Security breach notification laws or data breach notification laws are laws that require individuals or entities affected by a data breach, unauthorized access to data, to notify their customers and other parties about the breach, as well as take specific steps to remedy the situation based on state legislature. Data breach notification laws have two main goals. The first goal is to allow individuals a chance to mitigate risks against data breaches. The second goal is to promote company incentive to strengthen data security.Together, these goals work to minimize consumer harm from data breaches, including impersonation, fraud, and identity theft.
Such laws have been irregularly enacted in all 50 U.S. states since 2002. Currently, all 50 states have enacted forms of data breach notification laws. There is no federal data breach notification law, despite previous legislative attempts. These laws were enacted in response to an escalating number of breaches of consumer databases containing personally identifiable information. Similarly, multiple other countries, like the European Union General Data Protection Regulation (GDPR) and Australia's Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth), have added data breach notification laws to combat the increasing occurrences of data breaches.
The rise in data breaches conducted by both countries and individuals is evident and alarming, as the number of reported data breaches has increased from 421 in 2011, to 1,091 in 2016, and 1,579 in 2017 according to the Identity Theft Resource Center (ITRC). It has also impacted millions of people and gained increasing public awareness due to large data breaches such as the October 2017 Equifax breach that exposed almost 146 million individual's personal information.
Australia
On 2018, Australia Privacy Amendment (Notifiable Data Breaches) Act 2017 went into effect. This amended the Privacy Act 1988 (Cth), which had established a notification system for data breaches involving personal information that lead to harm. Now, entities with existing personal information security obligations under the Australian Privacy Act are required to notify the Office of Australian Information Commissioner (OAIC) and affected individuals of all “eligible data breaches.” The amendment is coming off large data breaches experiences in Australia, such as the Yahoo hack in 2013 involving thousands of government officials and the data breach of NGO Australian Red Cross releasing 550,000 blood donor's personal information.
Criticism of the data breach notification include: the unjustified exemption of certain entities such as small businesses and the Privacy Commissioner not required to post data breaches in one permanent place to be used as data for future research. In addition, notification obligations are not consistent at a state level.
China
In mid-2017, China adopted a new Cyber security Law, which included data breach notification requirements.
European Union
In 1995, the EU passed the Data Protection Directive (DPD), which has recently been replaced with the 2016 General Data Protection Regulation (GDPR), a comprehensive federal data breach notification law. The GDPR offers stronger data protection laws, broader data breach notification laws, and new factors such as the right to data portability. However, certain areas of the data breach notification laws are supplemented by other data security laws.
Examples of this include, the European Union implemented a breach notification law in the Directive on Privacy and Electronic Communications (E-Privacy Directive) in 2009, specific to personal data held by telecoms and Internet service providers. This law contains some of the notification obligations for data breaches.