Bruce Schneier, well known security guru, has posted an interesting summary of expected federal law covering disclosure of data loss in the US. What Bruce doesn't mention is that a lot of the state laws that are in place include a notification exemption for where notifying customers that their data has been lost would be too costly to a company.
For example if a company did lose data relating to several hundred thousand customers it is not too hard to imagine that the cost involved could be greater than $250,000 (which is the limit for the Ohio notification law). The company could then opt for a "conspicuous posting" on their website, or to provide "notification to major media outlets" in lieu of informing each customer.
Not hard to imagine never hearing about your data being lost is it?
Found this useful? Then Digg It.
