In this paper we study the law and economics of the EU data breach notification obligation (EU DBNO), which is part of the general data protection regulation. We start our discussion with the origins and aims of the EU DBNO. Following this, we study the social benefits of the DBNO and the conditions for these social benefits to emerge. Next, we analyse whether there would be spontaneous notification without the existence of a DBNO. We discuss how the national DPAs, that are responsible for the execution of the EU DBNO, can sufficiently induce data controllers to comply with the regulation. We also discuss the scope of the regulation from a social welfare perspective, in particular the conditions, which trigger a notification from data controllers

Additional Metadata
Keywords Data breach notification obligation, GDPR, Social welfare analysis, Data protection authority, Deterrence, Disclosure threshold, Digital first aid kit
Persistent URL,
Journal Computer Law and Security Review
Nieuwesteeg, B.F.H, & Faure, M.G. (2018). An analysis of the effectiveness of the EU data breach notification obligation. Computer Law and Security Report. doi:10.1016/j.clsr.2018.05.026