Why Information Security Law Has Been Ineffective in Addressing Security Vulnerabilities: Evidence from California Data Breach Notifications and Relevant Court and Government Records

Abstract Why has the information security law been unsuccessful in having firms in possession of personal data take precautions against data breaches? Why are data breaches becoming more devastating notwithstanding law enforcement? This article seeks an answer from the legal system’s failure to draw a line between agency problems and externalities inherent in the information security market. Although a firm’s misaligned incentive to invest in security measures is basically an agency problem to be addressed by data breach litigation, the U.S. courts’ reluctance to grant Article III standing in it has reduced potential plaintiffs’ chance of winning and propensity to litigate, impairing the functionality of the private enforcement. As an exception, security vulnerabilities can have the nature of negative externalities to be addressed by the public enforcement, to the extent that those in “key holders” such as payment card processors enable intruders to easily circumvent the security measures taken by other firms in the same security chain, or those in massive data aggregators deteriorate the public trust in the whole data infrastructure. Government regulations thus need to be targeted at such sources of negative externalities, but they have been misaimed at a few cases arising from conventional agency problems, sometimes out of attention-getting or political motivations. To test these hypotheses, this article presents an empirical study of security breach notifications filed in California during 2012–2016 and relevant court and government agency records produced until 2018.