Feeds

US moves forward on data privacy

Draft law heads for full Senate hearing

Protecting against web application threats using SSL

A draft US law to increase the security and privacy of personal information held by companies took a step forward last week, when it was approved by the influential Senate Judiciary Committee. The bill includes a duty to disclose security breaches.

The draft Personal Data Privacy and Security Act of 2005 will now move forward to a full Senate hearing.

The bill, sponsored by Senators Arlen Specter and Patrick Leahy, will ensure that companies with databases containing personal information on more than 10,000 US citizens establish and implement data privacy and security programs and vet third-party contractors hired to process data.

Under the bill, data brokers will generally be required to let individuals know what information is held about them and, where appropriate, allow individuals to correct demonstrated inaccuracies. They will also be obliged to notify law enforcement agencies, consumers and credit reporting agencies when digitised sensitive personal data has been compromised.

The bill tackles the question of Government databases run by private contractors, requiring an evaluation of potential contractors involved in handling personal data; an audit of commercial data brokers hired for projects involving personal data; and a privacy impact assessment on the use of commercial databases by federal departments.

Penalties should be included in Government contracts for failure to protect data privacy and security, according to the draft.

The bill also sets out stiff monetary penalties for failing to provide privacy and security protections and notices of security breaches, and toughens criminal penalties for those who infiltrate systems to compromise personal data.

It also imposes a criminal penalty in the cases were there is intentional and wilful concealment of a security breach known to require notice.

"This bill will ensure that our laws keep pace with technology," said Senator Leahy after the Committee vote. "In this information-saturated age, the use of personal data has significant consequences for every American. People have lost jobs, mortgages and control over their credit and identities because personal information has been mishandled or listed incorrectly."

The bill is not the only data security legislation to be discussed in Congress at present. The Senate Commerce Committee recently approved the Identity Theft Protection Act, while the Data Accountability and Trust Act is still at the Committee stage in the House of Representatives.

The raft of legislation is a result of growing public concern arising from serious data breaches over the past year - including attacks on data brokers LexisNexis and ChoicePoint.

See: The draft Personal Data Privacy and Security Act of 2005 (S.1789) (63-page / 119KB PDF)

Copyright © 2005, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.