Policy Fugue by Kenneth Corbin (bio )

Tracking the loveless marriage of technology and government

« Spectrum showdown: Broadcasters facing another fight | Kenneth Corbin Blog | Google's revised Book Search agreement coming Friday »

Senate committee clears data breach bills

By Kenneth Corbin on November 5, 2009 6:55 PM

A pair of bills that would require businesses to notify consumers in the event of a data breach cleared the Senate Judiciary Committee Thursday, moving on to the full Senate for consideration.

The Data Breach Notification Act, sponsored by Dianne Feinstein (D-Calif.), would authorize the attorney general to bring civil actions against firms that failed to notify people whose personal information had been compromised in a breach. It would also extend notification requirements to government agencies.

The more comprehensive Personal Data Privacy and Security Act, introduced by Judiciary Chairman Patrick Leahy (D-Vt.) and co-sponsored by Utah Republican Orrin Hatch and others, would also set notification requirements, as well as tighten criminal penalties for identity theft and willfully concealing information about a breach.

Additionally, the Leahy bill would require businesses to implement preventive security policies to guard against threats to their databases. Like Feinstein's bill, it would also apply to federal agencies.

Both bills would set federal guidelines to add some certainty to the patchwork of at least 45 state laws governing data breaches, and both enjoy the support of the Business Software Alliance (BSA), the leading lobbying arm of the software industry and many hardware firms.

"BSA commends Chairman Leahy, Sen. Hatch and Sen. Feinstein for their leadership on data security and data breach notification," Robert Holleyman, the group's CEO, said in a statement.

The group said that both laws would be "manageable for business."

Leahy's bill would also entail some changes in the shape of the federal government, directing the Federal Trade Commission to establish an Office of Federal Identity Protection, and requiring the Department of Justice to create an agency-wide chief privacy officer.

Both Leahy and Feinstein have introduced versions of the bills in previous Congresses, only to see them stall.

"The loss of data privacy is not just a grave concern for American consumers; it is also a serious and growing threat to the economic security of American businesses, and is a growing threat to our national security," Leahy said in a statement. "The time for Congress to enact comprehensive data privacy legislation has come. I hope that the Senate will consider this legislation promptly."

Permalink | Comments (0) | TrackBacks (0) | Share