Abstract:The General Data Protection Regulation (GDPR) requires an organisation that suffers a data breach to notify the competent Data Protection Authority. The organisation must also inform the relevant individuals, when a data breach threatens their rights and freedoms. This paper focuses on the following question: given the goals of the GDPR's data breach notification obligation, and we assess the obligation in the light of those goals. We refer to insights from information security and economics, and present them in a reader-friendly way for lawyers. Our main conclusion is that the GDPR's data breach rules are likely to contribute to the goals. For instance, the data breach notification obligation can nudge organisations towards better security; such an obligation enables regulators to perform their duties; and such an obligation improves transparency and accountability. However, the paper also warns that we should not have unrealistic expectations of the possibilities for people to protect their interests after a data breach notice. Likewise, we should not have high expectations of people switching to other service providers after receiving a data breach notification. Lastly, the paper calls for Data Protection Authorities to publish more information about reported data breaches. Such information can help to analyse security threats.

What problem does this paper attempt to address?

The problem that this paper attempts to solve is to evaluate the objectives, advantages and limitations of the data breach notification obligation in the General Data Protection Regulation (GDPR). Specifically, the authors explore the following questions: Given the objectives of the GDPR's data breach notification obligation, what are the strengths and weaknesses of this obligation? ### Main problems of the paper 1. **Objective analysis**: - The authors identified six objectives or reasons for the data breach notification obligation in the GDPR and evaluated the effectiveness of this obligation based on these objectives. These six objectives include: 1. **Enable individuals to protect themselves**: Notifications can help individuals take preventive measures, such as changing passwords or freezing credit cards. 2. **Enable individuals to choose or switch to competing services**: Public data breach events may prompt consumers to turn to more secure service providers. 3. **Incentivize organizations to improve security measures**: The notification obligation can prompt organizations to strengthen their data protection measures. 4. **Help regulatory agencies perform their duties**: Notifications enable regulatory agencies to better supervise and enforce the law. 5. **Increase transparency and accountability**: Notifications increase the transparency of data processing and make organizations accountable for their actions. 6. **Help compile statistical data**: Notifications are helpful for collecting information about data breaches for statistical analysis. 2. **Effectiveness evaluation**: - The authors combined insights from information security and economics to evaluate whether the GDPR's data breach notification obligation can achieve the above - mentioned objectives. They pointed out that although this obligation may be effective in some aspects, there are also some limitations and challenges. For example: - Individuals may lack sufficient technical knowledge to protect themselves after receiving the notification. - Remedial measures after data breaches may be limited for certain types of data (such as medical records). - Consumers may not easily change service providers in the face of data breaches, especially when it is not easy to change (such as in the case of data breaches by employers or universities). ### Main conclusions - The authors' conclusion is that the GDPR's data breach notification rules are likely to help achieve the objectives it has set, such as promoting organizations to strengthen security measures, increasing transparency and accountability. However, they also warn against having overly high expectations of the effectiveness of data breach notifications, especially in terms of individuals protecting their own interests and changing service providers. In addition, the paper calls on data protection agencies to release more information about reported data breaches to help analyze security threats. In this way, this paper not only provides a theoretical framework for scholars, but also provides practical suggestions for policy - makers, legal practitioners and data protection officers.

The GDPR's Rules on Data Breaches: Analysing Their Rationales and Effects

Understanding the Cost associated with Data Security Breaches.

The Role of Corporate Reputation and Crisis Response Strategies in Data Breach Management.

"It may be a pain in the backside but..." Insights into the impact of GDPR on business after three years

The European Union general data protection regulation: what it is and what it means

Impossible, unknowable, accountable: Dramas and dilemmas of data law

Human-GDPR Interaction: Practical Experiences of Accessing Personal Data

GDPR: Is it worth it? Perceptions of workers who have experienced its implementation

Are we there yet? Understanding the challenges faced in complying with the General Data Protection Regulation (GDPR)

GDPArrrrr: Using Privacy Laws to Steal Identities

A Law and Economics Approach to the New EU Privacy Regulation: Analysing the European General Data Protection Regulation

The right to privacy and an implication of the EU General Data Protection Regulation (GDPR) in Europe: challenges to the companies

The impact of the General Data Protection Regulation on health research

The Notice-and-Choice Privacy Gamble: Game Theory, Consumer Agency, and Implications for GDPR

Privacy Rights and Data Security: GDPR and Personal Data Markets

The effects of voluntary GDPR adoption and the readability of privacy statements on customers’ information disclosure intention and trust

An Analysis of the Consequences of the General Data Protection Regulation (GDPR) on Social Network Research

Adjusting to the GDPR: The Impact on Data Scientists and Behavioral Researchers

Understanding the notion of risk in the General Data Protection Regulation

Purpose definition as a crucial step for determining the legal basis under the GDPR: implications for scientific research

Needle in the Haystack: Analyzing the Right of Access According to GDPR Article 15 Five Years after the Implementation