In this paper we study the law and economics of the EU data breach notification obligation (EU DBNO), which is part of the general data protection regulation. We start our discussion with the origins and aims of the EU DBNO. Following this, we study the social benefits of the DBNO and the conditions for these social benefits to emerge. Next, we analyse whether there would be spontaneous notification without the existence of a DBNO. We discuss how the national DPAs, that are responsible for the execution of the EU DBNO, can sufficiently induce data controllers to comply with the regulation. We also discuss the scope of the regulation from a social welfare perspective, in particular the conditions, which trigger a notification from data controllers.

Additional Metadata
Keywords Data breach notification obligation, Data protection authority, Deterrence, Digital first aid kit, Disclosure threshold, GDPR, Social welfare analysis
Persistent URL dx.doi.org/10.1016/j.clsr.2018.05.026, hdl.handle.net/1765/109853
Journal Computer Law and Security Review
Citation
Nieuwesteeg, B. (Bernold), & Faure, M.G. (2018). An analysis of the effectiveness of the EU data breach notification obligation. Computer Law and Security Review. doi:10.1016/j.clsr.2018.05.026