Security experts have once again called for the UK to introduce a US-style
data breach notification law. The argument in favour is pretty compelling:
it will force firms to take their data protection more seriously and
improve security efforts.

With the EU now investigating the possibility of legislation along these
lines, and the Information Commissioner’s Office offering support for the
idea, the introduction of breach notification rules in the UK looks more
likely than ever. But there need to be clear guidelines covering when a
breach should be made public.data

Reporting of every breach, no matter how minor, could do more harm than
good, leading first to public hysteria and then to apathy. But when the
risk is significant, firms should be forced to disclose. The problem will
be in deciding what constitutes a significant breach.