“Incentivizing Firms to Protect Consumer Data: Can Reputation Play a (Bigger) Role?”

Résumé

Despite the growing threat of cyber-attacks, firms may lack incentives to invest in consumer data protection due to two market failures: imperfect information and externalities. I examine the mitigating role that reputation may play in a repeat-purchase setting—data breaches can damage a firm’s reputation, leading to lost future sales. I consider policies for boosting investment and analyze their impact on the security level and consumer surplus. I show that interventions which directly address the market failures always lead to desirable outcomes, while indirect interventions aimed at enhancing the role of reputation may result in lower investment and consumer surplus.