They're back! Data breach notification bills resurface

After several large breaches -- including the Epsilon, Sony, and Citigroup incidents that left customer financial data exposed -- federal lawmakers are dusting the covers off of an old idea: national data breach notification laws.

Since the inception of the California Data breach Disclosure Law, known as SB 1386, most states have since followed suit -- leaving a mishmash of data breach notification laws across the country. Proponents of a national law contend that a federal data breach disclosure standard would simplify the rules for business -- so they know exactly what events would trigger a mandate for notification.

Also see: The breach goes on: Bono Mack unveils SAFE Data Act

One piece of legislation being introduced, The Data Security and Breach Notification Act of 2011 by Sen. Patrick Leahy (D-Vt.) and co-sponsored by Sen. Charles Schumer (D-N.Y.) and Ben Cardin (D-Md.) would mandate organizations that possess personal information to put in place "reasonable" security procedures to keep that data secure. Should the organization endure a breach, those affected would have to be notified. Also, in line with what has become standard practice today, organizations would have to supply consumers access to credit reports or credit monitoring services for a period of time.

Also this week, Rep. Mary Bono Mack (R-Calif.) released a draft of a bill that also calls for a national notification standard for enterprises that suffer data breaches. Mack's bill would mandate that firms notify the Federal Trade Commission and breach victims within 48 hours of the scope of a breach being assessed. The legislation, in its current form, would give the Federal Trade Commission the power to fine companies that fail to comply.

"E-commerce is a vital and growing part of our economy. We should take steps to embrace and protect it -- and that starts with robust cyber security. Most importantly, consumers have a right to know when their personal information has been compromised, and companies and organizations have an overriding responsibility to promptly alert them," Bono Mack said in a statement.

Also see: Enterprise risk management

Industry security representatives have came out in favor of such federal notification laws, albeit considerably gutted. Leigh Williams, president of The Financial Services Roundtable, said that the roundtable supports "a uniform national standard for breach notification. Given existing state and financial services breach notification requirements, this migration will require both strong pre-emption and reconciliation to existing regulations and definitions of covered data." Williams also stated that their should be exemptions for data rendered unreadable, in breaches in which there is no reasonable risk of harm, and in situations in which financial fraud preventions are in place.

Such legislation, many contend, have their benefits and drawbacks. "Ideally, it would accomplish some worthwhile goals. It would enable those affected to understand their risks, if any, resulting from a breach," says Scott Crawford managing research director at Enterprise Management Associates. "Information that is detailed enough would better inform a more specific, and perhaps more effective, response. It would also provide much more information on security outcomes that we presently lack, in line with "New School" thinking, which would better inform us on how attacks succeed and security strategies fail, and where we could do better," he says.

There's no guarantee, once the bill works through the legislative process, that they'll turn out that way, warns Crawford. "The fear of embarrassment and negative impact on their business have not been the only things holding organizations back from disclosure, powerful as those motivators are," Crawford says. "In some cases, others may be further harmed by too much or too detailed disclosure too soon. Government agencies themselves may ask some organizations to withhold specific information if it could pose a threat to what they deem the national interest," he adds.

And that's one of the biggest levers organizations will pull during any lobbying or debate on and disclosure bill. "That suggests another concern: any resulting legislation would be so full of loopholes that it would effectively be neutered," Crawford says.

George V. Hulme writes about security and technology from his home in Minneapolis. He can be found on Twitter as @georgevhulme.

Read more about compliance in CSOonline's Compliance section.

Join the CSO newsletter!

Error: Please check your email address.

Tags data breachSB 1386state data breach lawsThe Data Security and Breach Notification Act of 2011SAFE Data ActSecurity LeadershipIT managementsonyregulatory compliancecitigroupsecuritySecurity Leadership | Compliance

More about Enterprise Management AssociatesEpsilon InteractiveetworkFederal Trade CommissionFinancial Services RoundtableSony

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by George V. Hulme

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place