Data Breach Disclosure 34,000,000). Clearly, identity theft and data breach are an economic concern. Escalating data breach problems further erode privacy. However, unlike identity theft, which has a legal definition and can be quantified in terms of incidents, privacy has no single definition or meaning. Generically speaking, privacy is the condition of being left alone, out of public view, and being in control of one's personal informa- tion. From a policy perspective, privacy can be classified in two basic categories: the reductionist view and the coherentist view (Schoeman, 1984). From the reductionist perspective all privacy claims are reducible to claims of other sorts, for example, property rights and trespass. According to this view, there is no purpose for considering privacy as a distinct issue of concern ­ existing policy can be extended to address it. In contrast, coherentism suggests that privacy consists of a number of fundamental, integrated, and distinct area is timely and relevant. Policy analysis aims to address questions such the following. What do governments choose to do or not to do? How effective are the proposed or enacted solutions to public problems? How are issues that affect large numbers of citizens introduced to the pub- lic arena? What are the historical, political, and institutional factors that shape the formulation of public policy? In light of the relationships among policies, which of various alternative policies will be most effective in achieving a given set of social goals? How can policy making be improved through research and analysis? This chapter seeks to advance information se- curity and privacy policy analysis by specifically examining the data breach disclosure laws recently enacted in the United States. The background section includes a brief history of these laws and serves to provide context. The laws are analyzed using an institutional analysis and development