An analysis of the effectiveness of the EU data breach notification obligation
In this paper we study the law and economics of the EU data breach notification obligation (EU DBNO), which is part of the general data protection regulation. We start our discussion with the origins and aims of the EU DBNO. Following this, we study the social benefits of the DBNO and the conditions for these social benefits to emerge. Next, we analyse whether there would be spontaneous notification without the existence of a DBNO. We discuss how the national DPAs, that are responsible for the execution of the EU DBNO, can sufficiently induce data controllers to comply with the regulation. We also discuss the scope of the regulation from a social welfare perspective, in particular the conditions, which trigger a notification from data controllers.
|Keywords||Data breach notification obligation, Data protection authority, Deterrence, Digital first aid kit, Disclosure threshold, GDPR, Social welfare analysis|
|Persistent URL||dx.doi.org/10.1016/j.clsr.2018.05.026, hdl.handle.net/1765/109853|
|Journal||Computer Law and Security Review|
Nieuwesteeg, B. (Bernold), & Faure, M.G. (2018). An analysis of the effectiveness of the EU data breach notification obligation. Computer Law and Security Review. doi:10.1016/j.clsr.2018.05.026