(notificationtotheDPA)andArticle34(notification todatasubjects)andSection8willprovidesomeconcluding remarks.

2.

The

European

union

data

breach

notification

obligation

Thissectionwillstartbybrieflyintroducingtheoriginsand specificcharacteristicsoftheEUDBNOinSection2.1.Section 2.2willshortlydiscussotherEUDBNOscurrentlyinforcein the EU,which mostly concerna certainsector ortopic.As statedintheintroduction,thestudyutilizestheliteratureon theeffectivenessofDBNOsintheUS.IntheUS,moststates haveaDBNOandconsequentlythereisempiricalresearch re-gardingthedatabreachnotifications.14_{Section2.3discusses}

thesimilaritiesanddifferencesbetweentheEUandUSDBNO regimes.

2.1. TheDBNOintheGDPR

TheDBNOispartoftheextensivelegislativedataprotection packageknownastheGeneralDataProtectionRegulation ab-breviatedasGDPR.TheGDPRregulatesmanyaspectsrelated tothe processingofpersonaldatasuchasbasic principles (Article5),lawfulness ofprocessingand individualconsent (Article6)andrightsofindividualsthathaveprovidedtheir datatoathirdparty(Section2oftheGDPR).TheGDPRentered intoforceonMay24,2016andappliesafteratwo-year tran-sitionperiodfromMay25,2018.15_{Contrary toits}

predeces-sor,Directive95/46/EC,16_{theGDPRwillequallyapplydirectly}

toeverycitizenandorganizationfallingwithinthescopeof

14_{Op.cit.NCSL.org(n6).} 15_GDPR,Art.99.

16_{Directive95/46/EContheprotectionofindividualswithregard} totheprocessingofpersonaldataandonthefreemovementof suchdata[1995]OJL281/31(DataProtectionDirective).

EuropeanUnionlaw.17_{Hence,theGDPRwillbeaninfluential}

pieceoflegislation.TheGDPRprovidesfortheDBNOin Arti-cles2(2),4(7),4(12),33,34and83(4):

Article4(12)definesapersonaldatabreachas‘abreach of security leading to the accidental or unlawful destruc-tion, loss, alteration, unauthorised disclosure of, or access to,personaldatatransmitted,storedorotherwiseprocessed’. Thedefinitionthusfocusesontheconsequencesofthedata breach.In doingso,the EUlegislator incorporatesthe ‘CIA triad’ of confidentiality,integrity or availability ofpersonal data.18 _{Possibledifferencesintheoriginofthedatabreach,}

forinstancewhetheradatabreachisintentionalornegligent, arenotrelevantfordefiningadatabreach.

Articles 4 (7) states which entities have to notify data breaches.These‘datacontrollers’canbelegalpersonsor pub-licauthorities.Hence,theDBNOappliestobothpublicand pri-vateorganisations.

Article2(2)excludescertaindatabreachesfromthe notifi-cationduty.Datathat(a)fallsoutsidethescopeofEUlaw;(b) fallswithinthescopeofChapter2ofTitleVoftheTEU;(c)is carriedoutbyanaturalpersonforpersonaluseor(most no-tably)(d)isusedfortheexecutionofcriminalprosecutiondo nothavetobenotifiedwhenbreached.

Articles33and34regulatetheactualobligationtodisclose adatabreach.19_{Thereisanapparentdifferenceinnotifyinga}

databreachtoadataprotectionauthority(DPA,Article33)or tothedatasubjectsaffected(Article34).Withrespecttothe former,adatacontrollerhastonotifytheDPA‘unlessthe per-sonaldatabreachisunlikelytoresultinarisktotherightsand freedomsofnaturalpersons’.20_{Hence,this‘likelihood’isthe}

keythresholdfornotifyingtheDPA.Article33(1)further spec-ifiesthatthenotificationshouldbeassoonaspossible,and notlaterthan72hafterthedatabreach.However,thisis ap-parentlynotaredline,becauseifitisnotfeasibletodoso,the organizationcannotifylater,buthastospecifythereasons whyitdoesso.Under33(3),thedatacontrollerhastoinclude thenatureofthebreach,itsconsequencesfordatasubjects, adescriptionofcounter-measuresundertakenandacontact point.Whenpossible,theorganizationshouldalsoincludethe typeandnumberofaffecteddatasubjectsandtheamountof records,whichhavebeenbreached.

Article34showsthatthethresholdformandatory notifi-cationtodatasubjectsishigheronseveralpointscompared totherequirementsfornotifyingtheDPAexArticle33.First, notificationtodatasubjectsisonlymandatorywhenthedata breachis‘likelytoresultinahighrisktotherightsand free-doms’ofdatasubjects.Hence,whereinArticle33acertainrisk 17_{Directive95/46/EC(DataProtectionDirective)didnotcontaina} requirementtonotifydatabreaches.

18_{Shari L. Pfleeger, ‘A Framework for Security Requirements’} (1991)10Computers&Security515,518.

19_{Oflessimportanceforthispaperittheobligationunder} Arti-cle33(2)whichstatesthatdataprocessors,whichprocessdata onbehalfofthecontroller,havetheobligationtonotifythe con-trollerwithoutunduedelayafterbecomingawareofapersonal databreach.

20_{Assuch,itisquitepeculiarthattheArticlespeaksofa} likeli-hoodtoresultinarisk,sinceriskalsocontainstheelementof likeli-hood.(risk=likelihood∗_{impact).Hence,withinthispaper,wewill} justusethetermrisk.

suffices,inthecaseofArticle34theriskshouldbehigh.The GDPRdoesnotspecifythisgapbetweenriskandhighriskany further.21_{Concerningthetemporalityofnotification,Article}

34(1)solelydeterminesthatthisshouldbewithoutundue de-layanddoesnotspecifythe72hofArticle33.Inaddition,the organizationdoesnothavetodescribethenatureofthedata breachandtheamountofdatasubjectsaffectedwhen noti-fyingdatasubjects.Article34(3)heightensthethresholdeven further.ThisArticleprovidesthreepossiblearguments that organizationscanusenottocommunicatetodatasubjects. First,organizationsmayrefrainfromnotifyingdatasubjects whenthedataismadesufficientlydifficulttouse,forinstance withencryption.22_{Second,whentheorganizationhastaken}

‘subsequentmeasures’,whichensurethatthehighriskwill nolongermaterialize,theydonotneedtonotify.Third, no-tificationtodatasubjectsisnotnecessarywhenitwouldlay adisproportionateburdenontheorganization.Ergo,thereis quitealargedifferenceintheexecutionofnotificationtothe DPAandtothedatasubject.TheGDPRdoesnotstatethe rea-sonsforthisdifference.However,Article34(4)regulatesthat theDPAmayrequiretheorganizationtostillissuean addi-tionalnotificationtodatasubjectswhentheDPAassessesthat thelikelihood ofadverseconsequencesfordatasubjectsis ‘high’accordingtoArticle34(1).

Article83(4)statesthatasanctionof€10,000,000or2%of theundertakings turnover,whicheverishigher,canbe im-posedwhenthedatacontrollerfailstonotifyadatabreach.23

ThesesanctionsarehighcomparedtothesanctionsintheUS, wherebystatelevelDBNOsusuallyhavesanctionsinthe mag-nitudeof$100,000sorlower.24

ThedejuretextoftheDBNOisdefiniteandwillnotchange inthenearfuture.25_{However,theexpostexecutionand}

en-forcement ofthe obligation willnecessitate acombination ofknowledgeregardingEUlaw,datasecurityandregulatory enforcement.Therefore,webelievethattheupcomingsocial welfareanalysiscontributestothedevelopmentofEUlawand policyaftertheentryintoforceoftheregulation.

2.2. Othernotificationdutiesofdatabreachescurrently inforceintheEU

TheEUDBNOintheGDPRisnottheonlynotificationdutythat currentlyappliesintheEU.26_{Inaddition,onaMemberState}

21_{Op.cit.DeHertandPapakonstantinou(n13)191.}

22_{ThetopicofencryptionandDBNOs,althoughnotinthe} con-textoftheGDPR,isextensivelydiscussedbyMarkBurdon,Jason ReidandRouhshiLow,‘Encryptionsafeharboursanddatabreach notificationlaws’(2010)26ComputerLaw&SecurityReview520.

23_{GDPR,Art.83(4);GDPR,Art.83(2)specifiesguidelinesforthe} de-terminationoftheactualmagnitudeofthesanction.

24_{BernoldNieuwesteeg,TheLegalPositionandSocietalEffectsof} Se-curityBreachNotificationLaws(1st_{edn,deLex2014)80.}

25_{Afterall,therehavebeenmorethantwodecadesinbetween} theentryintoforceofRegulation2016/679,anditspredecessor, Directive95/46/EC.

26_{Foramoreextensive,albeitslightlyout-datedoverview(sinceit} discussesthedraft-GDPRandproposedNIS-directive),wereferto SamsonEsayes,‘BreachNotificationRequirementsUnderthe Eu-ropeanUnionLegalFramework:Convergence,Conflicts,and Com-plexityinCompliance’(2014)31J.MarshallJ.Info.Tech.&Privacy L.317.

level,thereareoftenmanymoreDBNOs,whichcouldoverlap orbereplacedbytheEUDBNO.Inthissection,wewilllimit ourselvesbydiscussingDBNOsthatcouldentailpersonaldata onanEUlevel.

Article4(3)E-privacydirective2009/136/EGamendingdirective 2002/58/ECregulatesadatabreachnotificationobligationfor telecommunicationproviders. Thewordingofthe DBNOin the GDPRhassimilarities withthisdirectivesinceitstates that ‘inthecaseofapersonaldatabreach,theprovider of publicly availableelectroniccommunications servicesshall, withoutunduedelay,notifythepersonaldatabreachtothe competentnationalauthority.Whenthepersonaldatabreach islikely adverselytoaffect thepersonal dataor privacyof asubscriberorindividual,theprovidershallalsonotifythe subscriberorindividualofthebreachwithoutunduedelay’. CommissionRegulation611/2013furtherregulatesthedetails ofdatabreachdisclosureinthecontextoftheE-privacy di-rective. The E-privacy directiveand the GDPR are not mu-tuallyexclusive,sincetelecommunicationprovidersalsofall withinthescopeoftheGDPR.However,onsomeelements,the databreachdisclosurerequirementsfortelecommunication providersaresomewhatstricter.Forinstance,thedatabreach has(whenfeasible)tobenotifiedwithin24h(Article2(2) Reg-ulation611/2013)comparedtothe72hthatarerequiredin Articles33and34oftheGDPR.

Article19(2)eIDASRegulation910/2014regulatesthe manda-torydisclosureofabreachofsecurityorthelossofintegrityof trustservicesproviderssuchascertificateauthorities.These lossescouldalsoentailthelossofpersonaldata,andinsofar thebreachorlossofintegrityadverselyaffectsanaturalor legalpersonthispersonshouldalsobenotified.27

Article30andArticle31EUdirective2016/680onthe process-ingofpersonaldatabycompetentauthorities.Paralleltothe leg-islativeprocessGDPR,adirectivewasdraftedthatregulates dataprocessingforcompetentauthorities,suchasthejudicial apparatusofEUMemberStates.Thisdirectivealsoregulates databreachdisclosurebythesecompetentauthoritiestothe supervisoryauthority(Article30)andthedatasubject(Article 31).OneofthemainotherdifferenceswiththeGDPRisthat MemberStatesarefreetoimplementasanctioningsystemas longasthisis‘effective,proportionateanddissuasive’(Article 57).

Article14(3)NIS(networkandinformationsecurity)Directive 2016/1148.TheNISdirectiveregulatescybersecurityfor net-workandinformationsystems,whichare‘essentialservices’ suchas theenergyand utilityindustry.Article14 (3) regu-latesthesecuritybreachnotification.Operatorsofessential servicesshould,withoutunduedelay,incidentshavinga sig-nificantimpactonthecontinuityoftheessentialservicesthey providetoacompetentauthority.28_{Theseincidents,suchas}

forinstanceacyber-attackonapowergrid,couldalsoentail personaldatabreaches,althoughonecouldexpectthatthese companieswouldseparatelydisclosethesedatabreaches un-dertheGDPRorE-privacydirectiveregime.

27_{Seeforadiscussionofthetopic:AxelArnbak,HadiAsghari,} MichelvanEetenandNicovanEijk,‘SecuritycollapseintheHTTPS market’(2014)57CommunicationsoftheACM47.

28_{Whichis(often)adifferentauthoritythanthedataprotection} authorityoftheGDPR.

2.3. DifferencesbetweentheEUandUSlegislation TherearesignificantdifferencesbetweentheDBNOregimes intheEUandUS.Firstly,theEUDBNOisregulatedata cen-tralEuropeanlevelinsteadofatthestatelevelforUSlaws, whicharepartlymucholderthantheEUlaw.29_{Californiawas}

thefirstUSstatetoadoptaDBNOin2006andotherstates quicklyfollowed.30_{AsofMarch28,2018,Alabamabecamethe}

50thandfinalstatetoenactaDBNO.31_{Thispatchworkofstate}

levelDBNOshasprovidedsomechallenges.Forinstance,large (national)databreachesthatinvolverecordsofdatasubjects inmultiplesstateshavetobenotifiedaccordingtothe var-ious(slightlydifferent)legal regimes.32 _{Therefore,therehas}

beensomeliteratureregardingthedesirabilityofaDBNOona centrallevelintheUS.33_{Wewillnotincludethisstreamof}

lit-eratureinourmainargumentbecausethepatchworkissueis notrelevantintheEUsincetheDBNOisregulatedatacentral level.

Secondly,concerningthesanctioningregime,whichisone ofthecornerstonesforourlawandeconomicsanalysis,there arealsosomenotabledifferences.IntheUS,the administra-tivepenaltiesforDBNOsareusuallytwoordersofmagnitude lower thaninthe EUDBNO.Forinstance,the Virginiadata breachnotificationlaw,whichhasoneofthehighest sanc-tionsintheUS,allowsforanimpositionofa$150,000fine.34

However,intheUS,privacyclassactionscouldbeamuchmore significantcostfororganizations.35

Thirdly,themainreasond’êtreoftheUSandEUDBNOis dif-ferent.Section3.2willshowthattherearethreesocialbenefits forDBNOs:therighttoknowfordatasubjectsthatdataislost orharmed,informationdiffusionregardingdatabreachesand thepossibilitytoclaimdamagesbythesesamedatasubjects. FortheEuropeanUnion,theprotectionofpersonaldataand therighttoknowhasbeentheprimaryreasontoadopttheEU DBNOsinceitispartoftheGeneralDataProtectionRegulation. IntheUS,themultitudeofthethreesocialbenefits,especially therighttoknowand informationdiffusion,are positioned moreequally.36

Hence,wewilltakethepeculiaritiesoftheEUlegalregime into account in order to facilitate transplantation of the

29_Ibid155.

30_{Op.Cit.Nieuwesteeg(n24).}

31_{Aleksandra Vold, ‘That’s All Folks! Alabama Becomes 50}th State With Breach Notification Law’ (Thompson Coburn LLP,11 April 2018) https://www.thompsoncoburn.com/insights/blogs/ cybersecurity-bits-and-bytes/post/2018-04-11/that-s-all-folks! -alabama-becomes-50th-state-with-breach-notification-law

accessed16May2018.

32 _{Forinstance,thethresholdsandlegallanguagebetweenthe} USstatelevelDBNOsdiffer.SeeMarkBurdon,BillLaneandPaul vonNessen,‘Themandatorynotificationofdatabreaches:Issues arisingforAustralianandEUlegaldevelopments’(2010)26 Com-puterLaw&SecurityReview115.

33_{Seeforinstance:FabioBisogni,‘ProvingLimitsofStateData} BreachNotificationLaws:IsaFederalLawtheMostAdequate So-lution’(2016)6JournalofInformationPolicy154.

34_{CodeofVirginia§18.2-186.6.}

35_{SashaRomanosky,DavidHoffmanandAlessandroAcquisti,} ‘EmpiricalAnalysisofDataBreachLitigation’(2014)11Journalof EmpiricalLegalStudies74.

lessonslearnedontheothersideoftheAtlantic.Forinstance, inpursuingthesocialbenefitofinformationdiffusioninthe EUDBNO,oneshouldbecognizantofthefactthatinformation diffusionaboutpersonaldatabreachesandmutuallearning hasnotbeenthemainstartingpointofthelegislativeprocess thathasledtotheGDPRandtheDBNO.

3.

The

social

benefits

and

costs

of

the

DBNO

ThissectiondiscussesthesocialbenefitsoftheDBNO gen-erally.Thestartingpointhereisthatthesocialbenefitsofthe DBNOdependonthedisclosurethreshold.Section3.1will fur-ther introducethis ‘threshold’ perspective. Section 3.2 will discussthesocialbenefitsofaDBNO,whileSection3.3will discussitssocialcosts.

3.1. Thethreshold

TheEUlegislatordefinesthedatabreachnotification thresh-old inthe GDPR:data breachesthatresultin a‘risktothe rightsandfreedomsofnaturalpersons’inthecaseof notify-ingtheDPA(Article33).Inthecaseofnotificationtoaffected datasubjects,thisriskshouldbe‘high’(Article34).Naturally, somedatabreachesaremoreriskythanothersare.37_Identity

thefthasahighrisk,creditcardthefthasalowerriskandthe theftofcertainpasswordsandusernamesofnon-vital web-sites, aswellasencrypted data,haveanevenlower risk.38

Hence,theoretically,thesedatabreachescanbeplottedona riskcontinuum.ThetwothresholdswithintheEUDBNOare certainpointsonthisriskcontinuum.Thispaperdiscusses towhatextentthesocialoutcomesoftheregulationchange whentheriskthresholdisinterpretedmoreorlessstrictlyand consequentlymoreorfewerdatabreacheshavetobe noti-fied.Tobeprecise,wewillobservethe driversforachange inprivateandsocialoptimawhenthethresholdshifts.39_In Section7,wewillalsodiscusswhetheritissociallydesirable todistinguishbetweenthresholdsfornotifyingtotheDPAand tothedatasubjectsaffected.Intheupcomingsections,wewill primarilyfocusontheprivateandsocialbenefitsandcosts ofnotificationtodatasubjectsexArticle34GDPR.InSection 7.1wewilladdressthedifferentsituationoftheobligationto notifytheDPA.

37_{This paper doesnot aim to provide an extensive overview} ofpersonaldatabreachesandtheirriskforindividuals, organi-zationsandsociety.Forthepotentialconsequencesofpersonal data breachesandtheir risksforindividualsandorganizations seeinteraliaVerizon,‘DataBreachInvestigationsReport’http:// www.verizonenterprise.com/verizon-insights-lab/dbir/2017/

accessed16May2018

38_{GDPR, Art. 33(3) underc; Compare forinstance the Steam} hack which also included creditcard theft,but also less vital username information: Casey Johnston, ‘ValveconfirmsSteam hack: credit cards,personal info may be stolen’ (Ars Technica,

11 November 2011) https://arstechnica.com/gaming/2011/11/ valve-confirms-steam-hack-credit-cards-personal-info-may- be-stolen/accessed16May2018.

39_{We assume that data breaches carry a similar amount of} records(beingaffectedconsumers).

3.2. Thesocialbenefits

Thissectionwilldiscussthesocialbenefitsofdatabreach dis-closuretodatasubjects.First,andforemostfortheGDPR,the socialbenefitofdatabreachdisclosureistheimplementation ofthedatasubjects’‘righttoknow’thattheirdatahasbeen compromised.This‘righttoknow’isanaspectofthe funda-mentalrightontheprotectionofpersonaldata,enshrinedin theCharterofFundamentalRightsoftheEuropeanUnionand theEuropeanConventionofHumanRights.40_{Theprotection}

ofpersonaldatahasbeentheprimaryreasonfortheEuropean UniontoadopttheGDPRandthereintheEUDBNO.41_The

so-cialbenefitofthe‘righttoknow’isintangible.Inaddition,its intrinsicvaluevariesamongschoolsofthought.Ononeside ofthespectrum,thereisastreamofliteraturethatprioritizes fundamentalrightsbyqualifyingitas‘afirstlineofdefence’.42

Ontheothersideofthespectrum,thereisliteraturethat ar-guesthattherighttoknowhasalimitedvalue,43supported byempiricalresearchthatevaluatesthelowmonetaryvalue consumersattachtothisright.44_{Thevaluationoftherightto}

knowwill,inademocraticsociety,bedecidedbythe policy-makeraccordingtothepreferencesofthevoter.Inaddition, thevalueoftherighttoknowwillstronglydependuponthe natureofthedatabreach.Forexample,itmaybemore im-portantforanindividualtobeawareofanidentitytheftthan ofthelossofausernameorpasswordforaSteamaccount(a platformformobilegaming).45

Second,databreachdisclosurewillresultinadditional in-centivesfordatasecurityimprovementsforindividualsand organizations.Thereareshortandlong-termeffectsand di-rectandindirecteffectsofthediffusionofdatabreach disclo-sureinformation.46_{Databreachdisclosurehasashort-term}

direct impact on mitigating and avoiding consumer47 _and

40_{CharterofFundamentalRightsoftheEuropeanUnion[2012]} OJC326/1,Art.8;EuropeanConventionofHumanRights,Art.7. TherighttoknowisdescribedclearlyinArticle8(2)oftheCharter, whichstatesthat“everyonehastherightofaccesstodatawhich hasbeencollectedconcerninghimorher,andtherighttohaveit rectified”.

41_GDPR,Art.1.

42_{AxelArnbak,Securingprivatecommunications:protectingprivate} communications security inEU law- fundamentalrights, functional valuechains,andmarketincentives(1st _{edn,Kluwer Law} Interna-tional2016)Chapter4.

43_{RichardPosner,EconomicAnalysisofLaw(6}th_{edn,AspenLaw&} Business2002)711.

44_{Ignacio Cofone, ‘The Value of Privacy: Keeping the Money} Where the Mouth is’ (2014) RILE Working Paper Series 15/2014, http://www.econinfosec.org/archive/weis2015/papers/ WEIS_2015_cofone.pdfaccessed 16 May 2018.

45_{Thisgradualdecreaseoccursindependentlyoftheabsolute} valueoftherighttoknow,which,assaid,hastobedetermined bysocietaldebate.

46_{Op.cit.Romanosky,TelangandAcquisiti(n8)259;Thisisalso} theaimoftheDutchDBNOwhichstatesinitsexplanatory memo-randumthatthecentralavailabilityoftheinformationwill stimu-latetheabilitytolearnoforganizationswhichhavebeenbreached. 47_{PaulSchwartzandEdwardJanger,‘NotificationofData} Secu-rityBreaches’(2007)105MichiganLawReview913,915;Deirdre Mulligan,Security BreachNotificationLaws:ViewsfromChief Secu-rityOfficer (Study Conducted forthe Samuelson Law, Technol-ogy&PublicPolicyClinic,UniversityofCalifornia-BerkeleySchool

organizationallosses.48_{However,organizationsand}

individ-ualsmayover-investintheirsecurityimprovements.49_Inthe

longterm,accordingtoUSchiefsecurityofficers,databreach disclosurecanfoster“cooperationbetweeninformation secu-ritydepartments”.50_{Thisdiffusionofinformationhaspositive}

effects onoverall security.51 _{Furthermore,indirectly,adata}

breachdisclosureraisesthepublic’sawarenessregarding cy-bersecurity.Similartotherighttoknow,weassumethatthe informationbenefitforsecurityimprovementislowerwhen thesignificanceofthedatabreachriskislower.

Third,thepotentialliabilityclaimthatcanfollowa disclo-sure hasasocialbenefit.Liabilityresultsinbehaviourthat incentivizes organizationstointernalizesomeofthe exter-nalitiesincybersecurity.Quitenaturally,individualscanonly claimdamageswhenadatabreachdisclosurebecomespublic andtheyareawareofit.Liabilitycanevenaccumulateinclass actions.52

3.3. Thesocialcosts

Therearealsosocialcostsofdatabreachdisclosure.First, in-dividualsandorganizationswhosedatahavebeenbreached incurdirectcostsbecausetheyhavetospendtimeandmoney inordertoanalyseandmitigatetheirimpact.Thismightbea minorcostperrecord,butifhundredsofthousandsofrecords arebeingbreached,thenumbersquicklyaddup.53_Thecost

ofconsumeractionsmightbegreaterthanexpectedbecause consumerscanspendseveralhoursoftimeontheiraccounts and imposecostsonfirmsbyrequestingmoreinformation on,forinstance,newcreditcards.LenardandRubinestimate thatthis costis$10perdatasubject.54_{Second,anincrease}

intheamountofnotificationscanleadtoadecreaseinthe positiveeffectsofdisclosure,becausedatasubjectscanpay lessattention toeach individualdatabreach.Subsequently, theinformationdiffusionbecomeslessmeaningfuland even-tuallyalldatabreachescouldjustbeperceivedasirrelevant information.55_{Welabelthiseffect‘notificationfatigue’.Thus,}

ofLaw,2007)23,availablethroughhttps://www.law.berkeley.edu/ files/cso_study.pdfaccessed 16May 2018.Thisdiscussion is linked tothetimingofthenotificationstudiedbyFabioBisogni,‘Data BreachesandtheDilemmasinNotifyingCustomers’(2015), pre-sentedatThefourteenthAnnualWorkshopontheEconomicsof InformationSecurity,Delft,22-23June2015.Thefasterthe disclo-suretakesplace,themorebenefitsforconsumers.Weexpectthis tobeequaloversignificance.

48_{Op.cit.Romanosky,TelangandAcquisti(n8)258.} 49_{Op.cit.LenardandRubin(n9)48.}

50_{Op.cit.Mulligan(n47)18.}

51_{HulisiOgut,SrinivasanRaghunathanandNirupM.Menon,} ‘In-formationSecurityRiskManagementthroughSelf-Protectionand Insurance’(2005)TheUniversityofTexasSchoolofManagement 1,31.

52_{EspeciallyintheUS,seeop.cit.Romanosky,Hoffmanand} Ac-quisti(n8).

53_{Forinstanceaconsumerspends10minutesongaining} knowl-edgeaboutadatabreach,atan18europerhouropportunitycost, a100.000recordbreachcancostssociety300.000euro.Thesecosts arepubliccostsinsofarastheyarenotbeingcompensatedbythe privateorganization.

54_{Op.cit.LenardandRubin(n9)47.Itismorelikelytobeonthe} uppersideofthespectrum.

55_{Op.cit.Mulligan(n47)33.}

Table 1 – Social costs and benefits. Socialbenefits Marginal

social benefits relativetoa decreasing notification threshold

Socialcosts Marginalsocial costsrelativetoa decreasing notification threshold

Righttoknow Decreasing Administrative costs(data subjectside) Minor decrease Information diffusion Decreasing Notification fatigue Increasing Liability Decreasing Over-reactionin

restricting security

Decreasing

notificationfatiguedoesnot onlyaffectthe benefitsofthe (leastimportant)databreach,butalsohasnegative external-itiestowardsotherdatabreaches.Alldatabreachesbecome less importantwith the introduction ofanadditional data breach (through lowering the threshold).Likewise,as soon asmorenotificationsarebeingmade,forexampleby lower-ingthenotificationthreshold,thebenefitsoftheadditional databreach willdecreaseandthecosts(thenegative exter-nalitytootherdatabreaches)willincrease.Third, organiza-tionsmayover-investinsecuritybecauseofnotifyingthedata breach.However,thisisnotexpectedtobeaverysignificant socialcostbecauseingeneral,organizationshaveincentives tounder-investincybersecurity.56

3.4. Socialcostsversussocialbenefits

Table1belowdisplaysthesocialcostsandbenefitsrelativeto adecreasingnotificationthreshold.

Marginalsocialbenefitsalldecreasewhenlessriskydata breacheshavetobenotified.Themarginaladministrativecost islikelytodecrease,becausethedatasubjectwilltakemore timeinreviewingariskydatabreachthanalessriskydata breach.However,thedecreasewillquicklyflattenout,because acertainbaselineofinvestigativecostshavetobemadeby eachdatasubject.Inaddition,over-investmentby organiza-tions willbeless likelywhenless importantdatabreaches havetobenotified.Notificationfatiguewilllogicallystrongly increasewhenalargerpoolofdatabreacheshavetobe no-tified.Notificationfatiguedrivesoverallmarginalsocialcosts toincreaseandtheminordecreaseofadministrativecostand theoverallminordecreasingeffectofover-investmentcannot compensateforthat.Insum:theremaybepositivesocial ben-efitsfrom notification,butthesecanbereducedbecauseof notificationfatigue.Toreducethatrisk,determiningthe ap-propriatethresholdfornotificationiscrucial(seeSection7). Fornow,weassumethatasmartthresholdwillbedetermined andthatdisclosureisthereforesociallybeneficial.Thatthen leadstothefollowingquestion:

56_{Duetothemainlypositiveexternalitiesthatarepresentin} cy-bersecurity.

4.

Will

there

be

spontaneous

disclosure

in

the

absence

of

the

obligation?

Thissectiondiscusseswhethertherewillbespontaneous dis-closureintheabsenceoftheobligation.Wewillassessthe pri-vatecostsandbenefitsbecauseofdisclosure.Section4.1will discussprivate benefitsandSection 4.2willdiscussprivate costs.

4.1. Privatebenefits

First,organizationsexperienceabenefitbecausethe disclo-sureofdatabreachesallowsforthefastermitigationofthe impactofthebreach.Thisreducesdirectcosts.Thisis espe-ciallyrelevantwhenconsumersneedtotakeactionafterthe databreach,suchasrefrainingfromusingstolencreditcard informationorusingoldpasswords.Moreover,aDPAcan po-tentiallyassistinmitigatingthebreachbyprovidingtargeted advice.

4.2. Privatecosts

Besidesbenefits,privatepartiesalsoincurcostswhen disclos-ingdatabreaches.57_{First,therearetheadministrativecostsof}

disclosingdatabreachestotheaffecteddatasubjects. How-ever,themajorriskis(perceived)reputationdamage.The lit-eratureshowsthatdatabreachdisclosuredoeshavelimited singledigit(1or2%)negativemarketvalueimpactontheshort term.58_{However,researchthatfocussedonthelongterm}

sug-gests,“informationsecuritybreacheshaveminimallong-term economicimpact”.59_{WebelievethattheTargetstockprice}

ex-57_{Theseprivatecosts,andthenecessitytobalancethesecosts} withthesocialbenefitsofDBNOshavebeendebatedinthe liter-ature.Forinstance,MarkBurdon,BillLaneandPaulvonNessen, ‘DatabreachnotificationlawintheEUandAustralia– Whereto now?’(2012)28ComputerLaw&SecurityReview296,307 men-tioncompetingrationales,suchasthe‘dualconflictofeffective consumerprotectionsrelatingtoidentitytheftthreatsand min-imisingcorporatecompliancecosts.’

58_{Reputationdamageisusuallyquantifiedasthedifferencein} companyvaluebeforeandafterthedisclosure.SanjayGoeland HanyHawsky,‘Estimatingthemarketimpactofsecuritybreach announcementsonfirmvalues’(2009)46Information& Manage-ment404,408,usedsuchaneventstudymethodology.They mea-suredthemarketvalueofthecompanyafewdaysbeforeandafter thenotionofasecuritybreachandfoundanegativeeffectofon averageabout1%ofthemarketvalue.HuseyinCavusoglu, Biren-draMishraandSrinivasanRaghunathan,‘TheEffectofInternet SecurityBreachAnnouncementonMarketValue:CapitalMarket ReactionsforBreachedFirmsandInternetSecurityDevelopers’ (2004)9InternationalJournalofElectronicCommerce69,71, iden-tifiedthroughasimilarapproachanincidentallossofstockprices of2.1%.Theydiscussdirectandindirectcostsofdatabreaches, butthisisaslightlydifferenttopic,asthispaperisabouttotalk aboutdatabreachdisclosure.PierangeloRosati,MarkCummins, PeterDeeney,FabianGogolin,LisavanderWerffandTheoLynn, ‘Theeffectofdatabreachannouncementsbeyondthestockprice: Empiricalevidenceonmarketactivity’(2017)49International Re-viewofFinancialAnalysis146,152,findthatmarketactivityonthe shorttermslightlyhigherafteradatabreachannouncement.

59_{MyungKoandCarlosDorantes,‘Theimpactofinformation} se-curitybreachesonfinancialperformanceofthebreachedfirms:

ampleshowsthedifficultyinpointingoutlong-term reputa-tionaldamage.Targetwasthesubjectofaverysignificantdata breachinDecember2013.Fig.1belowdisplaysthegraphofthe stockmarketvalueofTarget.Itisimpossibletoidentifythe dayofthedatabreach,asonothertradingdaysstockprices didfluctuatemorethanduringtheeventinlateDecember.60

Inpractice,thedistributionofrealreputationalcostshasa long-termeffect.Someorganizationwillsuffernosignificant long-termreputationdamage,whileothercompanieswillgo bankruptbecauseofthedisclosureofthedatabreach.61_The

formergrouparelikelytoconsistoforganizationswitha sta-blecustomerbasethatareabletoexploitlock-instrategies andaretoobigtofail.Adatabreachdoesnotreducethe like-lihoodthatconsumersbuytheproductorservicesofthese organizations.The lattergroup has asmall customer base and/oroffersproductswithtrustasacoresellingpoint.62

Nev-ertheless,theperceivedvalueofreputationdamageismore im-portantthanitsobjectivevalue.Asasecurityofficerpointed out,“fearofreputationdamage… drivesorganizationstotake stepstoatleast evaluate,ifnotcorrectand enhance secu-ritymechanisms”.63_{Alternatively,considerthefollowingblog}

post:“OurheadofITSecurity(ofamajortelecom)toldusonce, ‘wehaveonekeymetric:Don’tshowupintheWallStreet Jour-nalforasecuritybreach.’”64

Athirdissueisliability.Thegenerallogicisthatwhena databreach becomespublic, theopportunity arises forthe publictosueorganizations.Therefore,notifyingdatabreaches raisesthelikelihoodofliabilitycosts.Romanoskyfindsthat whenconsumerssufferfinancialharm,theriskoflitigation increaseswithafactorof3.5.65_{However,twodriversmitigate}

anempiricalinvestigation’(2006)16JournalofInformation Tech-nologyManagement13,20,usedamatchedsamplecomparison analysisinsteadofeventstudymethodologytoinvestigatethe im-pactofsecuritybreachesonfirmperformance.Theseobservations aboutlong-termimpactshouldbetakenwithcare,becausethe ef-fectofthedatabreachismuchhardertodisentanglefromother exogenousvariablesandhighqualitypaneldataisnotavailable.

60_{‘In the days priorto Thanksgiving2013,someone installed} malwareinTarget’s securityandpaymentssystem designedto stealeverycreditcardusedatthecompany’s1,797U.S.stores.’ SeeMichaelRiley,BenElgin,DuneLawrenceandCarolMatlack, ‘Missed Alarms and 40 Million Stolen Credit Card Numbers: How Target Blew It’ (Bloomberg, 17 March 2014) https://www. bloomberg.com/news/articles/2014-03-13/target- missed-warnings-in-epic-hack-of-credit-card-data accessed 16 May 2018.

61_{RobertLaytonandPaulA.Watters,‘Amethodologyfor} estimat-ingthetangiblecostofdatabreaches’(2014)19Journalof Infor-mationSecurityandApplications321alsoindicatethatfirmscan stillgrow,whilewriting-offsomeexpendituresrelatedto reputa-tiondamage.

62_{Compareforinstancethe2017Verizondatabreachwiththe} 2011Diginotardatabreach.Theformerdidnotencountermajor issueswhilethelatterwentbankrupt.

63_{Op.cit.Mulligan(n47)14.}

64_{See the following article on Bruce Schneier’s blog: Bruce} Schneier, ‘Breach Notification Laws’ (Schneier on Security, 21 January 2009) https://www.schneier.com/blog/archives/2009/01/ state_data_brea.htmlaccessed 16 May 2018.

65_{Op.cit.Romanosky,HoffmanandAcquisti(n8)76.This} re-searchisbasedonUSdatawheretheuseofliabilitylawismore commonthaninotherjurisdictions.

Fig.1– Stockmarketvalueoftargetcorp.

Table 2 – summary of private costs and benefits. Privatebenefits Marginal

private benefits relativetoa decreasing notification threshold

Privatecosts Marginalprivate costsrelativetoa decreasing notification threshold Mitigationof impactand improvement ofsecurity Decreasing Administrative costs Slight decrease Reductionin reputation damage Decreasing Reputational damage Decreasing Additional perceived reputation damage Decreasing

Liabilitycosts Decreasing

this effect.First,awell-planned notificationstrategyfor or-ganizationscanmitigateliabilitycosts.Liabilityriskscanbe reducedwhentheorganizationisabletoshowthatittook ap-propriateactioninnotificationandreductionoftherisk(such asimmediatedisclosureitself).IntheU.S.,thelikelihoodofan organizationbeingsuedissixtimeslowerwhenthe organiza-tionoffersfreecreditmonitoringafterthedatabreach.66

Sec-ond,whenacompanyintentionallyconcealsdatabreaches and they nevertheless becomepublic,it canreasonablybe expected that the likelihood and impact of claims will be higher.Wesummarizeprivatecostsand benefitsinTable2

below.

Privatebenefitsandcostsarestronglycorrelatedwiththe magnitudeofthedatabreach risk.Private benefitsbecome higherwhendatabreachesthathavetobenotifiedaremore risky,whiledecreasingwhenbreachesbecomelessrisky.With

66_Ibid91.

regardtoprivatecosts,weexpecttheseadministrativecostsof disclosuretodecreaseslightly.Thisisrelatedtothe assump-tionthattheadministrativeproceduretoinformcustomers willtakeslightlymoretimewhenthebreachismore signif-icantbecauseitcanbeexpectedthatdatasubjectsdemand moreinformation.Weexpecttheothermarginalprivatecosts to decrease relative to a decreasing notificationthreshold. Concerningabsolutenumbers,privatecostsare(perceivedas) highandcertain,whileprivatebenefitsareindirectand un-certain.Hence,we assume that (at leastin the perception ofthe organization that hasthe notificationduty) the pri-vatecostsofdatabreachdisclosurearehigherthanthe pri-vatebenefits.Ergo,therearefewincentivesforaprivateactor spontaneouslytonotifydatabreachesintheabsenceofthe obligation.67

5.

The

case

for

the

DBNO

Section 3 observedthat adata breach notificationhas so-cialbenefits,mostnotablybringinginformationtothemarket thatservesasarighttoknow’andtheinformationdiffusion.

Section4observedthatdatabreachdisclosuremostlikely im-posesa netcost onprivate parties.There willnotinmost

67_{Surely,therearedatabreachesforwhichprivatebenefitsof} disclosureexceedprivatecosts.Forinstance,whenthereisa (per-ceived)highlikelihoodthatabreachwillbemadepublicbyathird party.Insucha situationthe differenceinreduced (perceived) reputationdamageandthethreatofliabilityclaimsmayweigh againstdisclosurecosts.Therehavebeencasesofspontaneous disclosureofdatabreachesinthepast,althoughthe‘spontaneity’ ofthesedisclosuresissometimeshardtodisentanglefromlocal legalobligations.Forinstance,intheNetherlands,therehasbeen alocaldatabreachnotificationlawsinceJanuary1,2016untilthe applicationoftheGDPR.Inaddition,contractualobligations be-tweenpartiescouldhavetriggereddatabreachdisclosureinthe past.Also,casesofspontaneousdisclosurearehardtoretrieve sincethereisobviouslynoobligationtonotifyaDPAinthe ab-senceofthelaw.Tothebestofourknowledge,therehasbeenno furtherresearchconductedonthespontaneousdisclosureof per-sonaldatabreachesintheEU.

Table 3 – Public costs of a DBNO. Publiccosts(costsassociated

withtheoperationofthe legalsystem)a

Marginalpubliccostsrelativetoa decreasingnotification threshold

Adoptioncosts Sunkcosts CostsofDPA Stable

Costsofenforcement Stableforgeneralenforcement,up tothresholdviolationspecific enforcement

Costsofthedigitalfirstaidkit Stable

a _{StevenShavell,‘TheLevelofLitigation:PrivateVersusSocial}

Op-timalityofSuitandofSettlement’(1999)19InternationalReviewof LawandEconomics99,100:“Toamplify,theprivatecostofasuit islessthanthesocialcostofasuit,forthatincludestheinjurer’s costsaswellasthepubliccosts(thosecostsassociatedwiththe operationofthejudicialsystem).”

casesbespontaneousdisclosureintheabsenceofthe obli-gation.Thissectionexaminesin5.1whethersocialsurplus is likelyto remain, evenwhen net private costs are taken into accountandarguesthatthereisacaseforregulation.

Section5.2discussesthepubliccostofenforcingtheBDNO.

5.1. IsthereacasefortheDBNO?

Most data breach disclosures impose a cost on data con-trollers.Uptothethreshold,thesocialbenefitsoutweighthe (net)privatecosts.Withinthis area,thereisacasefor reg-ulation.Thesocialoptimalthresholdfordisclosurewillliea notchhigher,becausenetprivatelosseshavetobeaddedto thesocialcosts.Thedatabreachesbelowthethresholdwill haveinsufficientpositiveeffectstocompensateforthe nega-tiveeffectsandgenerateasocialloss.Itbecomesquiteclear thatthisisimportanttogiveadirectionfordistinguishingand clarifyingthethreshold,whichwewilldoinSection7.

5.2. PubliccostoftheDBNO

TherearealsopubliccostsoftheDBNO(Table3).Thefirstis theadoptionoftheregulationassuch.Therearecosts associ-atedwiththediscussionandadoptionoftheregulationbythe EUlegislator.Thesearesunkcostsandtheregulatorcanalso incurthesecostswhentheregulationisnotadopted.There arealsocostsinvolvedinprocessingthenotificationsatthe DPA.Furthermore,thereareenforcementcosts68_andpossible

costsinvolvedinofferingadigitalfirstaidkit,discussedinthe nextsection.

Whenweaddthepubliccoststothenewsocialoptimum, thesociallyoptimalthresholdbecomeshigher.

68_{Op.cit.PolinskyandShavell(n5);SharonOded,‘Inducing} cor-poratecompliance:Acompoundcorporateliabilityregime’(2011) 31InternationalReviewofLawandEconomics272,273;George Stigler,‘TheOptimumEnforcementofLaws’(1970)78Journalof PoliticalEconomy526,526.

6.

Will

the

EU

DBNO

sufficiently

induce

data

controllers

to

notify?

Section3arguedthatdisclosureissociallybeneficialfora cer-tainareaofdatabreaches(uptothethreshold).Section4 con-cluded that, forthe majority ofthose databreaches, there wouldbeinsufficientincentivesforspontaneousdisclosureby privateparties.Section5arguedthatthereisacasefor regu-lation,becausethesesocialbenefitsarehigherthanprivate costs,providedthatthebenefitsofregulationoutweighthe publiccostsofregulation.Thequestionthissectionaimsto addressiswhethertheEuropeanregulationwillsufficiently inducedatacontrollerstonotifythosedatabreachesforwhich disclosureissociallybeneficial.

6.1. Theadministrativefine

Theadministrative fineis the maindesignparameter that inducesdatacontrollerstonotifywithinArticles33,34and 84(4)theDBNO;especiallyArticle84(4)GDPRgivesDPAsthis power.69 _{Inthecaseofnon-compliancewiththeregulation,}

DPAsaregrantedthepowertoimposeanadministrativefine of€10,000,000or2%oftheundertakingsturnover,whichever ishigher.70_{Thefinecanbeimposedwhenthedatacontroller}

concealsadatabreachor doesnotnotifyinduetime.The administrativefinehasseveraltheoreticaladvantages.First, the fine hasa multiplication effect. Thefine hasan effect onceimposed,aswellasthethreatoftheeffectthancanbe executedmultipletimesoncedatacontrollerscomply.Thus, whenthesanction isset atadeterrentlevelthatforces all datacontrollerstocomply,thesanctionitselfiscostless, be-causeitdoesnothavetobeexecuted.Insuchasituation,only thethreatsuffices.71_{Moreover,evenifthefinehastobe}

im-posed,thefineitselfisconsideredasociallycostlesstransfer ofmoney(contrarytootherthreatssuchasimprisonment).72

Last,highersanctionsallowforlowerlevelsofenforcement toremainanidenticallevelofdeterrence.Thehighsanctions inArticle84(4) GDPRconsequentlycould saveenforcement costs.

However,thehighfineinArticle84(4)GDPRalsohasseveral disadvantages.Forsmalldatacontrollers,themaximum de factofinewillbelowerbecauseahighfinewillgobeyondtheir solvency.73_{Next,highsanctionscanleadtoover-and}

under-deterrencewhen the perceptionofthelikelihood of detec-tiondiffersfromtheactuallikelihoodofdetection.74_This

phe-nomenonoccursespeciallywhenthereisalowlikelihoodof 69_{Op.cit.Nieuwesteeg(n24)80.ThemajorityoftheDBNOsinthe} worldapplypenaltiesinordertodeternon-compliance.

70_{GDPR,Art.83(4).}

71_{See Giuseppe Dari-Mattiacci and Gerrit de Geest, ‘Carrots,} sticks,andthemultiplicationeffect’(2010)26JournalofLaw, Eco-nomics, andOrganization 365,365,compare the discussion in

supraSection2.2onperceivedreputationdamage. 72_{Op.cit.PolinskyandShavell(n5).}

73_{Also,inpractice,itislikelythatmostactualfineswillbelower} thanthemaximum,loweringtheirdeterrenteffect.Article83(2) specifiesseveralcircumstancesofthecasethathavetobetaken intoaccountfortheactualdeterminationofthefine,suchas neg-ligenceandmitigationmeasures.

detection.Tobespecific,datacontrollerscouldbeincentivized tonotifydatabreachesthataresubjecttomandatory notifi-cation(becausetheydonotresultinariskfordatasubjects) justbecausetheywanttobe‘onthesafeside’.Thisassumes thatthedatacontrollersdonothaveexactinformationabout thetwothresholds.Thisisreasonabletoexpect,because cur-rently the thresholdsare notdefined any furtherthan the qualificationof‘risk’or‘highrisk’totherightsandfreedoms ofdatasubjects.Inasituationofover-deterrence,data con-trollerswilldisclosedatabreachesforwhichdisclosureisnot sociallybeneficialandthiswillresultinasocialwelfareloss. Furthermore,ahighadministrativefinecanincentivizedata controllersnottodetectdatabreaches.75_{Closelyconnected,}

peopleshowrisk-seekingbehaviourwhenfacinglosses.This underminesthedeterrenteffectofhighfines.76_Alast

disad-vantageofthe(high)administrativefineisthatitwillpunish the organizationitself(andthus theshareholders and cus-tomers)andnotthepeopleresponsibleforconcealingthedata breach.77

6.2. Enforcementofthefine

TheadministrativefineoftheDBNOishigh,buttheexpected valueoftheadministrativefineisthemagnitudeofthefine multipliedbythelikelihoodofdetection.Hence,itsdeterrent effectlargelydependsontheabilityoftheDPAeffectivelyto enforceatacceptablesocialcost.78_{Whatshouldbethelevel}

ofdeterrence?Thelevelofdeterrenceshouldexceedthenet privatecostthatdatacontrollersincurwhendisclosingadata breach.79_{Thisprivatecostisnotstaticbutvariesacrossdata}

controllers and willalso bedifferent foreach data breach.

Section4concludedthatprivatecostsare(perceivedas)high andcertain,whileprivatebenefitsareindirectanduncertain. Hence,thereisasignificantgap betweenprivatecostsand benefitsthatshouldbeclosedbyanappropriatedeterrent ef-fectoftheDBNOinordertoinduceanorganizationtoprovide sufficientnotification.

Theappropriatelevelofdeterrencecanbeaccomplished throughenforcingtheregulationandbyincreasingthe likeli-hoodofdetection.TheGDPRdoesnotgivefurtherinstruction onhowtoenforcetheobligation,apartfromthestatement that enforcementshould be‘strong’ accordingto Recital7. Thissectionwilldiscussseveralpossibilitiesforenforcement oftheEUDBNO.

75_{SeealsoA.MitchellPolinskyandStevenShavell,‘Mandatory} versusVoluntaryDisclosureofProductRisks’(2006)HarvardLaw School, John M. Olin Centerfor Law, Economics and Business DiscussionPaperSeries564/2006,4http://www.nber.org/papers/ w12776accessed16May2018.

76_{SeetheseminalarticleofDanielKahnemanandAmon} Tver-sky,‘ProspectTheory:AnAnalysisofDecisionunderRisk’(1979) 47Econometrica263.

77_{Seeforamoreextensivediscussionop.cit.PolinskyandShavell} (n5).

78_{Seealsoop.cit.Dari-MattiacciandDeGeest(n72)andGary} Becker,‘CrimeandPunishment: AnEconomicApproach’(1968) 76TheJournalofPoliticalEconomy169.Accordingtothetheory ofdeterrence,thestrictnessofthestickequalsthemagnitudeof sanctionstickmultipliedbytheprobabilityofdetection.

79_{SeesupraSection4.}

General enforcement concerns auditing random organiza-tionstoinvestigatewhethertheycomplywiththeDBNO. Gen-eralenforcementischaracterizedbythefactthatitdoesnot dependonthenumberofindividualswho actuallycommit harmfulacts.80_{AnexampleofthecurrentDutchDBNOthat}

willbereplacedbytheEUDBNOillustratesthatgeneral en-forcementwillbecostly.81 _{SupposetheDutchDPAwantsto}

achievealikelihoodofdetectionof10%anditwillbeable suc-cessfullytofindadatabreachinhalfofthecaseswhereone hasoccurred.82_{Thenitmustaudit20%outofthetotalnumber}

of132,000organizationsintheNetherlands.83_Nomorethan

20organizationsperyearcanbeauditedbyoneFTE.84_Hence,

toaudit20%oneneeds1320FTE.Givenanaverageannual to-talcostforskilledpersonnelof€100,000,theregulatorycosts ofenforcementriseto€132,200,000perannum.In2017,the totalcapacityoftheDutch DPAinNetherlandsis72,5FTE, thatcanonlybepartiallydeployedforenforcement.85

Sup-posethat25%oftheDutchDPAstotalcapacity(18,125FTE) canbedevotedtogeneralenforcementoftheDBNO.This re-sultsinanactuallikelihoodofdetectionofaround0,27%.In addition,generalenforcementcausessignificant administra-tivecostsfortheorganizationsthataresubjecttoanaudit. Manyofthemhavenothingtohideandhavetodevotetime andmoneytotheauditingprocedure,whichaggravatesthe socialcostofgeneralenforcement.Ergo,webelievethat gen-eralenforcementisnotasociallyefficientinstrumentto in-creasethedeterrenteffectoftheDBNO.86

Exanteriskbasedauditingisamoreefficientmeansof audit-ing.Thisapproachstartswithprioritizingsectorsor organiza-tionsthataremostlikelytoviolatetheobligation.IntheUS, forinstance,healthcareandfinancialinstitutionshavebeen subjecttodatabreachesrelativelymoreoftenthanother sec-tors.87_{Inaddition,DPAscanprioritizetheirenforcement}

ef-fortsonthosesectorswherethedisclosureofdatabreachesis mostlikelytoleadtothehighestsocialwelfareincrease. Log-ically,exanteriskbasedauditingreducescostsbecausethe averagelikelihoodofdetectionislikelytoincreaseperaudit. However,thisshouldbeweighedagainstthecostofexante effortsindeterminingtherisk.Whenthesecostsarekept suf-ficientlylow,forinstancethroughdiffusinginformationabout riskassessmentsacrosstheEU,riskbasedauditingis prefer-abletogeneralenforcement.However,alabourintensive au-ditingprocedureislikelytoremain.

80_{Op.cit.Oded(n68)273.}

81_{Op.cit.LaubeandBöhme(n9)37.}

82_{We assume 50% likelihood of detectionbecause data} con-trollerscanquiteeasilyactivelyconcealdatabreachesbyfor in-stancingremovinglogfilesaboutthebreach.

83_{According to the Dutch estimation when the DBNO was} adopted.

84_{Assuming10daysFTEworkforanintensiveauditing} proce-dure.

85_{Seewww.autoriteitpersoonsgegevens.nlaccessed16May2018.} TheDutchDPAalsohasothertasks.

86_{Op.cit.LaubeandBöhme(n9)37.}

87_{BasedontheUSPrivacyRightsClearinghousedatasetthatis} forinstanceanalysedbyBenjaminEdwards,StevenHofmeyrand StephanieForrest,‘HypeandHeavyTails:ACloserLookatData Breaches’(2016)2JournalofCybersecurity3,4.