They're back! Data breach notification bills resurface
- 27 June, 2011 23:48
- Comments
After several large breaches -- including the Epsilon, Sony, and Citigroup incidents that left customer financial data exposed -- federal lawmakers are dusting the covers off of an old idea: national data breach notification laws.
Since the inception of the California Data breach Disclosure Law, known as SB 1386, most states have since followed suit -- leaving a mishmash of data breach notification laws across the country. Proponents of a national law contend that a federal data breach disclosure standard would simplify the rules for business -- so they know exactly what events would trigger a mandate for notification.
Also see: The breach goes on: Bono Mack unveils SAFE Data Act
One piece of legislation being introduced, The Data Security and Breach Notification Act of 2011 by Sen. Patrick Leahy (D-Vt.) and co-sponsored by Sen. Charles Schumer (D-N.Y.) and Ben Cardin (D-Md.) would mandate organizations that possess personal information to put in place "reasonable" security procedures to keep that data secure. Should the organization endure a breach, those affected would have to be notified. Also, in line with what has become standard practice today, organizations would have to supply consumers access to credit reports or credit monitoring services for a period of time.
Also this week, Rep. Mary Bono Mack (R-Calif.) released a draft of a bill that also calls for a national notification standard for enterprises that suffer data breaches. Mack's bill would mandate that firms notify the Federal Trade Commission and breach victims within 48 hours of the scope of a breach being assessed. The legislation, in its current form, would give the Federal Trade Commission the power to fine companies that fail to comply.
"E-commerce is a vital and growing part of our economy. We should take steps to embrace and protect it -- and that starts with robust cyber security. Most importantly, consumers have a right to know when their personal information has been compromised, and companies and organizations have an overriding responsibility to promptly alert them," Bono Mack said in a statement.
Also see: Enterprise risk management
Industry security representatives have came out in favor of such federal notification laws, albeit considerably gutted. Leigh Williams, president of The Financial Services Roundtable, said that the roundtable supports "a uniform national standard for breach notification. Given existing state and financial services breach notification requirements, this migration will require both strong pre-emption and reconciliation to existing regulations and definitions of covered data." Williams also stated that their should be exemptions for data rendered unreadable, in breaches in which there is no reasonable risk of harm, and in situations in which financial fraud preventions are in place.
Such legislation, many contend, have their benefits and drawbacks. "Ideally, it would accomplish some worthwhile goals. It would enable those affected to understand their risks, if any, resulting from a breach," says Scott Crawford managing research director at Enterprise Management Associates. "Information that is detailed enough would better inform a more specific, and perhaps more effective, response. It would also provide much more information on security outcomes that we presently lack, in line with "New School" thinking, which would better inform us on how attacks succeed and security strategies fail, and where we could do better," he says.
There's no guarantee, once the bill works through the legislative process, that they'll turn out that way, warns Crawford. "The fear of embarrassment and negative impact on their business have not been the only things holding organizations back from disclosure, powerful as those motivators are," Crawford says. "In some cases, others may be further harmed by too much or too detailed disclosure too soon. Government agencies themselves may ask some organizations to withhold specific information if it could pose a threat to what they deem the national interest," he adds.
And that's one of the biggest levers organizations will pull during any lobbying or debate on and disclosure bill. "That suggests another concern: any resulting legislation would be so full of loopholes that it would effectively be neutered," Crawford says.
George V. Hulme writes about security and technology from his home in Minneapolis. He can be found on Twitter as @georgevhulme.
Read more about compliance in CSOonline's Compliance section.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
- Bookmark this page
- Share this article
- Got more on this story? Email CIO
- Follow CIO on twitter
- Epsilon hack: Notification letters
- Sony: PlayStation network personal user data stolen - CSO Online - Security and Risk
- Citigroup Reveals Breach Affected Over 360,000 Cards - CSO Online - Security and Risk
- California SB 1386: For the Love of Privacy - CSO Online - Security and Risk
- CSO Disclosure Series : Data Breach Notification Laws, State By State - CSO Online - Security and Risk
- The breach goes on: Bono Mack unveils SAFE Data Act
- Press Releases - Newsroom - U.S. Senator Mark Pryor
- draft of a bill
- Risk's rewards: Organizational models for ERM - CSO Online - Security and Risk
- @georgevhulme.
- Compliance - CSO Online - Security and Risk
-
Google Jumps Into Social Bookmarks Game
-
NBN build gaining momentum daily: Quigley
-
Face Time - Interview with John Brennan and Robert DiStefano
-
Monday Grok: Will Siri crack the walls of GOOG?
-
Face Time - Interview with John Brennan and Robert DiStefano
-
A Governance Guide for Hybrid SharePoint Migrations
Cloud-based computing represents a powerful new option for managing enterprise content, offering increased flexibility, efficiency, and reduced cost for IT infrastructure, data storage, and applications. However, for a variety of business and technical reasons, most organisations will take a phased approach to adopting cloud-based services, which will require them to continue to maintain their on-premises SharePoint environments during the transition. This white paper, written by Chris Beckett from SharePoint Bits, discusses some of the benefits and risks of hybrid SharePoint deployments, and presents governance considerations that are essential for ensuring a successful migration. -
Optimised Data Protection for VMware® Environments with Symantec NetBackup™ Appliances
VMware® remains the most widely deployed virtualisation solution. The explosive growth of VMware infrastructure in organisations both large and small has enabled corporations to more fully exploit their hardware investments. With multiple virtual machines running on few physical hardware nodes, hardware costs are reduced, as well as space, power, and cooling requirements. This white paper discusses in more detail how VMware environments can be protected with the NetBackup appliances. Read more. -
High Availability with Oracle Database 11g Release 2
In this paper, we review the common causes of application downtime and discuss how technologies available in the Oracle Database can help avoid costly downtime and enable rapid recovery from unplanned failures and also minimize impact from planned outages. We also highlight new technologies introduced in Oracle Database 11g Release 2 that enable businesses to make their IT infrastructure even more robust and fault tolerant, maximize their return on investment on high availability infrastructure, and provide better quality of service to users.
-
Appleworks 6 for Dummies
-
Build the Ultimate Home Theater PC (Extremetech)
-
QuickBooks 2006 for Dummies
-
Photoshop 7 All-In-One Desk Reference for Dummies
-
Access 2002 for Dummies Quick Reference
-
Cisco Networking for Dummies, 2E
-
Aperture Exposed
-
PHP and MySQL Everyday Apps for Dummies
-
Objects, Abstraction, Data Structures and Design








Comments
Post new comment