While I think that goverments are more likely to disclose breaches (it's harded to replace your government than your bank), I think that we've seen that most breach disclosures don't lead to the sky falling, and so we're seeing more of them.

I talk about this regularly over at http://www.emergentchaos.com. Take a look at the breach analysis archives.

Adam
 

Possibility #5 - private industry takes privacy more seriously.

No, really, I mean it.

I'll admit my sample size is lousy - I work in private industry with a terrible privacy track record, but I have no relevant experience in the public sector.

In my business, confidential data often also has commercial applications. If you lose this data, not only are there privacy and reputational issues, but there may also be a genuine profit hit: competitors may steal your clients, employees may be taking money to which they are not entitled.

As a result, the people who have access to confidential data are a defined number of people, with well-defined responsibilities. Other people are in charge of making sure those people are doing their jobs correctly.

The Economist says something very similar (albeit in a much more erudite way) in its Nov. 22editorial dealing with the loss of the HMRC data (http://www.economist.com/opinion/displaystory.cfm?story_id=10177106)

"Large databases have their uses, doing away with paperwork and speeding things up. But the centralisation of so much data also has drawbacks, as this week's mess shows. In its enthusiasm for huge technology projects, such as its plan for a national identity card, the British government has failed to take such dangers sufficiently seriously. And why should it, when its departments face no penalties for ignoring procedures and losing data? If organisations were confronted by the risks of building large databases and forced to balance them against the benefits they provide, they would design them differently and monitor their use more closely. "

The private sector is, to a greater extent, confronted with the risks of building (and running) large databases, and so does design and monitor them more closely. Not perfectly, not constantly, but more closely.