I Have the Right to be Alerted: The Global Policy on Data Breach Disclosure

Abstract

Law is said to mirror societal values. Following an examination of the personal data breach disclosure rules of 187 legal jurisdictions around the world, this study argues that there is now a global societal expectation that individuals must be informed of data breaches involving their personal information. From a single US State (California) passing a unique and innovative law in 2003, the world has moved towards legally mandating data controllers to reveal the occurrence of a personal data breach. Organizations can no longer conceal a failure in their data security. World practice also shows that majority of legal jurisdictions regulate when and how individuals are notified. The prevailing global breach notification policy is that individuals should be informed of a breach if it involves their personal data and if there is a risk of harm to them. In turn, majority of legal jurisdictions set a specific timeframe within which to report to the authorities, while a general timeframe within which to notify individuals. Dominant worldwide policy also shows that majority of legal jurisdictions regulate the content of breach notices. This study concludes by outlining what could be the components of a global model approach to breach disclosure. It argues that breach disclosure rules should be seen as akin to an individual right and a subset of one’s right to privacy and right to human dignity – i.e., a right to be alerted.