WASHINGTON – Congressman Bart Gordon and his colleagues approved bipartisan legislation to require companies holding sensitive personal information to secure that data and provide notice to American consumers when that data is compromised.
“According to a recent report, almost 340 million records containing ‘sensitive personal information’ have been ‘involved in security breaches since January 2005’,” said Gordon. “It is essential that consumers’ personal information, whether it is collected online or through other means, is safe.”
The House-passed bill, the Data Accountability and Trust Act (H.R. 2221), directs the FTC to create rules requiring any person involved in interstate commerce who owns or possesses data containing personal information, or has a third party maintaining the data, to create procedures regarding information security practices to protect personal information. The practices include a security policy to collect, sell, and maintain the information, a point of contact responsible for the management of information, and a process to assess any system vulnerabilities.
“If there is a security breach of any kind,” Gordon stated, “this bill will not only better protect consumers’ personal information, but it will also require data companies to notify each individual whose personal information has been acquired by an unauthorized person.”
With limited exceptions, all security breach notifications would have to be made to each individual consumer within 60 days and the FTC would also have to be notified. If online companies did not comply with the bill’s new regulations, they could face a fine of $5 million for each violation.
The bill was written and approved by the House Energy and Commerce Committee’s Subcommittee on Commerce, Trade and Consumer Protection, of which Gordon is a member. Having passed the House, the bill will now move to the Senate for consideration.
