Why information security law has been ineffective in addressing security vulnerabilities: Evidence from California data breach notifications and relevant court and government records

Why has the information security law been unsuccessful in having firms in possession of personal data take precautions against data breaches? Why are data breaches becoming more devastating notwithstanding law enforcement? This article seeks an answer from the legal system's failure to draw a line between agency problems and externalities inherent in the information security market. Although a firm's misaligned incentive to invest in security measures is basically an agency problem to be addressed by data breach litigation, the U.S. courts' reluctance to grant Article Ill standing has reduced potential plaintiffs' chance of winning and propensity to litigate, impairing the functionality of the private enforcement. As an exception, security vulnerabilities can have the nature of negative externalities to be addressed by the public enforcement, to the extent that those in "key holders" such as payment card processors enable intruders to easily circumvent the security measures taken by other firms in the same security chain, and that those in massive data aggregators undermine public trust in the whole data infrastructure. Government regulations, which need to be targeted at such sources of negative externalities, have actually been misaimed at a few cases arising from conventional agency problems. To test these hypotheses, this article presents an empirical study of security breach notifications filed in California during 2012-2016 and relevant court and government agency records produced until 2018. (C) 2019 The Author. Published by Elsevier Inc.