Feeds

US moves forward on data privacy

Draft law heads for full Senate hearing

Internet Security Threat Report 2014

A draft US law to increase the security and privacy of personal information held by companies took a step forward last week, when it was approved by the influential Senate Judiciary Committee. The bill includes a duty to disclose security breaches.

The draft Personal Data Privacy and Security Act of 2005 will now move forward to a full Senate hearing.

The bill, sponsored by Senators Arlen Specter and Patrick Leahy, will ensure that companies with databases containing personal information on more than 10,000 US citizens establish and implement data privacy and security programs and vet third-party contractors hired to process data.

Under the bill, data brokers will generally be required to let individuals know what information is held about them and, where appropriate, allow individuals to correct demonstrated inaccuracies. They will also be obliged to notify law enforcement agencies, consumers and credit reporting agencies when digitised sensitive personal data has been compromised.

The bill tackles the question of Government databases run by private contractors, requiring an evaluation of potential contractors involved in handling personal data; an audit of commercial data brokers hired for projects involving personal data; and a privacy impact assessment on the use of commercial databases by federal departments.

Penalties should be included in Government contracts for failure to protect data privacy and security, according to the draft.

The bill also sets out stiff monetary penalties for failing to provide privacy and security protections and notices of security breaches, and toughens criminal penalties for those who infiltrate systems to compromise personal data.

It also imposes a criminal penalty in the cases were there is intentional and wilful concealment of a security breach known to require notice.

"This bill will ensure that our laws keep pace with technology," said Senator Leahy after the Committee vote. "In this information-saturated age, the use of personal data has significant consequences for every American. People have lost jobs, mortgages and control over their credit and identities because personal information has been mishandled or listed incorrectly."

The bill is not the only data security legislation to be discussed in Congress at present. The Senate Commerce Committee recently approved the Identity Theft Protection Act, while the Data Accountability and Trust Act is still at the Committee stage in the House of Representatives.

The raft of legislation is a result of growing public concern arising from serious data breaches over the past year - including attacks on data brokers LexisNexis and ChoicePoint.

See: The draft Personal Data Privacy and Security Act of 2005 (S.1789) (63-page / 119KB PDF)

Copyright © 2005, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Intelligent flash storage arrays

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.