An interesting article is here, that describes the impact of data breach laws. The article rightly credits the California data breach law with starting the ball rolling on requiring companies to disclose security breaches. To date 43 other states have followed suit. And in the five years that these laws have been in existence, a reported (disclosed) 245 million individuals have had their PII exposed.

The article calls into question whether the data breach laws are having any impact in the reducing identity theft, and it cites a study by Carnegie Mellon researchers that compared the incidence of identity theft in states with and without security breach laws in place. The conclusion of the study was there was little actual difference.

I can’t quibble with the conclusion, nor with the study results, but I do think there’s a different point to be made, which is that the existence of these laws has (IMHO) caused companies to “raise the bar” with respect to information security, spending more to protect critical IT assets, and to protect our PII. Not that companies or industries are where they need to be in terms of providing adequate security, but the existence of the laws has helped- no organization wants to be sending out those letters to their customers that start “We’re sorry to inform you…”.

Think about all of those breaches getting reported (now) to do with lost laptops, tapes, USB drives. Encryption solutions for this market segment are a big deal now, as they should be. Now rewind about five years. Were laptops going missing back then? Sure. Did companies spend much on securing the data on these devices then? Not so much. The problem (pre-breach laws) was pretty much swept under the rug. Disclosure (or the threat of it) forces companies to be more responsible. And it probably helps to get Sr. Management a little more focused on spending adequately on IT security.