6.4: Data Breach Law

Develop national data breach law to coordinate policies among the 50 states.

Other Information:

Private actors own and control many of the systems and information infrastructure at risk, which makes fostering good information security practices and resilience particularly tricky for the government. Securing cyberspace requires balancing incentives for secure investment and transparency for accountability. One approach to this has been the state-based data breach notification laws. First passed by California in 2004, these laws dramatically increased the number of breaches that the public knew about, as well as presented tangible costs to those responsible for privacy incidents. As a result, an entire industry has grown up around helping firms prevent, detect and deal with data breaches. Unfortunately, by regulating at the state level, firms with a national customer base must comply with some 47 different state laws. We must develop national data breach law to coordinate policies among the 50 states. It is important that this law maintain the goals of the original policy, which is to encourage firms to safeguard personal data, and provide public information about the state of data security.

Stakeholder(s):

• States

Indicator(s):

Indicator:1

Content