End of shield for corporate data breach ‘victims’?

An interesting decision was covered in an article on wired.com yesterday, “Government Stops Shielding Corporate Breach ‘Victims’” that may promote renewed corporate interest in making sure they have a proper data security strategy in place.

While 45 states in the U.S. have data breach notification laws in place, many a corporation has tried to hide behind the 2004 Crime Victims’ Rights Act, a law intended to respect the “victim’s dignity and privacy”. In this story, we learn that a motion filed by Assistant U.S. Attorney Stephen Heymann argued that companies should be identified. More to the point, he argues that disclosure provides incentive for companies to “invest in the protections their customers would want. Transparency makes the market work in this area.”

I couldn’t agree more. I’ve argued for years that data breaches occur globally (check out privacyrights.org for a glimpse) with alarming frequency, and that if companies must be motivated with a stick to take data protection seriously, so be it. We extend a level of trust to businesses and institutions when we provide credit cards and other personal information to purchase their goods and services, and I’ll go out of my way to do business with organizations that respect the trust I’ve extended to them.

Time will tell if this theme of transparency translates to improved corporate data security behavior.

Tags: Data Protection