When does a privacy breach cause harm?

When does a privacy breach cause harm?

Finally having a clear standard could contain corporate liability and reduce companies' operational expenses

Several countries are on the verge of doing what US courts have stopped short of: codifying that breaches of personal information can actually harm people. Why should US companies welcome this development?

Because an international answer to this question could clarify the standard of protection that corporations have to meet with regard to personal data in their care. Finally having a clear standard could contain corporate liability and reduce companies' operational expenses. Whether the US Congress also makes this leap in its deliberations over a national breach-notification bill may depend on legal experts stepping up to the plate to reshape the terms of the debate.

Let's face it: US courts have botched this one. Time and again, when plaintiffs have sued companies for exposing their personal data, the only damages courts have awarded them, if any, have been for monetary losses relating to account fraud or identity theft.

On the one hand, most large data breaches don't even lead to a rash of ID thefts. As forensics firm ID Analytics has shown in a number of case studies, lost laptops and other similar breaches involving thousands of people's sensitive information resulted in only about a dozen verifiable instances of fraud.

But is monetary loss the only criterion for personal harm? Anyone who has experienced true ID theft would say the money is only a part of the equation. The countless obstacles to getting on with life, not to mention the psychological dread, can outweigh the hard-dollar losses.

So when do privacy breaches cause harm? That's what I asked Anita Allen, a professor at the University of Pennsylvania's law school. Allen is scheduled to address this topic later this month at the International Association of Privacy Professionals Summit in the US.

"Identity theft and financial fraud are one sort of harm," Allen said. "But others include offensive publication of illicitly acquired personal information, along with hurt feelings and dashed expectations. The assault to personality and feelings is the quintessential privacy injury."

To that end, we can all think of examples in our own lives where privacy exposures harmed us or people we knew. Predators who exploit information about children online, forwarded e-mail chains that damage relationships and compromising photos sent by cell phones are three examples that come to mind.

But what about the information potentially obtained by insurance companies and employers that could limit someone's economic possibilities, or information obtained by government agencies that threaten our sense of autonomy? These can all harm our human dignity.

Follow Us

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.


ARN Innovation Awards 2022

Innovation Awards is the market-leading awards program for celebrating ecosystem innovation and excellence across the technology sector in Australia.

EDGE 2022

EDGE is the leading technology conference for business leaders in Australia and New Zealand, built on the foundations of collaboration, education and advancement.

Show Comments