Law
The Legal Standard of Reasonableness in Data Breach Notification Requirements
Quick fact
In the United States, most state data breach notification laws require notification only when the breach poses a 'reasonable risk' of harm to individuals, yet courts rarely define 'reasonable' with precision, instead relying on case-by-case judgment—creating wide variability in how companies respond.
Why this is interesting
When a company loses your personal data, they don't always have to tell you. The law leaves it to a surprisingly fuzzy word: 'reasonable.' But what does that actually mean?