Damage Sharing May Not Be Enough: An Analysis of an Ex-ante Regulation Policy for Data Breaches

Abstract

Data breaches, occurring either on the customer’s PCs or on the service provider’s equipment, expose customers to significant economic losses. An ex-ante regulation policy that apportions a fraction of the losses to the service provider (a damage-sharing policy) may reduce the burden for the customer and lead the service provider to invest more in security. We analyse this regulation policy through a game-theoretic approach, where the customer acts on the amount of personal information it reveals, and the service provider acts on the amount of security investments. We show that the game exhibits a single Nash equilibrium in a realistic scenario. In order to optimize the social welfare, the regulator has to choose the fraction of damage apportioned to the service provider. We show that the policy is relatively ineffective unless the fraction of damage charged to the service provider is quite large, beyond 60%. On the other hand, if the policy is applied with a large damage-sharing factor, the overall social welfare falls heavily.

The support of the Euro-NF Network of Excellence is gratefully acknowledged by the third author. The paper reflects the personal opinion of the authors and cannot be regarded as an official position of the Garante on the subject.