U.S. lawmakers push for data privacy legislation

WASHINGTON - Following the disclosure of two recent large-scale identity theft operations, the U.S. data brokerage industry will most likely face new laws this year governing what personal data it collects and shares, several U.S. lawmakers said Tuesday.

As the chief executives of ChoicePoint and a LexisNexis division looked on, nearly all the members of a House of Representatives subcommittee blasted the companies for collecting personal data and sharing it with other companies without telling the people whose data is being collected. Since mid-February, both companies have disclosed that identity thieves have stolen the personal information of tens of thousands of U.S. residents.

Representative Joe Barton, chairman of the House Energy and Commerce Committee, called such security breaches "intolerable," and he promised to look into legislation that would regulate data brokers, including a ban on the sale of Social Security numbers without the permission of the owner of the number, except when needed by law enforcement.

In the Internet age, ID thieves have easy access to personal information such as bank records contained in huge databases operated by data brokers, said Barton, a Texas Republican. "Under current law, anyone has a near-perfect right to package your personal information and do almost anything they want with it," he said. "They can change it, share it, rent it or sell it. The constraints are so flimsy they're laughable."

The two companies' chief executives seemed to disagree, saying most of the personal information they collect is governed by the U.S. Fair Credit Reporting Act, which allows individuals to check their credit records and ask credit reporting agencies to make corrections.

A law that would prohibit almost all sales of Social Security numbers could hamper financial institutions investigating fraud, bill collection companies and law enforcement investigations, said Derek Smith, chairman and chief executive officer (CEO) of ChoicePoint, and Kurt Sanford, president and CEO of U.S. Corporate and Federal Government Markets at LexisNexis. In some cases, consumers may not give explicit permission for a data broker to share their Social Security numbers in transactions that benefit them, such as pre-employment background checks, Smith said.

Smith told lawmakers that his company provides a valuable service to lenders, insurance companies and even law enforcement agencies hunting down criminals. ChoicePoint has done "some serious soul-searching" since its breach and has decided that it should have acted more quickly when it discovered the breach, he said.

"Every advance in technology that makes our lives easier also makes it easier for our enemies to move swiftly against us," Smith said. "You and I can be approved for a bank account in a matter of minutes, but a person can use that same technology to get a false or real drivers' license or to create a fake business." In February, ChoicePoint disclosed that up to 145,000 U.S. residents are potential victims of an ID theft scheme, discovered in September, in which thieves set up a bogus business that requested background checks from ChoicePoint.

This month, LexisNexis' parent company, Reed Elsevier PLC, announced that hackers compromised databases and stole the personal information of at least 32,000 people. The company is still investigating how thieves gained access to passwords that allowed them into a LexisNexis database, Sanford said.