Empirical estimates of privacy harm can help victims to demonstrate damages resulting from violations or support organisations in balancing harm to individuals against the cost of preventative measures. Quantitative studies of privacy harm are relatively rare. Personal identity insurance provides an additional source of quantitative data regarding the nature, likelihood and impact. We extract 34 unique personal identity insurance products that were filed with regulators in the US. We conduct a content analysis on the policy wordings and actuarial tables. Analysing the policy wordings reveals that personal identity theft causes a number of costs in terms of monitoring credit records, lost income and travel expenses, attorney fees, and even mental health counselling. Our analysis shows there are few exclusions related to moral hazard, which suggests that identity theft is largely outside the control of individuals. The actuarial calculations reveal financial impacts ranging from a few hundred to a few thousand dollars. Finally, insurers provide support services that are believed to reduce out of pocket expenses by over 90%. Together these policies, which are tested by market forces, provide three main insights: (i) there are real, quantifiable harms resulting from identity theft; (ii) individuals can do little to stop it; and (iii) a lack of support services increases losses.
Woods, Daniel W, Quantifying Privacy Harm via Personal Identity Insurance (December 13, 2021).