{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,11,12]],"date-time":"2026-11-12T13:17:28Z","timestamp":1794489448671,"version":"4.9.1"},"reference-count":77,"publisher":"Wiley","issue":"2","license":[{"start":{"date-parts":[[2011,3,9]],"date-time":"2011-03-09T00:00:00Z","timestamp":1299628800000},"content-version":"vor","delay-in-days":8,"URL":"http:\/\/onlinelibrary.wiley.com\/termsAndConditions#vor"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["J Policy Anal Manage"],"published-print":{"date-parts":[[2011,3]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>In the United States, identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with up to 35 percent of known identity thefts caused by corporate data breaches. Many states have responded by adopting data breach disclosure laws that require firms to notify consumers if their personal information has been lost or stolen. Although the laws are expected to reduce identity theft, their effect has yet to be empirically measured. We use panel data from the U.S. Federal Trade Commission to estimate the impact of data breach disclosure laws on identity theft from 2002 to 2009. We find that adoption of data breach disclosure laws reduce identity theft caused by data breaches, on average, by 6.1 percent. \u00a9 2011 by the Association for Public Policy Analysis and Management.<\/jats:p>","DOI":"10.1002\/pam.20567","type":"journal-article","created":{"date-parts":[[2011,3,9]],"date-time":"2011-03-09T18:30:06Z","timestamp":1299695406000},"page":"256-286","source":"Crossref","is-referenced-by-count":184,"title":["Do data breach disclosure laws reduce identity theft?"],"prefix":"10.1002","volume":"30","author":[{"given":"Sasha","family":"Romanosky","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Rahul","family":"Telang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alessandro","family":"Acquisti","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"311","published-online":{"date-parts":[[2011,3,9]]},"reference":[{"key":"e_1_2_10_2_1","unstructured":"Acquisti A. Friedman A. &Telang R.(2006 June).Is there a cost to privacy breaches? An event study. Paper presented at the Fifth Workshop on the Economics of Information Security University of Cambridge England."},{"key":"e_1_2_10_3_1","unstructured":"Assessing data security: Preventing breaches and protecting sensitive information. (2005).Hearing before the Committee on Financial Services House of Representatives 109th Congress."},{"key":"e_1_2_10_4_1","doi-asserted-by":"publisher","DOI":"10.1162\/003355398555522"},{"key":"e_1_2_10_5_1","unstructured":"Baum K.(2006 April).Identity theft 2004. Special Report NCJ 212213. Washington DC: Bureau of Justice Statistics. Retrieved December 16 2010 fromhttp:\/\/www.ncjrs.gov\/App\/Publications\/abstract.aspx?ID=233686."},{"key":"e_1_2_10_6_1","unstructured":"Baum K.(2007 November).Identity theft 2005. Special Report NCJ 219411. Washington DC: Bureau of Justice Statistics. Retrieved December 16 2010 fromhttp:\/\/bjs.ojp.usdoj.gov\/index.cfm?ty=pbdetail&iid=971."},{"key":"e_1_2_10_7_1","doi-asserted-by":"publisher","DOI":"10.1162\/003355304772839588"},{"key":"e_1_2_10_8_1","doi-asserted-by":"publisher","DOI":"10.1177\/000271626737400102"},{"key":"e_1_2_10_9_1","doi-asserted-by":"publisher","DOI":"10.1086\/468019"},{"key":"e_1_2_10_10_1","doi-asserted-by":"crossref","unstructured":"Brodkin J.(2007 April 10).Victims of ChoicePoint data breach didn't take advantage of free offers. Network World. Retrieved September 12 2009 fromhttp:\/\/www.networkworld.com\/news\/2007\/041007\u2010choicepoint\u2010victim\u2010offers.html.","DOI":"10.1016\/S0262-1762(07)70179-7"},{"key":"e_1_2_10_11_1","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-2003-11308"},{"key":"e_1_2_10_12_1","unstructured":"Cate F.(2005 February 27).Another notice isn't answer. USA Today. Retrieved October 15 2009 fromhttp:\/\/www.usatoday.com\/news\/opinion\/2005\u201002\u201027\u2010consumer\u2010protection\u2010oppose_x.htm."},{"key":"e_1_2_10_13_1","unstructured":"Cate F.(2009 March).Comparative approaches to security breaches. Paper presented at the symposium on Security Breach Notification Six Years Later: Lessons Learned about Identity Theft and Directions for the Future Berkeley Center for Law and Technology Berkeley CA. Retrieved December 16 2010 fromhttp:\/\/www.law.berkeley.edu\/media\/bclt\/security\/media\/09\u2010bclt\u2010privacy\u2010comparative.mp3."},{"key":"e_1_2_10_14_1","doi-asserted-by":"publisher","DOI":"10.1080\/10864415.2004.11044320"},{"key":"e_1_2_10_15_1","volume-title":"The effects of \u201cshall\u2010issue\u201d concealed\u2010carry licensing laws: A literature review","author":"Cleary J.","year":"1999"},{"key":"e_1_2_10_16_1","first-page":"10245","article-title":"Empirical research on the deterrent effect of environmental monitoring and enforcement","volume":"30","author":"Cohen M. A.","year":"2000","journal-title":"Environmental Law Reporter"},{"key":"e_1_2_10_17_1","doi-asserted-by":"publisher","DOI":"10.1086\/449111"},{"key":"e_1_2_10_18_1","doi-asserted-by":"crossref","unstructured":"Cook P. &MacDonald J.(2010).Public safety through private action: An economic assessment of BIDs locks and citizen cooperation. NBER Reporter 1 Conferences.","DOI":"10.3386\/w15877"},{"key":"e_1_2_10_19_1","unstructured":"Data Breaches and Identity Theft. (2005).Prepared statement of the Federal Trade Commission before the Committee on Commerce Science and Transportation U.S.Senate 109th Congress."},{"key":"e_1_2_10_20_1","doi-asserted-by":"crossref","unstructured":"Dezhbakhsh H. &Shepherd J.(2004).The deterrent effect of capital punishment: Evidence from a \u201cjudicial experiment.\u201d American Law and Economics Association Annual Meetings. Retrieved December 20 2010 fromhttp:\/\/law.bepress.com\/cgi\/viewcontent.cgi?article=1017&context=alea.","DOI":"10.2139\/ssrn.432621"},{"key":"e_1_2_10_21_1","first-page":"632","article-title":"Guns, crime, and the impact of state right\u2010to\u2010carry laws","volume":"73","author":"Donohue J.","year":"2004","journal-title":"Fordham Law Review"},{"key":"e_1_2_10_22_1","first-page":"1193","article-title":"Shooting down the \u201cmore guns, less crime\u201d hypothesis","volume":"51","author":"Donohue J.","year":"2003","journal-title":"Stanford Law Review"},{"key":"e_1_2_10_23_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1016033203101"},{"key":"e_1_2_10_24_1","volume-title":"FTC identity theft survey report: 2003","author":"Federal Trade Commission","year":"2003"},{"key":"e_1_2_10_25_1","volume-title":"Consumer fraud and identity theft complaint data: January\u2013December 2006","author":"Federal Trade Commission","year":"2007"},{"key":"e_1_2_10_26_1","volume-title":"FTC identity theft survey report: 2006","author":"Federal Trade Commission","year":"2007"},{"key":"e_1_2_10_27_1","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511510533"},{"key":"e_1_2_10_28_1","unstructured":"Givens B.(2000).Identity theft: How it happens its impact on victims and legislative solutions. Written testimony for the U.S. Senate Judiciary Subcommittee on Technology Terrorism and Government Information 109th Congress."},{"key":"e_1_2_10_29_1","volume-title":"Identity fraud trends and patterns: Building a data\u2010based foundation for proactive enforcement","author":"Gordon G. R.","year":"2007"},{"key":"e_1_2_10_30_1","volume-title":"Testimony before the Committee on Government Reform, House of Representatives","author":"Government Accountability Office","year":"2006"},{"key":"e_1_2_10_31_1","volume-title":"Data breaches are frequent, but evidence of resulting identity theft is limited; however, the full extent is unknown","author":"Government Accountability Office","year":"2007"},{"key":"e_1_2_10_32_1","unstructured":"H.B. 732 59th Legislature State of Montana. (2005) (enacted). Retrieved December 16 2010 fromhttp:\/\/data.opi.mt.gov\/bills\/2005\/BillHtml\/HB0732.htm."},{"key":"e_1_2_10_33_1","first-page":"97","article-title":"Identity theft: Making the known unknowns known","volume":"21","author":"Hoofnagle C. J.","year":"2007","journal-title":"Harvard Journal of Law and Technology"},{"key":"e_1_2_10_34_1","unstructured":"Identity Theft: Recent Developments Involving the Security of Sensitive Consumer Information. (2005).Hearing before the Committee on Banking Housing and Urban Affairs Senate 109th Congress."},{"key":"e_1_2_10_35_1","unstructured":"Illinois House Transcript. (2005 April 12).94th General Assembly Regular Session 38th Legislative Day."},{"key":"e_1_2_10_36_1","volume-title":"Identity fraud survey report: 2006","author":"Javelin Research","year":"2006"},{"key":"e_1_2_10_37_1","volume-title":"Identity fraud survey report: 2007","author":"Javelin Research","year":"2007"},{"key":"e_1_2_10_38_1","volume-title":"2010 Identity fraud survey report: Identity fraud continues to rise\u2014new accounts fraud drives increase; consumer costs at an all time low","author":"Javelin Research","year":"2010"},{"key":"e_1_2_10_39_1","doi-asserted-by":"publisher","DOI":"10.1162\/003355303321675428"},{"key":"e_1_2_10_40_1","doi-asserted-by":"publisher","DOI":"10.1177\/153244000500500406"},{"key":"e_1_2_10_41_1","unstructured":"Kaplan D.(2008 February 20).TJX reports soaring profits one year after breach disclosure. SC Magazine. Retrieved October 20 2009 fromhttp:\/\/www.scmagazineus.com\/TJX\u2010reports\u2010soaring\u2010profits\u2010one\u2010year\u2010after\u2010breach\u2010disclosure\/article\/107072\/."},{"key":"e_1_2_10_42_1","first-page":"13","article-title":"The impact of information security breaches on financial performance of the breached firms: An empirical investigation","volume":"17","author":"Ko M.","year":"2006","journal-title":"Journal of Information Technology Management"},{"key":"e_1_2_10_43_1","doi-asserted-by":"crossref","unstructured":"Kobayashi B.(2005).An economic analysis of the private and social costs of the provision of cybersecurity and other public security goods. George Mason University School of Law Working Papers Series.","DOI":"10.1086\/scer.14.3655314"},{"key":"e_1_2_10_44_1","first-page":"888","article-title":"Ex post liability for harm vs. ex ante safety regulation: Substitutes or complements","volume":"80","author":"Kolstad C.","year":"1990","journal-title":"American Economic Review"},{"key":"e_1_2_10_45_1","volume-title":"Slow down on data security legislation. Progress Snapshot 1.9","author":"Lenard T. M.","year":"2005"},{"key":"e_1_2_10_46_1","first-page":"44","article-title":"Much ado about notification","volume":"29","author":"Lenard T. M.","year":"2006","journal-title":"Regulation"},{"key":"e_1_2_10_47_1","volume-title":"The behavioral foundations of policy","author":"Loewenstein G."},{"key":"e_1_2_10_48_1","doi-asserted-by":"publisher","DOI":"10.1086\/467988"},{"key":"e_1_2_10_49_1","volume-title":"Informational approaches to regulation","author":"Magat W. A.","year":"1992"},{"key":"e_1_2_10_50_1","doi-asserted-by":"publisher","DOI":"10.1086\/467468"},{"key":"e_1_2_10_51_1","unstructured":"Michigan Senate Journal. (2005).Regular Session No. 106."},{"key":"e_1_2_10_52_1","unstructured":"Minnesota Commerce Committee(2006)Update. (2006 April 3). Minnesota Senate Committee on Commerce Eighty\u2010Fourth Legislature."},{"key":"e_1_2_10_53_1","doi-asserted-by":"publisher","DOI":"10.1086\/382603"},{"key":"e_1_2_10_54_1","unstructured":"Nakashima E. &O'Harrow R. Jr.. (2008 February 22).LexisNexis parent set to buy ChoicePoint. Washington Post. Retrieved November 1 2009 fromhttp:\/\/www.washingtonpost.com\/wp\u2010dyn\/content\/article\/2008\/02\/21\/AR2008022100809.html."},{"key":"e_1_2_10_55_1","volume-title":"Learning the game: How the legislative process works","author":"Neal T.","year":"2005"},{"key":"e_1_2_10_56_1","unstructured":"Personal Internet Security. (2007).House of Lords Science and Technology Committee 5th Report of Session 2006\u201307 HL Paper 165\u2013I."},{"key":"e_1_2_10_57_1","volume-title":"National survey on data security breach notification","author":"Ponemon Institute","year":"2005"},{"key":"e_1_2_10_58_1","volume-title":"Consumers' report card on data breach notification","author":"Ponemon Institute","year":"2008"},{"key":"e_1_2_10_59_1","unstructured":"Ranger S.(2007 September 3).Data breach laws make companies serious about security. Retrieved September 7 2009 fromhttp:\/\/management.silicon.com\/itdirector\/0 39024673 39168303 00.htm?r=1."},{"key":"e_1_2_10_60_1","first-page":"949","article-title":"The role of deterrence in the formulation of criminal law rules: At its worst when doing its best","volume":"91","author":"Robinson P. H.","year":"2003","journal-title":"Georgetown Law Journal"},{"key":"e_1_2_10_61_1","volume-title":"Paper presented at the Ninth Workshop on the Economics of Information Security (WEIS 2010)","author":"Romanosky S.","year":"2010"},{"key":"e_1_2_10_62_1","unstructured":"Samuelson Law Technology & Public Policy Clinic. (2007).Security breach notification laws: Views from chief security officers. Unpublished manuscript University of California\u2013Berkeley School of Law."},{"key":"e_1_2_10_63_1","unstructured":"Saskia K.(2002).SB 1386: Bill analysis. Retrieved December 16 2010 fromhttp:\/\/www.leginfo.ca.gov\/pub\/01\u201002\/bill\/sen\/sb_1351\u20101400\/sb_1386_cfa_20020823_220958_asm_ floor.html."},{"key":"e_1_2_10_64_1","unstructured":"S.B. 2290. (2006).23d Legislature State of Hawaii (enacted). Retrieved December 16 2010 fromhttp:\/\/www.capitol.hawaii.gov\/session2006\/bills\/SB2290_cd1_.htm."},{"key":"e_1_2_10_65_1","unstructured":"Securing Consumers' Data: Options Following Security Breaches. (2005).Hearing before the Subcommittee on Commerce Trade and Consumer Protection of the Committee on Energy and Commerce House of Representatives 109th Congress."},{"key":"e_1_2_10_66_1","unstructured":"Securing Electronic Personal Data: Striking a Balance Between Privacy and Commercial and Governmental Use. (2005). Hearing before the Committee on the Judiciary Senate 109th Congress."},{"key":"#cr-split#-e_1_2_10_67_1.1","unstructured":"Securities and Exchange Commission. (2008).Part 248-Regulation s-p: Privacy of consumer financial information and safeguarding personal information"},{"key":"#cr-split#-e_1_2_10_67_1.2","unstructured":"proposed rule. Retrieved November 11 2008 fromhttp:\/\/www.sec.gov\/rules\/proposed\/2008\/34\u201057427fr.pdf."},{"key":"e_1_2_10_68_1","first-page":"913","article-title":"Notification of data security breaches","volume":"105","author":"Schwartz P.","year":"2007","journal-title":"Michigan Law Review"},{"key":"e_1_2_10_69_1","doi-asserted-by":"publisher","DOI":"10.2307\/2555680"},{"key":"e_1_2_10_70_1","doi-asserted-by":"publisher","DOI":"10.1016\/0144-8188(91)90014-5"},{"key":"e_1_2_10_71_1","first-page":"1009","article-title":"How a bill becomes a law, really","volume":"24","author":"Simitian J.","year":"2009","journal-title":"Berkeley Technology Law Journal"},{"key":"e_1_2_10_72_1","unstructured":"Simitian J.(2009b March).How a bill becomes a law really. David Nelson Memorial Keynote Address at the symposium on Security Breach Notification Six Years Later: Lessons Learned about Identity Theft and Directions for the Future Berkeley Center for Law & Technology Berkeley CA. Retrieved December 16 2010 fromhttp:\/\/www.law.berkeley.edu\/media\/bclt\/security\/media\/07\u2010bclt\u2010privacy\u2010simitian.mp3."},{"key":"e_1_2_10_73_1","volume-title":"Understanding state constitutions","author":"Tarr G. A.","year":"2000"},{"key":"e_1_2_10_74_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2007.70712"},{"key":"e_1_2_10_75_1","unstructured":"Vijayan J.(2008 January 29).ChoicePoint to pay $10M to settle breach\u2010related lawsuit. Network World. Retrieved November 1 2009 fromhttp:\/\/www.networkworld.com\/news\/2008\/012908\u2010choicepoint\u2010to\u2010pay\u201010m\u2010to.html."},{"key":"e_1_2_10_76_1","doi-asserted-by":"publisher","DOI":"10.2307\/1954434"},{"key":"e_1_2_10_77_1","volume-title":"Uses and abuses of empirical evidence in the death penalty debate","author":"Wolfers J.","year":"2006"}],"container-title":["Journal of Policy Analysis and Management"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.wiley.com\/onlinelibrary\/tdm\/v1\/articles\/10.1002%2Fpam.20567","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.wiley.com\/onlinelibrary\/tdm\/v1\/articles\/10.1002%2Fpam.20567","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1002\/pam.20567","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,10,31]],"date-time":"2023-10-31T15:16:28Z","timestamp":1698765388000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1002\/pam.20567"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2011,3]]},"references-count":77,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2011,3]]}},"alternative-id":["10.1002\/pam.20567"],"URL":"https:\/\/doi.org\/10.1002\/pam.20567","archive":["Portico"],"relation":{},"ISSN":["0276-8739","1520-6688"],"issn-type":[{"value":"0276-8739","type":"print"},{"value":"1520-6688","type":"electronic"}],"subject":[],"published":{"date-parts":[[2011,3]]}}}