Abstract

Companies are under an increasing pressure by policy makers to publicize data breaches. Such notification obligations require announcing the loss of personal data collected from customers, because of hacker attacks or other incidents. While notification is likely to impact on firms’ reputation, we know little about the impact such notifications have on consumers with respect to disclosure of their personal data. We present the problem as a dynamic lottery with personal data under the risk of privacy shocks and experimentally study how the privacy breach notification changes an individual’s behavior regarding data disclosure. Our results suggest that the notification induces individuals – disregarding the sensitivity of their data – to disclose more.