Legal Policies Failing on Data Breaches?–An Empirical Study of U.S. Information Security Law Implementations

Data breaches are increasingly disruptive and have caused dramatic financial implications for the organizations affected by incidents. Although the government has enacted and amended relevant legal provisions, the number of data breaches is broadly on the rise. The laws concerning data breaches aim to decrease the risk of such incidents, but their true efficacy remains to be quantitively evaluated. In this study, we use panel data on data breaches in the United States from 2005 to 2019 to empirically verify whether laws enacted can reduce the probability of data breaches. First, we attempt to confirm that the law is in force to curb the occurrence of data breaches; second, we further study the effectiveness of the penalty regulations. Our findings will clearly illustrate whether data breach laws can play a deterrent role in reducing incidents and provide new insights into the field of government regulations.