Federal Data-Breach Bills: The Tip Of The Iceberg - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
Mobile // Mobile Applications
Commentary
11/13/2009
09:45 PM
50%
50%

Federal Data-Breach Bills: The Tip Of The Iceberg

The Senate is considering two bills designed to revamp federal consumer data-privacy rules. But anyone who thinks these bills represent a wake-up call has already been sleeping way too long.

The Senate is considering two bills designed to revamp federal consumer data-privacy rules. But anyone who thinks these bills represent a wake-up call has already been sleeping way too long.The Data Breach Notification Act and the Personal Data Privacy and Security Act would apply to companies that suffer data breaches involving sensitive consumer information, such as financial records. Both bills would require firms to report significant data breaches -- most likely involving more than 5,000 individuals -- to government regulators, credit reporting agencies, and affected consumers.

Both, however, will also include exemptions to the reporting rules for companies that take measures to protect customer records. The use of approved encryption methods to protect consumer data, for example, could exempt a company from at least some of the disclosure rules.

A health-care technology reform package passed as part of a massive federal stimulus bill last February included similar data-breach disclosure provisions and exemptions. The current bills would extend the same sort of regulations to all sensitive consumer data, although they will probably not be as strict.

This isn't the sexiest topic, but it is one that could cost your company a ton of money if it gets caught unprepared.

Here's the real problem: Your company may already be subject to similar, and in some cases even more stringent, data-breach notification laws.

Today, 46 states already have laws in place that regulate how companies must respond to consumer data breaches. Some compel firms that discover a data breach to notify consumers and state regulators; others, such as a Massachusetts state law, actually require firms to encrypt sensitive consumer data stored on laptops.

If and when a federal law takes effect, it is likely to preempt many of these state laws. Until that happens, however, your company could face serious penalties if it fails to understand and to follow state data-breach notification laws. As always, ignorance is no excuse.

If you're looking for a good place to begin your company's research into this question, try CSO online. It has a fairly complete list of state by state data breach notification laws, currently covering 43 states (including a subsequent update article).

If your home state isn't on CSO's map, don't assume that you're out of the woods. Its list seems to be missing at least a couple of more recent state laws. If your state looks like an exception to the rule, I suggest running a Google search or simply calling your local Chamber of Commerce to make sure that is really the case.

Even if these laws don't apply to your business, encrypting sensitive customer records is always a good idea. Encryption is a quick, cheap, insanely simple security measure that could spare your company fines, litigation costs, and loads of negative publicity.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
News
How GIS Data Can Help Fix Vaccine Distribution
Jessica Davis, Senior Editor, Enterprise Apps,  2/17/2021
Commentary
Graph-Based AI Enters the Enterprise Mainstream
James Kobielus, Tech Analyst, Consultant and Author,  2/16/2021
Slideshows
11 Ways DevOps Is Evolving
Lisa Morgan, Freelance Writer,  2/18/2021
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you.
Slideshows
Flash Poll