Great minds are working on this, and no one has a neat solution. Say a laptop with a lot of sensitive information on it disappears. Should the company immediately inform all those whose information was there on the lost laptop, when four days later it’s found and nothing’s been done to it? Do we want to cry wolf and scare people, or do we want to evaluate the whole sequence and determine if there is a real harm factor involved with this irresponsibility? As you say, we do have account numbers from credit cards exposed, and the effect of that doesn’t show up for six months. How do you measure that? It’s complicated.

Do you think the law leaves enough room for the company that gets that laptop back to do computer forensics on the hard drive, see that files weren’t accessed in the past four days and not do a disclosure?

Sometimes the information is, in effect—I’ll put quotes around it—"compromised," yet it has no use because it is encrypted. On the other hand, if because of lousy security a database is hacked into, and the person was doing it for a reason, that’s very different. There’s a management decision to be made involving risk management and risk assessment—trying to come up with the criteria by which you will implement certain reactive types of programs.

This fall, I attended a meeting where some businesses said, Look, we’re not going to invest in enhanced information security because it’s expensive; it has a low return on investment. I said, Really? Tell me how you crank in the risk to your reputation if you have a security breach. What about the cost or the liability of the lawsuits that are coming your way? The collateral damage is just enormous. Avoiding that cost, what does that do for your return on investment?

The marketplace has a way of working. Whether or not it works fast enough to avoid major calamities in the future, I don’t know. But I know this. More burdensome regulation—and certainly more burdensome regulation driven by an emotional circumstance or perceived crisis—often gets us laws with unintended consequences. Cost of compliance is one. Cost-benefit analysis should be a part of any regulation imposing burdens on its targets.

It’s been about a year and a half since the first disclosure law took effect in California, and similar laws have passed or are being considered in many states. Do you classify these disclosure laws as burdensome regulations?