Antitrust Law Daily Wrap Up, PRIVACY NEWS: Senate bill would impose new private sector data privacy, security obligations, (May 1, 2015)
By John Curran,TRDaily
A bill introduced in the Senate today by Sen. Patrick Leahy (D., Vt.), ranking member of the Senate Judiciary Committee, would create new obligations for private sector entities to create and meet data security and privacy standards in order to safeguard against breaches of consumer data, along with rules to notify consumers if breaches occur.
The Consumer Privacy Protection Act of 2015 –which is also sponsored by Sens. Al Franken (D., Minn.), Elizabeth Warren (D., Mass.), Richard Blumenthal (D., Conn.), Ron Wyden (D., Ore.), and Edward Markey (D., Mass.)—would require companies that store personal or financial data on more than 10,000 customers “to meet consumer privacy and data security standards to keep this information safe,” and to notify customers within 30 days of a breach, absent law enforcement intervention that would allow for a lengthier notification period.
The text of the bill does not provide for any specific technical measures to be taken, but says companies who meet the 10,000 customer-data threshold “shall implement a comprehensive consumer privacy and data security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity, and the nature and scope, of the activities of the covered entity.”
The security program, it says, shall be designed to “ensure the privacy and security of sensitive personally identifying information,” protect against “any anticipated vulnerabilities to the privacy and security” of the data, protect against unauthorized access, acquisition, disclosure, or use of the data, and evaluate the risk of any of unauthorized disclosures. A covered entity also would have to “assess the sufficiency of its technical, physical, and administrative controls in place to control and minimize risks” of unauthorized disclosure.
Privacy and data security programs would have to be developed with one year of the bill becoming law.
Exempted from the requirements of the bill would be financial institutions that are in compliance with the Gramm-Leach-Bliley Act, entities in compliance with the data security requirements of the Health Insurance Portability and Accountability Act and the Health Information Technology for Economic and Clinical Health Act, and communications service providers engaged solely in the transmission, routing, or storage of communications.
The Department of Justice, the FTC, and state authorities would have the right to enforce the law, and penalties for violations could run as high as $5 million, with an additional $5 million possible for willful violations.
The bill would preempt state laws that are weaker than the provisions of the federal bill, but would not do so in the case of state laws with stronger provisions. It contains a safe-harbor provision if the data being protected is rendered unusable to a third party by encryption or other technological means.
Information that must be protected under the proposal includes Social Security numbers, financial account data, online user names and passwords, “unique biometric data” including fingerprints, “information about a person’s physical and mental health,” geolocation data, and access to private digital photos and videos.
The bill also would require notification to the federal government of large data breaches.
“Today, data security is not just about protecting our identities and our bank accounts; it is about protecting our privacy. Americans want to know not just that their bank account and credit cards are safe and secure, they want to know that their emails and their private pictures are protected as well,” said Sen. Leahy in a statement.
Other data breach bills pending in Congress include the Data Security Act of 2015 introduced in the Senate earlier this month, and the Data Security and Breach Notification Act of 2015 (HR 1770), which has been approved by the House Energy and Commerce Committee.
News: Privacy