As business values of customer data have increased, vast amounts of customer data have been collected by firms and used for their businesses activities. Though customers' personal information should be secured by the firms, the customer data are often stolen and misused from security breach. We examine alternative legal systems that affect firm's decisions on securing customer data using analytical methods. We identify conditions under which the law that imposes the liability on the firm for customer's security loss leads firms to have higher security investment and firm profit than the law that does on the customer.
