Ever since California passed its groundbreaking data breach disclosure law (the famous California SB 1386) back in 2003, legislators across the country have been working on similar laws that would require companies to notify customers whose personal information has been compromised. Lawmakers in at least 37 other states have succeeded in passing similar legislation, creating what many businesses complain is a unruly patchwork of laws. Meanwhile, the U.S. Senate and House of Representatives are still trying to hammer out a federal version that everyone can agree on. Or at least live with.

Never ones to shirk a challenge, we at CSO wondered if our own readers couldn’t come up with a more perfect disclosure law than any of those proposals that are meandering through committees on Capitol Hill. Two attorneys from the law firm Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, which represents corporate clients in a range of industries, agreed to start the discussion at their itinerant blog on CSOonline.com, Security Legislation Sound Off. There, Cynthia Larose and Stefani Watterson, both of whom are certified information privacy professionals, got the debate rolling with a couple lists of what the legislation might contain and asked readers to weigh in on how to craft the act.

What follows are three pieces: The product of all this feedback from legal and security experts, what we're proposing as the Personal Data Privacy Act. Two other pieces follow to expalin the points the experts debated.

The Personal Data Privacy Act, a Proposal

Incorporating feedback from CSO readers at CSOonline.com, and proposed by attorneys Cynthia Larose and Stefani Watterson of the law firm Mintz, Levin.

Purpose: To prevent the use of personally identifiable information in a way that is harmful to individuals and to provide for notice in the event of a breach of such information.

Definitions: 1. Business or businesses. All organizations (including, but not limited to, incorporations, partnerships, limited liability companies, sole proprietorships) engaged in interstate commerce.

2. Personally identifiable information. The name of an individual used in combination with Social Security number, driver’s license number, passport number and two of the following: address, account number, date of birth, mother’s maiden name or a unique biometric identifier.

3. Data breach. Unauthorized access to personally identifiable information that results in, or could result in, inappropriate use of the data. This does not include good faith acquisition of data.

Data breach notification: Any business that uses, stores or transfers personally identifiable information must notify all individuals whose personally identifiable information is compromised through a data breach. Notification must occur within 30 days of the breach and must be by either mail, phone or electronic means.