'Strategic News Bundling and Privacy Breach
Disclosures' by
Sebastien Gay
considers
how firms strategically bundle news reports to offset the negative effects
of a privacy breach disclosure. Using a complete dataset of privacy breaches from 2005
to 2014, I find that firms experience a small and significant 0.27% decrease in their
stock price on average following the breaking news disclosure of the privacy breach.
But controlling for media coverage, this small decline is offset by an increase in the
effect of a larger than usual number of positive news reports released by the firm on
that day, which could increase the returns by 0.47% for every additional positive news
report compared to their usual media coverage. I further find that disclosure laws have
a significant and negative effect on the returns, even when news releases are used to
alleviate the decrease. Moreover, a portfolio constructed with breached firms controlling
for state disclosure laws outperforms the market over the 2007-2014 period, especially
in the case of breached firms in mandatory disclosure states.
Gay comments
The development of online transactions and data aggregation storage for companies has
increased the risk of privacy breaches in the past ten years. According to Privacy Rights
Clearinghouse, in fact, there were more than 4,540 breaches reported over the period 2005-
2014, compared to less than 1,000 over 1995-2005. The increase is primarily due to the
increased use, retention, and repackaging of data by companies.
On February 4, 2015, Anthem, Inc., one of the largest health insurance companies in
the United States, announced that 80 million customers’ and employees’ data were stolen.
Critical information (social security numbers, names, and dates of birth) for the 80 million
affected people was at risk of fraudulent use, making the Anthem breach one of the largest
privacy breaches in history. During the next trading day, however, the Anthem stock barely
went down from its closed value of $137.6 of the day prior to the brach announcement. The
close price represented a decrease of 0.31%, in line with the overall market decrease. The
Anthem stock was unaffected by this (random) event. This is one of many examples of data
breaches that affected a large amount of customers and their highly personal and sensitive
data but did not lead to a market sellout of the firm’s stock.
This paper examines why stocks of breached firms do not seem to be significantly affected
after reporting a privacy breach. I empirically show that firms counterbalance the effect of
a privacy breach disclosure by bundling this negative and potentially costly release with
more positive news reports to alleviate any expected decrease in stock value. I also find
that firms tend to release the disclosure during a period when there are a smaller than usual
amount of negative news reports. My analysis is reinforced by the fact that privacy breaches
happen at random times for any given firm, but firms have some small leeway to time their
disclosures. States have different laws regarding disclosures that can allow firms to announce
the privacy breach event to customers or the state attorney general with different timeframes,
usually between a day to up to two months after the firm discovers the breach. Moreover,
privacy breaches are known to be indicative of negative news since they indicate that private
information from customers or employees (or possibly both) has been stolen. Also, privacy
breach disclosures, contrary to more frequent and pre-scheduled corporate disclosures, are
good identifiable random events to test strategic (voluntary) disclosures by firms. Despite
not all states requiring disclosures, firms may want to disclose a privacy breach to avoid
developing a negative reputation.
This empirical analysis answers two main questions using privacy breach disclosures:
First, can firms counterbalance the negative effect of a privacy breach disclosure by strategically
timing the release of more positive media coverage than usual? Second, do disclosure
laws have a significant effect on the stock price of the firms that experience a privacy breach?
He concludes
This paper analyzes the effects of privacy breach disclosures and its potential bundling with
positive news on that day on the stock market. My key finding is that firms manage to
avoid the full negative effect of a privacy breach event disclosure by releasing on the same
day an abnormal amount of positive news to the market. Specifically, I show that after the
“breaking news” release of a privacy breach a large amount of positive news to the market
tends to have a dominating effect. My results suggest that a larger abnormal amount of
positive news on the day of the breach disclosure more than offsets the negative effect of the
disclosure. These findings are consistent with the empirical behavioral literature where bad
news reports are usually released to the market when investors are not paying attention. In
my particular case of privacy breaches, investors are distracted by the negative news report
on privacy breaches. I provide evidence that firms tend to release bundled news to the market
to offset negative random events, potentially stocking good news. Contrary to planned news
that firms prepare months in advance, most privacy breaches need to be disclosed within two
months of discovery. I find that there exists a strategic bundling of news by firms around
unexpected negative events. My interpretation focuses on the premise that firms are not
entirely in control of a privacy breach release and will try to bundle positive news to be able
to control the effect of the privacy breach disclosure on their stock.
A trading strategy based on the mix of breaking news and disclosure laws outperforms
the market. In essence, disclosure laws seem to punish breached firms, especially if the
disclosure is reinforced by breaking news reports. It may be an indirect way for the FTC to
ensure firms are setting the right standards of protection against privacy breaches.blockquote>
