An analysis of the effectiveness of the EU data breach notification obligation

Bernold Nieuwesteeg; Michael Faure

doi:10.1016/j.clsr.2018.05.026

An analysis of the effectiveness of the EU data breach notification obligation

Bernold Nieuwesteeg^*, Michael Faure

^*Corresponding author for this work

Research output: Contribution to journal › Article › Academic › peer-review

283 Downloads (Pure)

Abstract

In this paper we study the law and economics of the EU data breach notification obligation (EU DBNO), which is part of the general data protection regulation. We start our discussion with the origins and aims of the EU DBNO. Following this, we study the social benefits of the DBNO and the conditions for these social benefits to emerge. Next, we analyse whether there would be spontaneous notification without the existence of a DBNO. We discuss how the national DPAs, that are responsible for the execution of the EU DBNO, can sufficiently induce data controllers to comply with the regulation. We also discuss the scope of the regulation from a social welfare perspective, in particular the conditions, which trigger a notification from data controllers. (C) 2018 Bemold Nieuwesteeg and Michael Faure. Published by Elsevier Ltd. All rights reserved.

Original language	English
Pages (from-to)	1232-1246
Number of pages	15
Journal	Computer Law and Security Review
Volume	34
Issue number	6
Early online date	18 Aug 2018
DOIs	https://doi.org/10.1016/j.clsr.2018.05.026
Publication status	Published - Dec 2018

Keywords

Data breach notification obligation
GDPR
Social welfare analysis
Data protection authority
Deterrence
Disclosure threshold
Digital first aid kit
LAWS
ANNOUNCEMENTS
CARROTS
LIABILITY

Access to Document

10.1016/j.clsr.2018.05.026

Full TextFinal published version, 720 KBLicence: Taverne

Cite this

@article{dd6dec9f23fe4d839e776fba849c42c9,

title = "An analysis of the effectiveness of the EU data breach notification obligation",

abstract = "In this paper we study the law and economics of the EU data breach notification obligation (EU DBNO), which is part of the general data protection regulation. We start our discussion with the origins and aims of the EU DBNO. Following this, we study the social benefits of the DBNO and the conditions for these social benefits to emerge. Next, we analyse whether there would be spontaneous notification without the existence of a DBNO. We discuss how the national DPAs, that are responsible for the execution of the EU DBNO, can sufficiently induce data controllers to comply with the regulation. We also discuss the scope of the regulation from a social welfare perspective, in particular the conditions, which trigger a notification from data controllers. (C) 2018 Bemold Nieuwesteeg and Michael Faure. Published by Elsevier Ltd. All rights reserved.",

keywords = "Data breach notification obligation, GDPR, Social welfare analysis, Data protection authority, Deterrence, Disclosure threshold, Digital first aid kit, LAWS, ANNOUNCEMENTS, CARROTS, LIABILITY",

author = "Bernold Nieuwesteeg and Michael Faure",

year = "2018",

month = dec,

doi = "10.1016/j.clsr.2018.05.026",

language = "English",

volume = "34",

pages = "1232--1246",

journal = "Computer Law and Security Review",

issn = "0267-3649",

publisher = "Elsevier Limited",

number = "6",

}

TY - JOUR

T1 - An analysis of the effectiveness of the EU data breach notification obligation

AU - Nieuwesteeg, Bernold

AU - Faure, Michael

PY - 2018/12

Y1 - 2018/12

N2 - In this paper we study the law and economics of the EU data breach notification obligation (EU DBNO), which is part of the general data protection regulation. We start our discussion with the origins and aims of the EU DBNO. Following this, we study the social benefits of the DBNO and the conditions for these social benefits to emerge. Next, we analyse whether there would be spontaneous notification without the existence of a DBNO. We discuss how the national DPAs, that are responsible for the execution of the EU DBNO, can sufficiently induce data controllers to comply with the regulation. We also discuss the scope of the regulation from a social welfare perspective, in particular the conditions, which trigger a notification from data controllers. (C) 2018 Bemold Nieuwesteeg and Michael Faure. Published by Elsevier Ltd. All rights reserved.

AB - In this paper we study the law and economics of the EU data breach notification obligation (EU DBNO), which is part of the general data protection regulation. We start our discussion with the origins and aims of the EU DBNO. Following this, we study the social benefits of the DBNO and the conditions for these social benefits to emerge. Next, we analyse whether there would be spontaneous notification without the existence of a DBNO. We discuss how the national DPAs, that are responsible for the execution of the EU DBNO, can sufficiently induce data controllers to comply with the regulation. We also discuss the scope of the regulation from a social welfare perspective, in particular the conditions, which trigger a notification from data controllers. (C) 2018 Bemold Nieuwesteeg and Michael Faure. Published by Elsevier Ltd. All rights reserved.

KW - Data breach notification obligation

KW - GDPR

KW - Social welfare analysis

KW - Data protection authority

KW - Deterrence

KW - Disclosure threshold

KW - Digital first aid kit

KW - LAWS

KW - ANNOUNCEMENTS

KW - CARROTS

KW - LIABILITY

U2 - 10.1016/j.clsr.2018.05.026

DO - 10.1016/j.clsr.2018.05.026

M3 - Article

SN - 0267-3649

VL - 34

SP - 1232

EP - 1246

JO - Computer Law and Security Review

JF - Computer Law and Security Review

IS - 6

ER -

An analysis of the effectiveness of the EU data breach notification obligation

Abstract

Keywords

Access to Document

Fingerprint

Cite this