Antitrust Law Daily Wrap Up, PRIVACY NEWS: Governors, state AGS urge Congress to preserve state authority over data breach, security, (Jul 8, 2015)

By John Curran and Brian Hammond, TRDaily

Several state governors and attorneys general from 47 states have sent separate letters to Congressional leaders, requesting that federal legislation on data breach notification and security not sweep away state laws that have been used to protect citizens for a decade.

In a July 7 letter sent by the National Association of Attorneys General, the state AGs noted that Congress is taking steps to pass a national standard for data breach notification but that federal and state enforcement would be the optimal approach. Any additional protections afforded consumers by a federal law “must not diminish the important role states already play protecting consumers from data breaches and identity theft,” the letter stated.

“To ensure that federal breach notification law is effective and consumers are afforded the best protection, it is crucial that state attorneys general maintain their enforcement authority under their states’ laws, and that any legislation be tailored to ensure complementary enforcement authority,” the AGs asserted.

Since 2003, states have played a critical role in investigating and enforcing data security lapses and responding to identity theft and consumer fraud, the letter maintained. The Illinois Attorney General has helped more than 38,000 state residents remove more than $27 million in unauthorized charges from their accounts. “Preempting state law would make consumers less protected than they are right now,” wrote the AGs. “Our constituents are continually asking for greater protection. If states are limited by federal legislation, we will be unable to respond to their concerns.”

Earlier this year, Reps. Randy Neugebauer (R., Texas) and John Carney (D., Del.) introduced the Data Security Act of 2015, which they said would establish a national data security and breach notification standard for financial institutions and retailers to better protect consumer financial data. The bill would preempt state data breach and notification laws, and would give the Federal Trade Commission enforcement authority for the new law.

A bill introduced in the Senate in May by Sen. Patrick Leahy (D., Vt.), ranking member of the Senate Judiciary Committee, would create new obligations for private sector entities to formulate and meet data security and privacy standards in order to safeguard against breaches of consumer data, along with rules to notify consumers if breaches occur. It would also preempt state data breach notification laws that are weaker than the provisions of the federal bill, but would not do so in the case of state laws with stronger provisions.

The National Governors Association (NGA) said it also wrote to House and Senate leaders, urging that any federal cybersecurity legislation support state efforts to protect consumers, government networks, and critical infrastructure.

The NGA asked that any legislation to establish a national data breach notification standard “maintain states’ ability to enforce civil penalties for violations and provide additional protections in state statute if desired.”

The NGA also said that federal efforts to encourage the private sector to share information on cyber threats with the federal government should also improve information sharing with state and local authorities.

Finally, the governors urged Congress to “continue to support efforts of the Army and Air National Guard to build cyber mission forces,” adding that the National Guard is a “cost-effective force uniquely positioned to leverage private sector cybersecurity skills while supporting federal and state needs.”

The letter was signed by Chair and Vice Chair of the NGA Homeland Security & Public Safety Committee—Michigan Governor Rick Snyder and Virginia Governor Terry McAuliffe—as well as the co-chairs of the Council of Governors—Iowa Governor Terry Branstad and Connecticut Governor Dannel Malloy.

News: Privacy