Forty-six states require organizations to notify users when personally identifiable information has been exposed or when the organization’s data security measures have been breached. This article describes a qualitative document analysis of 13 data breach notification templates from state and federal agencies. The results confirm much of the typical advice for negative messages, but they suggest that the direct pattern may be an effective way to inform users as required by law, to overcome optimism bias, and to overcome rational ignorance. When a buffer is used, writers should not be afraid to refer to the bad news.
AcquistiA.FriedmanA.TelangR. (2006). Is there a cost to privacy breaches? An event study. Paper presented at the 27th International Conference on Information Systems, Milwaukee, WI. Retrieved from http://allan.friedmans.org/papers/breach06.pdf
2.
AlredG. J. (1992). “We regret to inform you”: Toward a new theory of negative messages. In SimsB. R. (Ed.), Studies in technical communication: Selected papers from the 1992 CCCC and NCTE meetings (pp. 17-36). Denton, TX: University of North Texas Press.
3.
AlredG. J.BrusawC. T.OliuW. E. (2011). The business writer’s handbook. Boston, MA: Bedford/St. Martin’s.
4.
ArgentiP. A. (2006). How technology has influenced the field of corporate communication. Journal of Business and Technical Communication, 20, 357-370.
5.
BovéeC. L.ThillJ. V. (2012). Writing negative messages. In Business communication today (11th ed.). Upper Saddle River, NJ: Prentice Hall.
6.
CarterC. (2012). Negative messages. In Keys to business communication: Success in college, career, and life. Upper Saddle River, NJ: Prentice Hall.
CoombsW. T.HolladayS. J. (2008). Comparing apology to equivalent crisis response strategies: Clarifying apology’s role and value in crisis communication. Public Relations Review, 34, 252-257.
JansenF.JanssenD. (2011). Explanations first: A case for presenting explanations before the decision in Dutch bad-news messages. Journal of Business and Technical Communication, 25, 36-67. doi:10.1177/105065191038037210.1177/1050651910380372
17.
JebbJ. F. (2005). The crisis posting: Scenarios for class discussion and creation. Business Communication Quarterly, 68, 457-478.
18.
JohnsonC. (2006). Recommendations for identity theft related data breach notification. Washington, DC: Office of Management and Budget. Retrieved from http://www.whitehouse.gov/omb/memoranda_2006/
19.
KolinP. C. (2007). Successful writing at work. Boston, MA: Houghton Mifflin.
20.
LehmanC. M.DuFreneD. M. (2012). Delivering bad-news messages. In BCOM (3rd ed.). Mason, OH: South-Western/Cengage Learning.
21.
LimayeM. R. (2001). Some reflections on explanation in negative messages. Journal of Technical and Business Communication, 15, 100-110.
22.
LockerK. O. (1999). Factors in reader responses to negative letters: Experimental evidence for changing what we teach. Journal of Business and Technical Communication, 13, 5-48.
23.
LockerK. O.KienzlerD. S. (2010). Delivering negative messages. In Business and administrative communication (9th ed.). New York, NY: McGraw-Hill/Irwin.
24.
MascoliniM. (1994). Another look at teaching the external negative message. Business Communication Quarterly, 57(2), 45-47.
OliuW. E.BrusawC. T.AlredG. J. (2009). Writing business correspondence. In Writing that works: Communicating effectively on the job (9th ed.). Boston, MA: Bedford/St. Martins.
RodeL. (2007). Database security breach notification statues: Does placing the responsibility on the true victim increase data security?Houston Law Review, 43, 1597-1634.
32.
RomanoskyS.TelangR.AcquistiA. (2011). Do data breach disclosure laws reduce identity theft?Journal of Policy Analysis and Management, 30, 256-286.
ShwomB. G.SnyderL. G. (2012). Communicating bad-news messages. In Business communication: Polishing your professional presence. Upper Saddle River, NJ: Prentice Hall.
35.
SomaJ. T.CoursonJ. Z.CadkinJ. (2009). Corporate privacy trend: The “value” of personally identifiable information (PII) equals the “value” of financial assets. Richmond Journal of Law and Technology, 25(4), 1-32. Retrieved from http://jolt.richmond.edu/v15i4/article11.pdf
