The U.S. Senate Judiciary Committee has approved two bills that would require organizations with data breaches to report them to potential victims.
The Judiciary Committee on Thursday voted to approve both the Personal Data Privacy and Security Act and the Data Breach Notification Act by large majorities.
[ Get insight on the latest tech business trends with InfoWorld's Tech's Bottom Line blog. ]
The Data Breach Notification Act, sponsored by Senator Dianne Feinstein, a California Democrat, would require U.S. agencies and businesses that engage in interstate commerce to report data breaches to victims whose personal information "has been, or is reasonably believed to have been, accessed, or acquired."
Feinstein's bill would also require agencies and businesses to report large data breaches to the U.S. Secret Service
The Personal Data Privacy and Security Act would also require that organizations that maintain personal data give notice to potential victims and law-enforcement authorities when they have a data breach. It would increase criminal penalties for electronic-data theft and allow people to have access to, and correct, personal data held by commercial data brokers.
The second bill, sponsored by Senator Patrick Leahy, the Judiciary Committee chairman and a Vermont Democrat, would also require the U.S. government to establish rules protecting privacy and security when it uses information from commercial data brokers.
Several tech groups have called for the U.S. Congress to pass national data-breach notification legislation. Since a series of high-profile data breaches in early 2005, about 45 states have passed data-breach notification laws.
It's difficult for companies to comply with the separate state laws, officials from cybersecurity product vendor Symantec have said.
Symantec CEO Enrique Salem sent a letter to the committee Wednesday in support of the Leahy data-breach bill.
The Leahy bill "is a major step forward towards enacting a comprehensive, uniform national framework to better prevent breaches of sensitive consumer information as well as setting a clear standard for effective notification should a breach occur," Salem wrote.
Symantec supports the bill's language saying that if personal data is encrypted or otherwise rendered unusable, organizations don't have to report the data breach, the letter said. The committee has recognized "there are widely accepted industry best practices and standards for data security that companies can look to as a road map for compliance when protecting electronic data," Salem wrote.
The Business Software Alliance, a trade group, also praised the committee for approving both bills.
"In recent years, hundreds of millions of individual records containing sensitive personal information have been involved in computer security breaches," BSA President and CEO Robert Holleyman said in a statement. "The frequency and severity of data breaches have prompted more than 45 states to pass data security laws, creating a confusing patchwork quilt of regulations."
Both bills now head to the full Senate for votes. The timeline for action in the Senate is unclear.
Get the independent advice and expertise you need to support a virtual workforce.
The increase in Linux popularity has increased the frequency and sophistication of malware attacks. Read this 2 page white paper now to learn how you can protect your Linux environment with real-time protection that is certified by all major Linux vendors.
Download now »
Ensuring acceptable application delivery will become even more difficult over the next few years. As a result, IT organizations need to ensure that the approach that they take to resolving the current application delivery challenges can scale to support the emerging challenges. This handbook elaborates on the key tasks associated with planning, optimization, management and control and provides decision criteria to help IT organizations choose appropriate solutions.
Download now »
A common misconception is that mid-range storage requirements are dramatically different than that of a larger enterprise. Mid-range storage users may require less capacity, but they have similar functionality and management requirements. This ESG paper examines mid-range storage needs and reviews a new solution that adjusts size while retaining value, performance and functionality.
Download now »
Sign up to receive InfoWorld Resource Alerts
This white paper provides guidance on how to develop a strategic approach to managing and monitoring logs, a key function required for compliance with many regulatory mandates and a critical defense against security threats.
Download now! »
Learn about the processes and technologies that support security information management (SIM) operations, as well as the business case for SIM. The series examines different options for implementing SIM and gives you evaluation criteria for selecting the best option for your organization.
Download now! »
Learn the strategies, actions, and capabilities that Best-in-Class organizations employ and technologies they choose to obtain superior performance against various security performance metrics. This report provides guidelines for identifying which security solutions to consume as a MSS and defines best practices for choosing and managing MSSPs.
Download now! »
15 Recommendations
