Are Breach Notification Laws Not Working?

Carnegie Mellon research begs the question, "Are breach laws only informing us that identity theft is occurring, or do the laws actually help reduce breaches?"

So far, identity theft doesn't appear to be decreasing. Is more legislation needed, or has the existing legislation simply not been around for long enough?