Eric Chabrow reports on BankInfoSecurity.com that a number of witnesses testifying yesterday during the Senate hearing on the Data Security and Breach Notification Act of 2010 urged Congress to exempt groups when breach notification is already mandated by other laws.
Of course, their arguments make a certain amount of sense — except for the fact that if we exempt all these sectors or groups, we will still have a crazy patchwork quilt of laws instead of one clear federal law. Under those conditions, depending on who loses particular pieces of information, you may or may not get notified. Does it matter to consumers whether the sensitive data were on a laptop stolen from a financial sector employee or from a health care sector employee? The protections need to follow the data and not be subject to varying opinions and standards about “risk of harm.”
One reason to hope that this bill would apply to more sectors is that it details what kinds of information need to be included in a notification. Under the proposed bill, the notification is to include:
(i) the date, estimated date, or estimated date range of the breach of security;
(ii) a description of the personal information that was acquired or accessed by an unauthorized person;
(iii) a telephone number that the individual may use, at no cost to such individual, to contact the covered entity to inquire about the breach of security or the information the covered entity maintained about that individual;
(iv) notice that the individual is entitled to receive, at no cost to such individual, consumer credit reports on a quarterly basis for a period of 2 years, or credit monitoring or other service that enables consumers to detect the misuse of their personal information for a period of 2 years, and instructions to the individual on requesting such reports or service from the covered entity, except when the only information which has been the subject of the security breach is the individual’s first name or initial and last name, or address, or phone number, in combination with a credit or debit card number, and any required security code;
(v) the toll-free contact telephone numbers and addresses for the major credit reporting agencies; and
(vi) a toll-free telephone number and Internet website address for the Commission whereby the individual may obtain information regarding identity theft.
The above seems reasonable to me, although I would prefer to see two additional requirements that the entity disclose when and how they first became aware of the breach and when they re-secured their system.
Chabrow also reports:
Subcommittee Chairman Mark Pryor, D-Ark., said the panel could redraft and vote on the bill as early as next week. In his opening statement, Pryor cited the Privacy Rights Clearinghouse, which said more than a half billion data records have been compromised by unauthorized access to consumer databases since 2005. Last year, he said, nearly 500 data breaches in the United States potentially exposed 222 million sensitive records.
It’s nice to see Congress looking at breach reports and statistics compiled by groups like the PRC, ITRC, and DataLossDB.org. But are they paying enough attention to how many breaches involve paper records? Let’s see how they revise the draft bill. I doubt they’ll get rid of some of the provisions that I strongly dislike, but then, they do not legislate to please me.