Complain about a product or service

Senate Moves Ahead with Data Breach Bills

By Martin H. Bosworth
ConsumerAffairs.com

May 4, 2007 

Data Theft • Thieves Steal AT&T Laptop with Employee Data • Report: Data Breach Disclosure Laws Don't Affect Identity Theft • Patient Information Exposed in Data Breach at Walter Reed • Supermarket Chain Reports Data Breach • Report: Feds Still Not Doing Enough To Secure Data • Data Thieves Hit Georgetown University Students, Faculty • 800,000 Job Seekers At Risk In Gap Data Breach • TJX Data Breach Settlement Has Strings Attached • More ...

The Senate has taken action on several competing pieces of legislation that would mandate government agencies and private businesses to disclose data breaches, federalize the right of consumers to obtain "credit freezes" on their accounts, and offer more transparency in the world of data brokers that buy and sell citizens' information.

How strong the bills will turn out to be is, however, anyone's guess.

The Senate Judiciary Committee approved bills introduced by committee chair Patrick Leahy (D-VT) and Dianne Feinstein (D-CA) on May 3. Leahy's bill, "The Personal Data Privacy And Security Act of 2007 ," would "deal with the underlying problem of lax security and lack of accountability to help prevent data breaches from occurring in the first place and also addresses the need to provide Americans with better notice of breaches that may affect their personal information," the senator said.

Leahy and co-sponsor Sen. Arlen Specter (R-PA) had originally introduced the act in 2005 in response to high-profile data breaches at ChoicePoint and LexisNexis, but the bill failed to get out of the Senate.

Leahy's legislation would mandate data security programs for companies with information on more than 10,000 Americans and require vetting of contractors hired to process data, as well as strengthening the criminal penalties for committing data breaches with the intent to sell the information, or concealing that a breach took place.

"We have tried to put forth some meaningful solutions to this problem in our bill and hope to merit the Committee’s support," Leahy said in a statement. "This is not a perfect bill. It is not the bill that either of us would have written alone."

Feinstein's bill, the "Notification of Risk To Personal Data Act," also cleared the Judiciary Committee. Feinstein's bill, the "Notification of Risk To Personal Data Act," includes a "disclosure trigger" for breaches, enabling businesses to escape the notification requirement if they perform their own in-house "risk assessment" of the breach.

Feinstein's bill also preempts stronger state laws on data breaches and offers a broad exemption for law enforcement agencies from the disclosure requirement.

Public Interest Research Group (PIRG) head Ed Mierzwinski criticized both bills for what he called "weak" provisions governing data breaches and the preemption of state laws, stating that the influence of the credit and financial industries was behind the push for weaker federal laws to override state bills.

"Consumers have been better served by state leadership on privacy, on global warming and on virtually every policy matter," Mierzwinski said. "Federal law should always be a floor protecting everyone at minimum levels, never a ceiling preventing states from acting more quickly or going further in defense of consumers and the environment."

Inouye's Proposal

Not to be outdone, Senate Commerce Committee chair Daniel Inouye (D-HI) introduced the "Identity Theft Prevention Act of 2007" on April 20. His measure sets the standard for breaches at "$11,000 per violation per day," and mandates that consumers in all 50 states have the right to "freeze" their credit and prevent unauthorized opening of new accounts.

Credit freezes are a favored tool of consumer and privacy advocates, but they are fiercely opposed by industries that depend on easy access to credit, such as auto sellers.

Credit freezes are available in 30 states, but have been opposed even in states with high levels of identity theft and fraud, such as Arizona and Nevada.

The Federal Trade Commission's new strategic plan for identity theft mirrors both the good and bad aspects of the bills being pushed in the Senate. The FTC plan mandates setting standards for breach disclosures, stiffening criminal penalties for cybercriminals, and enforcing breach laws in the public and private sector.

However, it also recommends preempting stronger state laws that govern data breaches, and takes a "wait-and-see" approach towards credit freeze legislation.

Washington Post tech columnist Brian Krebs argues that credit freezes give consumers "peace of mind," and that citizens should not have to pay to prevent unauthorized access to their own credit.

"While $60 per couple may seem like a fortune to keep your personal data private, a freeze can save ID theft victims the years of hassle and thousands of dollars in legal costs typically incurred as they seek to clear their names," Krebs wrote. "Still, that cost is likely to be prohibitive for some people, particularly low-income families and the elderly."

Whichever piece of legislation ends up clearing the Senate, all of the players involved are emphasizing the continuing risks to ordinary people if laws are not put in place to stem data breaches soon.

"Passing this comprehensive privacy legislation is a legislative priority," Senator Leahy said of his bill. "I hope the Committee will join with us to support this privacy legislation and work with us to see it enacted."

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Back to the top |