The best way for a company to handle a data breach is to be prepared. As we discuss in our data breach readiness handbook, preparation includes, among other things, drafting an incident response plan, reviewing cyber-insurance, reviewing contractual obligations with business partners, having relationships to help investigate security incidents, and training your incident response teams.

Preparation also requires anticipating decision-points that are likely to arise in a breach. Our clients often ask to look back at the approximately 600 data security incidents and breaches that we have handled over the years and identify the decision-points that are most difficult.

Many of the areas where we have seen companies struggle involve management-level strategic decisions that must be made when a security incident is identified.   This eight-part series explores these difficult decision points. For each there are no “right” or “wrong” answers. Like all strategic decisions management must examine the specific facts facing their company and their organization’s culture, their industry, and business realities.  

While there may be no right or wrong answer, in our experience executives that have anticipated these decision points before a breach are better able to make decisions that align with the organization’s overall strategic goals and are able to do so with greater speed and confidence.

Part 2: Should You Disclose A Breach If You Are Not Required To Do So By Law?

 Situation. State data breach notification statutes only require that an organization disclose a data breach if the breach involves specific types of data. In most states that includes only Social Security Numbers, Driver’s License Numbers, or financial account numbers that permit access to accounts. Many data breaches, however, involve the loss of other types of information (e.g., salary, date of birth, demographic information, email address, mailing address, etc.). In situations in which a breach involves data types that do not trigger a breach notification requirement, management often struggles with whether to (1) voluntarily notify impacted individuals, and/or (2) voluntarily notify regulators.

Some Strategic considerations: Management typically considers the following factors when determining whether to disclose a security incident that does not involve data fields that legally require disclosure:

Pros of voluntary disclosure.

1. Disclosing a data breach can avoid allegations that the company intentionally withheld information about the breach from the public.
2. Although state data breach notification statutes may not require disclosure, most lawsuits involving data breaches are based negligence or breach of contract. As a result, the fact that the company was not required to disclose the breach does not necessarily mean that a plaintiff may not initiate litigation under a different legal theory relating to the company’s decision not to disclose.

Cons of voluntary disclosure.

1. Notifying individuals about a data breach that does not involve the type of information that could be used to perpetrate identity theft can be confusing and unnecessarily alarming to the individual notified. For example individuals that have been notified about breaches involving relatively innocuous data (e.g., their address), but have experienced ID theft in the past, often misattribute the breach to the ID theft.
2. Voluntary notification imposes an immediate and direct cost on an organization. In addition, companies often offer ID protection services to impacted individuals even if the breach does not raise the prospect of ID theft to assuage individual’s misunderstanding concerning the impact of the breach. That too can drive direct costs. Many cyber-insurance policies will not reimburse companies for the cost of voluntary notifications or offers of ID theft related services.
3. Voluntary notification may draw attention to a breach that might otherwise not become public. The attention may negatively impact the reputation or brand of the company.

[View source.]