Information Security Law in the EU and the U.S.: A Risk-Based Assessment of Regulatory Policies

Security breaches affecting millions of consumers world-wide, media reports about “cyber war” and speculations about “cyber terrorism” have brought information security (often also referred to as “cyber security”) to the forefront of the public debate. “Information Security Law in the EU and the U.S.” provides the first comprehensive assessment of EU and U.S. information security law, covering laws and regulations that require the implementation of security measures, laws that impose or limit liability for security breaches, laws that mandate the disclosure of vulnerabilities or security breaches, and laws that deter malicious actors by providing criminal sanctions. To facilitate this comparative assessment, a risk-based assessment methodology is used. The book also contains a concluding comparative assessment that summarizes the current state of information security law. Building on this concluding assessment, policy recommendations are presented how to fundamentally improve information security.