House passes Data Breach legislation… jury still out
The U.S. House of Representatives has passed HR 2221, the Data Accountability and Trust Act. This sets nationwide breach notification requirements that trump the patchwork of State laws that have been in effect with California leading the way in 2002. The passage was written about in a Federal Computer Week article “House passes bill to require data breach notifications“.
Overall, standardizing the definition of Personally Identifiable Information will help in protecting the data. This is a good thing as some states have more stringent definitions than others. Data brokers have greater requirements. Also a good thing.
The problem I see comes from the FTC having jurisdiction over the new law. The FTC does not have authority to enforce regulations on government, banks, savings and loans, insurance industry and non-profits which would include higher education and some healthcare environments. These industries are often the victims of data breaches yet they aren’t covered by this new federal law.
We’ve seen the FTC extend its reach with the Red Flags rule and perhaps they will follow suit with the new data breach notification legislation. If they let some industries with known disclosure issues slip through the cracks then the overall effectiveness of the legislation is diminished.
