Sasha Romanosky
of Carnegie Mellon University - Heinz College of Information Systems and Public Policy,
David A. Hoffman
of Temple and the Cultural Cognition Project at Yale Law School, and
Alessandro Acquisti
of Carnegie Mellon University - H. John Heinz III School of Public Policy and Management have written Empirical Analysis of Data Breach Litigation. Here's the abstract:
Legal privacy scholarship typically emphasizes the various ways that plaintiffs fail when bringing legal actions against entities when their personal information is lost or stolen. However this scholarship often considers only a small set of published judicial opinions from large-scale data breaches. And so, little is actually known about the characteristics and disposition of a representative set of data breach lawsuits. Using a unique sample of anually-collected data from Westlaw and PACER, we analyze the court dockets of over 200 federal data breach lawsuits from 1998 to 2011, making this, to our knowledge, the first empirical examination of data breach litigation. We use discrete outcome regression models to estimate the probability that a data breach will result in a lawsuit, and the probability that, once filed, the case will reach settlement. We find that breaches resulting from the unauthorized disclosure or disposal of personal information are 6.9% more likely to result in lawsuit, relative to breaches caused by lost or stolen hardware, whereas breaches caused by cyber-attack are only 2.9% more likely to result in lawsuit. These results suggest that plaintiffs respond more to the careless or negligent handling by a firm of their personal information, than to the firm’s inability to withstand a cyber-attack or misfortune of losing a laptop. However, while these properties may explain the probability of lawsuit, we find that breach characteristics (size, cause and types of information lost) do not significantly predict the outcome of a data breach lawsuit. Instead, the probability of settlement appears to be driven by the presence of actual financial loss, and class certification.