Dear Lawmakers, Your New Breach Notice Laws Should Address These Issues

The days of companies being so afraid of the reputational impact of a breach that they would look for any way possible to avoid disclosure are gone.  The pendulum has swung in the opposite direction.  Now companies, often in the name of being "completely transparent" with their customers, want to disclose incidents as soon as possible (sometimes even before they know whether a "breach" actually occurred).  The immediate disclosure "instinct" companies are developing is, in part, due to the number of incidents being disclosed.  There certainly seems to be safety in numbers—there were significant breaches disclosed in 2014 that received much less attention than they likely would have if they had been disclosed prior to December 2013.  The continuous news cycle of incident reports has awakened the reactive cycle of new breach notification law proposals.  The new proposals, like their predecessors that were not enacted, are not paired with any empirical data of why new or