US Data Security Bill Expected to Reach Committee Vote Shortly

The US Senate recently introduced an amended version of the Personal Data Security and Privacy Act, a bill which would establish minimum security and privacy requirements and enhance penalties for security breaches involving personal data. The bill was first introduced in June 2005 by Senator Arlen Specter, a Pennsylvania Republican, and Senator Patrick Leahy, a Vermont Democrat, in response to a series of high-profile security breaches involving firms like ChoicePoint, Bank of America, PayMaxx and LexisNexis. The amendments include narrowing the definition of certain terms, such as "data broker". The original definition of "data broker" had been seen by some as being overly broad and capable of encompassing news or web sites run by alumni organizations or charities that published personal information relating to their members. The amended bill also excludes a provision which severely restricted the sale and use of social security numbers by businesses and other entities. In addition, the bill would require notice of data breaches be given to any US resident whose data was subject to the breach "without unreasonable delay". Remaining in the bill are criminal penalties of up to five years in prison for hiding breaches of security involving sensitive personal information and economic damage. Also retained are minimum security and privacy standards for companies that handle electronic data records containing "sensitive personally identifiable information". According to Senator Leahy, stakeholder comments have made the bill better balanced and focused. The revised bill may receive a Committee vote shortly. For more information, visit: http://makeashorterlink.com/?C2B6527FB http://makeashorterlink.com/?I2E6127FB For a copy of the bill as introduced, see: http://i.i.com.com/cnwk.1d/pdf/ne/2005/Specter-Leahy.pdf Summary by: Nicholas Wong