Feeds

US moves forward on data privacy

Draft law heads for full Senate hearing

Choosing a cloud hosting partner with confidence

A draft US law to increase the security and privacy of personal information held by companies took a step forward last week, when it was approved by the influential Senate Judiciary Committee. The bill includes a duty to disclose security breaches.

The draft Personal Data Privacy and Security Act of 2005 will now move forward to a full Senate hearing.

The bill, sponsored by Senators Arlen Specter and Patrick Leahy, will ensure that companies with databases containing personal information on more than 10,000 US citizens establish and implement data privacy and security programs and vet third-party contractors hired to process data.

Under the bill, data brokers will generally be required to let individuals know what information is held about them and, where appropriate, allow individuals to correct demonstrated inaccuracies. They will also be obliged to notify law enforcement agencies, consumers and credit reporting agencies when digitised sensitive personal data has been compromised.

The bill tackles the question of Government databases run by private contractors, requiring an evaluation of potential contractors involved in handling personal data; an audit of commercial data brokers hired for projects involving personal data; and a privacy impact assessment on the use of commercial databases by federal departments.

Penalties should be included in Government contracts for failure to protect data privacy and security, according to the draft.

The bill also sets out stiff monetary penalties for failing to provide privacy and security protections and notices of security breaches, and toughens criminal penalties for those who infiltrate systems to compromise personal data.

It also imposes a criminal penalty in the cases were there is intentional and wilful concealment of a security breach known to require notice.

"This bill will ensure that our laws keep pace with technology," said Senator Leahy after the Committee vote. "In this information-saturated age, the use of personal data has significant consequences for every American. People have lost jobs, mortgages and control over their credit and identities because personal information has been mishandled or listed incorrectly."

The bill is not the only data security legislation to be discussed in Congress at present. The Senate Commerce Committee recently approved the Identity Theft Protection Act, while the Data Accountability and Trust Act is still at the Committee stage in the House of Representatives.

The raft of legislation is a result of growing public concern arising from serious data breaches over the past year - including attacks on data brokers LexisNexis and ChoicePoint.

See: The draft Personal Data Privacy and Security Act of 2005 (S.1789) (63-page / 119KB PDF)

Copyright © 2005, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Remote control for virtualized desktops

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.