(Under) Investment in Cyber Skills and Data Protection Enforcement: Evidence from Activity Logs of the UK Information Commissioner's Office

Abstract

Data breaches account for a significant share of cyber attacks. While they severely impact customers, who lose valuable personal data, they often have a limited effect on the operations of data-holding companies. This might lead firms to underinvest in cybersecurity. Does stronger data protection alleviate the effects of these misaligned incentives? We address this question by examining the link between firms' cybersecurity hiring and stronger data protection laws and enforcement. We study two institutional changes that affect data protection enforcement by the Information Commissioner's Office (ICO) in the UK. The first is the removal of the requirement to prove substantial damage and distress in 2015 that gives greater discretion to the ICO to issue monetary penalties. The second is the enactment of the Data Protection Act 2018, which significantly raises the ceiling of monetary penalties. To examine the effects of these legal changes, we assemble a novel dataset from ICO activity logs that entails more than 5,000 supervisory actions. We construct an index for exposure to ICO enforcement at the three-digit industry level. Combining the sectoral variation with the timing of the legal changes, we show that while stronger data protection enforcement significantly increases the investment in cybersecurity skills by up to 52%, it has a negative impact on firm dynamics, reducing the entry rate by up to 12% and increasing the exit rate by up to 13%.