Data breach notification laws

This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these template messages) This article needs to be updated. Please help update this article to reflect recent events or newly available information. (May 2014) The examples and perspective in this article deal primarily with the United States and do not represent a worldwide view of the subject. You may improve this article, discuss the issue on the talk page, or create a new article, as appropriate. (June 2019) (Learn how and when to remove this message) (Learn how and when to remove this message)

Security breach notification laws or data breach notification laws are laws that require individuals or entities affected by a data breach, unauthorized access to data,^[1] to notify their customers and other parties about the breach, as well as take specific steps to remedy the situation based on state legislature. Data breach notification laws have two main goals. The first goal is to allow individuals a chance to mitigate risks against data breaches. The second goal is to promote company incentive to strengthen data security.^[2]Together, these goals work to minimize consumer harm from data breaches, including impersonation, fraud, and identity theft.^[3]

Such laws have been irregularly enacted in all 50 U.S. states since 2002. Currently, all 50 states have enacted forms of data breach notification laws.^[4] There is no federal data breach notification law, despite previous legislative attempts.^[5] These laws were enacted in response to an escalating number of breaches of consumer databases containing personally identifiable information.^[6] Similarly, multiple other countries, like the European Union General Data Protection Regulation (GDPR) and Australia's Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth), have added data breach notification laws to combat the increasing occurrences of data breaches.^[7]

The rise in data breaches conducted by both countries and individuals is evident and alarming, as the number of reported data breaches has increased from 421 in 2011, to 1,091 in 2016, and 1,579 in 2017 according to the Identity Theft Resource Center (ITRC).^[8][9] It has also impacted millions of people and gained increasing public awareness due to large data breaches such as the October 2017 Equifax breach that exposed almost 146 million individual's personal information.^[10]