How to Protect Consumer Data Privacy: A Proposal

CSO conducted an online discussion forum among legal and security experts, with some consumers weighing in, and came up with a proposal for a national data breach privacy law.

Ever since California passed its groundbreaking data breach disclosure law (the famous California SB 1386) back in 2003, legislators across the country have been working on similar laws that would require companies to notify customers whose personal information has been compromised. Lawmakers in at least 37 other states have succeeded in passing similar legislation, creating what many businesses complain is a unruly patchwork of laws. Meanwhile, the U.S. Senate and House of Representatives are still trying to hammer out a federal version that everyone can agree on. Or at least live with.

Never ones to shirk a challenge, we at CSO wondered if our own readers couldn’t come up with a more perfect disclosure law than any of those proposals that are meandering through committees on Capitol Hill. Two attorneys from the law firm Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, which represents corporate clients in a range of industries, agreed to start the discussion at their itinerant blog on CSOonline.com, Security Legislation Sound Off. There, Cynthia Larose and Stefani Watterson, both of whom are certified information privacy professionals, got the debate rolling with a couple lists of what the legislation might contain and asked readers to weigh in on how to craft the act.

What follows are three pieces: The product of all this feedback from legal and security experts, what we're proposing as the Personal Data Privacy Act. Two other pieces follow to expalin the points the experts debated.

The Personal Data Privacy Act, a Proposal

Incorporating feedback from CSO readers at CSOonline.com, and proposed by attorneys Cynthia Larose and Stefani Watterson of the law firm Mintz, Levin.

Purpose: To prevent the use of personally identifiable information in a way that is harmful to individuals and to provide for notice in the event of a breach of such information.

Definitions: 1. Business or businesses. All organizations (including, but not limited to, incorporations, partnerships, limited liability companies, sole proprietorships) engaged in interstate commerce.

2. Personally identifiable information. The name of an individual used in combination with Social Security number, driver’s license number, passport number and two of the following: address, account number, date of birth, mother’s maiden name or a unique biometric identifier.

3. Data breach. Unauthorized access to personally identifiable information that results in, or could result in, inappropriate use of the data. This does not include good faith acquisition of data.

Data breach notification: Any business that uses, stores or transfers personally identifiable information must notify all individuals whose personally identifiable information is compromised through a data breach. Notification must occur within 30 days of the breach and must be by either mail, phone or electronic means.

Safe harbor: Notification is not required if a business meets the industry standard for methods of encryption and the business has taken preventive measures to secure its systems and data.

Preventive measures: Businesses can meet the safe harbor if they have taken the following preventive measures:

1. Adopted established industry standards for data security and encryption.

2. Implemented an internal data security program that includes regular internal and external audits.

3. Implemented a regular employee education and training program to raise awareness of data security issues.

Use of Social Security numbers: By the year _____, businesses must phase out the use of Social Security numbers as a method of identification.

Enforcement: The attorney general or state attorneys general may bring a civil action against any business that violates the provisions of this act. Fines for violations shall not exceed $1,000 per day per individual whose personally identifiable information has been compromised. The maximum penalty per violation shall be $1,000,000.

No private cause of action: This act does not establish a private cause of action against any business for violations of the act.

Relation to state law: This act shall supersede any state law relating to ­notification of breach of personally­identifiable information.

Part II: A Summary of Issues Businesses Could Consider in Data Breach Disclosure

From the perspective of businesses, Larose and Watterson suggested that the law might include:

  • Clear definitions of what is and what is not a “breach.”
  • Clear standards for how and when notification is to be provided.
  • Clear standards regarding who must provide notification—data owners or the party responsible for the breach.
  • A notification trigger that allows determination of possibility of harm or misuse of the data before notification is required.
  • “Safe harbor” or exclusion if encrypted data is compromised.
  • No private right of action. Enforcement by the Federal Trade Commission under FTC-promulgated rules (like Gramm-Leach-Bliley and Can-Spam).
  • Clear federal preemption of all similar state laws.
Part III: A Summary of Issues Consumers Care About in Breach Disclosure

From the perspective of consumers, Larose and Watterson suggested some requirements and definitions:

  • Companies must notify all individuals whose personal information is compromised.
  • Notification must occur by written means (electronic or by mail) without unreasonable delay. Companies must implement notification procedures and review and update those procedures if necessary on an annual basis.
  • “Companies” includes all entities and individuals conducting interstate transactions that request or store ­personal information.
  • “Personal information” includes the first and last name of an individual, with one or more of the following: date of birth, Social Security number, account number and driver’s license number.
  • Following notification to individuals of the breach, companies must take ­reasonable steps to change the ­personal information to prevent unauthorized use of it.
  • Notification should be required ­without regard to whether there is the possibility for harm.
  • Private right of action and civil ­penalties for failure to comply.
  • No preemption of more stringent or more protective state laws.

To read the debate among business representatives and consumer privacy advocates, visit CSOonline.com's online discussion.

One especially contentious point that emerged: whether businesses must disclose a breach of personal information that was encrypted.

Even those who didn’t completely object to some kind of exception for encrypted information raised concerns about how quickly encryption techniques change.

Another common thread was the need for legislators to address—in this law or elsewhere—the fact that a few bits of personal information can be so easily obtained and then misused by someone looking to commit identify fraud. “The best defense against data being stolen is data not being gathered in the first place,” wrote one poster. “Use of SSNs in any database should be strictly limited to information reported to the [Social Security Administration] or [Internal Revenue Service].”

Based on the dozens of often conflicting comments at CSOonline.com, Larose and Watterson bravely proffer this proposal. Whether their effort matches some of the more pro-consumer comments on the site is open to further discussion. As much as anything, the process underscores the challenge facing legislators. They won’t be able to come up with a national disclosure law that makes everyone happy. We can’t say that even this one makes any of us at CSO happy, exactly—but we’re glad to have given readers and our expert commentators a chance to weigh in.

This story, "How to Protect Consumer Data Privacy: A Proposal" was originally published by CSO.

Related:

Copyright © 2007 IDG Communications, Inc.

Survey says! Share your insights in our 19th annual State of the CIO study