Vox: Companies lose your data and then nothing happens

All 50 states have laws that require businesses and in most cases government entities to issue notifications about data breaches. But they often differ on what happens next in terms of who’s allowed to enforce the laws and go after companies who screw up, explained Caitriona Fitzgerald, deputy director of the Electronic Privacy Information Center (EPIC). “Some states give attorneys general sole authority to enforce data breach laws, but they don’t give them any resources to do it,” she said. Some states allow for a private right of action, which allows private citizens to sue a company directly, but that can be tricky to navigate. Fitzgerald said courts have often made it hard for individuals to sue because it’s hard to quantify harm and show exactly the cost of your data being lost.

Read more here.