When does a privacy breach cause harm?

Computerworld - Several countries are on the verge of doing what U.S. courts have stopped short of: codifying that breaches of personal information can actually harm people. Why should U.S. companies welcome this development?

Because an international answer to this question could clarify the standard of protection that corporations have to meet with regard to personal data in their care. Finally having a clear standard could contain corporate liability and reduce companies' operational expenses. Whether the U.S. Congress also makes this leap in its deliberations over a national breach-notification bill may depend on legal experts stepping up to the plate to reshape the terms of the debate.

Let's face it: U.S. courts have botched this one. Time and again, when plaintiffs have sued companies for exposing their personal data, the only damages courts have awarded them, if any, have been for monetary losses relating to account fraud or identity theft.

On the one hand, most large data breaches don't even lead to a rash of ID thefts. As forensics firm ID Analytics Inc. has shown in a number of case studies, lost laptops and other similar breaches involving thousands of people's sensitive information resulted in only about a dozen verifiable instances of fraud.

But is monetary loss the only criterion for personal harm? Anyone who has experienced true ID theft would say the money is only a part of the equation. The countless obstacles to getting on with life, not to mention the psychological dread, can outweigh the hard-dollar losses.

So when do privacy breaches cause harm? That's what I asked Anita Allen, a professor at the University of Pennsylvania's law school. Allen is scheduled to address this topic later this month at the International Association of Privacy Professionals Summit in Washington.

“Identity theft and financial fraud are one sort of harm,” Allen said. “But others include offensive publication of illicitly acquired personal information, along with hurt feelings and dashed expectations. The assault to personality and feelings is the quintessential privacy injury.”

To that end, we can all think of examples in our own lives where privacy exposures harmed us or people we knew. Predators who exploit information about children online, forwarded e-mail chains that damage relationships and compromising photos sent by cell phones are three examples that come to mind.

But what about the information potentially obtained by insurance companies and employers that could limit someone's economic possibilities, or information obtained by government agencies that threaten our sense of autonomy? These can all harm our human dignity.