Antitrust Law Daily Wrap Up, PRIVACY NEWS: Senator Nelson drafting legislation on data security, breach notification, (Jan 14, 2015)

By Brian Hammond,TRDaily

Sen. Bill Nelson (D., Fla.) yesterday said he planned to introduce legislation that would require companies to notify customers within 30 days if their personal data has been compromised, would direct the Federal Trade Commission to develop data security standards for businesses, and would preempt state data security and breach notification laws.

The announcement by the ranking member of the Senate Commerce Committee comes one day after President Obama called for legislation to address data breaches.

"How many more consumers will be affected before something is done?” Nelson asked. “Now is the time Congress must act.”

The draft Data Security and Breach Notification Act of 2015 would require companies to notify consumers of data breaches unless the company "determines there is no reasonable risk of identity theft, fraud, or unlawful conduct as a result of the breach." Notification would be required within 30 days unless it is "not feasible to provide such notice within that timeframe or unless the FBI or the Secret Service has notified the breached entity that notification would impede criminal investigation or national security."

The bill also would direct the Federal Trade Commission to develop security standards for businesses to use in protecting consumers' personal and financial data. The FTC would be directed to consider the "the size, nature, and scope of activities; existing state-of-the-art protections for such data; and the costs of implementation, including its effect on small businesses," the draft states.

The bill would authorize the FTC and state attorneys general to enforce its data security and breach notification provisions. Violations would be considered unfair or deceptive acts or practices under the FTC Act, thereby empowering the FTC to seek civil penalties in addition to its "full panoply of equitable remedies," the draft says. The bill would preempt state data security and breach notification laws.

To assist law enforcement, the bill also would require covered entities to report security breaches to a federal entity when the breach is "(1) is of a certain magnitude, (2) involves data bases owned by the federal government, or (3) involves information on personnel in national security or law enforcement." The Department of Justice would be authorized to enforce this provision of the bill, which would also establish criminal penalties for certain willful violations, it says.

Meanwhile, Sen. Tom Carper (D., Del.), ranking member of the Homeland Security and Governmental Affairs Committee, issued a statement supporting the president's proposed legislation on data breaches and promising to continue work on data breach legislation, such as the proposals he has previously developed with Sen. Roy Blunt (R., Mo.).

"The president’s announcement is an important call to action for Congress, the administration, and the various stakeholders to work together to strengthen our cyber networks, prevent future attacks, and protect consumers when a data breach does occur," Sen. Carper said. "I am hopeful that the Obama administration’s attention to this issue will encourage our colleagues to join us in taking the important steps forward we need in order to pass legislation that will better protect consumers and businesses in cyberspace. The longer we wait to act, the greater the risk of damage.”

News: Privacy