Empirical Analysis of Data Breach Litigation

Abstract

Legal privacy scholarship has typically emphasized the various ways in which plaintiffs fail when bringing legal actions against entities when their personal information is lost or stolen. However, this scholarship is based on a limited set of published judicial opinions about large-scale data breaches. Little is actually known about the characteristics and disposition of a representative set of data breach lawsuits. Using a unique sample of manually-collected data from PACER, we analyze the court dockets of over 200 federal data breach lawsuits from 1998 to 2011. We use discrete outcome regressions to better understand which breaches are being litigated and which lawsuits are being settled. Our results generally (though not strictly) support theoretical notions of litigation. We find that while breach characteristics (size, cause and types of information compromised) are positively correlated with probability of filing a lawsuit, they contribute less when predicting the outcome of the suit. Instead, the probability of settlement is mostly driven by typical legal procedural matters such as actual harm and class certification.

Consumer Attitudes Toward Data Breach Notifications and Loss of Personal Information

“…These consumer actions should also be comforting to breached firms that are providing such assistance. Given that past research has shown that firms are less likely to be sued when they provide credit monitoring (Romanosky, Hoffman, and Acquisti, 2014), higher acceptance rates will likely further help reduce civil litigation costs.…”

“…A NetDiligence study using anonymous cyber insurance claim data from 2014 reported that personal information was the most frequently exposed type of data (41 percent of breaches, n = 117), followed by personal health information (21 percent) and then credit card information (19 percent) (NetDiligence, 2014). Further, Romanosky, Hoffman, and Acquisti, 2014, found that the most-common personal information stolen was name, address, and Social Security number (77 percent of breaches, n = 1,772), followed by credit card and health information (12 percent). 18 We cannot comment on the absolute percentage of respondents who lost such information because of the potential overlap between discrete categories of information.…”

“…However, there is a relatively small body of research on the different forms of data compromised in these breaches (Romanosky, Hoffman, and Acquisti, 2014). Therefore, we asked respondents to identify the types of data lost in the most-recent breach notification they received.…”

The challenges of personal data markets and privacy

“…Different countries in the world use different definitions of personal data and apply different rules governing its collection and use. As a result, businesses operating in a digital economy without borders are exposed to legal and enforcement risks (Romanosky et al 2012 ) that are hard to quantify. Other liabilities arise from the risk that large collections of personal data become targets of cybercrime, in particular when they include identifying or financial information.…”

Improving the Utility of Anonymized Datasets through Dynamic Evaluation of Generalization Hierarchies

“…For example, individuals may suffer from discrimination or identity theft. Likewise, organizations may suffer from negative publicity, fines or other sanctions [18]. Hence, this data must be anonymized before being shared for analysis.…”