Shostack + Friends Blog Archive


Iowa breach law arrives a bit early

On May 10, Iowa became the 42nd U.S. state (counting D.C. as a state) with a breach notification law. The law itself is not remarkable. If anything, it is notably weaker than many other states’ laws.
When can we expect to see the last stragglers finally pass their laws? Here’s a plot of each state’s date of law passage, expressed in days since the Choicepoint episode became public. The x-axis is logarithmic.
Looks like a decent fit to me. In fact, a tad over under 3% of the variance remains unexplained. Assuming that whatever accounts for this exponential decay remains for a while, the last state should have a law in place October 9, 2011 :^).

5 comments on "Iowa breach law arrives a bit early"

  • Adam says:

    So you’re predicting that the next Congress & administration will fail to pass either a privacy or a breach notice law with a pre-emption?

  • Chris says:

    Did I leave out the “ceteris paribus”? ;^)
    My point, really, is that to the extent people consider this a solved problem because the states know what to do and will get around to it, they might be in for a longish wait.

  • Hilarious. Last time I checked there are seven remaining states, not eight.
    Who wants to bet on which state will be last:
    Alaska, New Mexico, South Dakota, Missouri, Alabama, Mississippi, or Kentucky?
    Extra points if you can figure out what these states have in common.

  • “So you’re predicting that the next Congress & administration will fail…”
    Based on the track record of S.1789[109th] and H.4127[109th] it is hard to say federal legislation for breach disclosure will even make it to the floor for debate.

  • Chris says:

    @Davi –
    Quite right. My dataset actually has 43 “states”, not 42. I was going to say “42 states, plus DC”, switched gears, and managed to screw up the description. Since the graph shows state laws after ChoicePoint, only 42 data points are plotted.
    Meanwhile, I learned that AK has had their HB 65 signed into law on 6/13!
    This brings my adjusted R2 to .9798

Comments are closed.