eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Two draft versions of data breach bills were introduced in Congress: one by U.S. Rep. Mary Bono Mack, R-Calif., and the other by Sens. John Rockefeller, D-W.Va., chair of the Senate Commerce Committee, and Sen. Mark Pryor, D-Ark.
The Bono Mack draft bill would require companies to notify the Federal Trade Commission and law enforcement within 48 hours and to begin notifying customers within 48 hours of when an incident assessment is completed, Bono Mack said June 15. The Rockefeller-Pryor bill, introduced the same day, would also require companies to safeguard sensitive data and inform customers in a timely manner in the case of a breach.
“If companies are going to collect and store consumers’ personal information, safeguarding that information should be priority No. 1,” said Pryor, noting that many companies have recently been hacked. “We need to pass strong security and notification standards before this problem spins further out of control,” Pryor said.
The bills come shortly after lawmakers and consumers bitterly berated Sony for taking so long to disclose a massive data breach in its PlayStation Network and related entertainment sites. Recent reports revealed that Citigroup also sat upon a data breach incident for at least three weeks.
At the House hearing, other lawmakers expressed concern that allowing companies to wait until the assessment is complete would result in stalling tactics. Mack said she is willing to discuss a certain “drop-dead” time, such as 60 days, within which companies have to report the breach. Organizations being too slow would face penalties from the Federal Trade Commission.
The Bono Mack bill could result in scenarios similar to what happened to Sony. Rep. Henry Waxman, D-Calif., noted that if this bill were law, Sony would still not be required to notify customers about the breach, since it is still in the process of assessing the data breach. Sony was hacked in mid-April.
Bono Mack, chairman of the House Subcommittee on Commerce, Manufacturing and Trade, called her bill “our opening shot.” Her Secure and Fortify Electronic Data bill closely tracks the bills from Energy and Commerce committees, but the class of companies subject to the law is much wider, including third-party data holders such as “contracted cloud providers.” Bono Mack also gave the FTC authority over nonprofit organizations, noting that they often posses “a tremendous amount” of consumer information.
Under the rule, companies would be required to erase personal data as soon as it’s not being used, eliminating the possibility of having it stolen in an attack. Companies would not have to notify law enforcement of the intrusion within 48 hours if the breach “is determined to be inadvertent” or would be unlikely to “result in harm,” according to the draft.
“The consequences of data breaches can be grave: identity theft, depleted savings accounts, a ruined credit score, and trouble getting loans for cars, homes and children’s education,” said Rockefeller.
The Rockefeller-Pryor bill would require businesses that store personal information to establish reasonable security policies and procedures to protect data.
“Companies that maintain vast amounts of consumer information need to have effective safeguards in place to keep sensitive consumer information secure,” Rockefeller said.