An investigation of the impact of data breach severity on the readability of mandatory data breach notification letters: Evidence from U.S. firms

Jackson, Stephen; Vanteeva, Nadia; Fearon, Colm

Abstract

© 2019 ASIS & T The aim of this article is to investigate the impact of data breach severity on the readability of mandatory data breach notification letters. Using a content analysis approach to determine data breach severity attributes (measured by the total number of breached records, type of data accessed, the source of the data breach, and how the data were used), in conjunction with readability measures (reading complexity, numerical intensity, length of letter, word size, and unique words), 512 data breach incidents from 281 U.S. firms across the 2012–2015 period were examined. The results indicate that data breach severity has a positive impact on reading complexity, length of letter, word size, and unique words, and a negative impact on numerical terms. Interpreting the results collectively through the lens of impression management, it can be inferred that business managers may be attempting to obfuscate bad news associated with high data breach severity incidents by manipulating syntactical features of the data breach notification letters in a way that makes the message difficult for individuals to comprehend. The study contributes to the information studies and impression management behavior literatures by analyzing linguistic cues in notifications following a data breach incident.

• Journal Article Type: Article
• Acceptance Date: Dec 14, 2018
• Online Publication Date: Mar 18, 2019
• Publication Date: Nov 1, 2019
• Deposit Date: Feb 25, 2019
• Publicly Available Date: Feb 25, 2019
• Journal: Journal of the Association for Information Science and Technology
• Electronic ISSN: 2330-1643
• Publisher: Association for Information Science and Technology (ASIS&T)
• Peer Reviewed: Peer Reviewed
• Volume: 70
• Issue: 11
• Pages: 1277-1289
• DOI: https://doi.org/10.1002/asi.24188
• Public URL: https://uwe-repository.worktribe.com/output/850494
• Publisher URL: https://doi.org/10.1002/asi.24188
• Additional Information: Additional Information : This is the peer reviewed version of the following article: [Jackson, S., Vanteeva, N. and Fearon, C. (2019) An investigation of the impact of data breach severity on the readability of mandatory data breach notification letters: Evidence from U.S. firms. Journal of the Association for Information Science and Technology. ISSN 2330-1635], which has been published in final form at https://doi.org/10.1002/asi.24188. This article may be used for non-commercial purposes in accordance with Wiley Terms and Conditions for Self-Archiving.
• Contract Date: Feb 25, 2019