July 29, 2005
After a year in which millions of Americans have been put at risk of identity theft because of a series of data security breaches, Congress is exploring legislative remedies. The Senate Judiciary Committee has begun consideration of S. 1408, the Identity Theft Protection Act.
The measure would require data brokers and others covered by the law to develop, implement, and maintain an effective information security program to protect sensitive information. The safeguards include encryption, truncation, and other security measures currently available or under development.
The law would also require data brokers to immediate report security breaches compromising 1,000 or more consumers to federal officials and consumer agencies. Currently there is no federal requirement in that regard, and state laws vary. California requires notification but most other states do not.
While the proposed law fills several glaring gaps in data security, some consumer groups claim it doesnt go far enough, and have expressed concern about intense lobbying by industry groups.
Consumers Union charges industry lobbyists are fighting to block a new right for consumers to freeze access to credit files, stricter rules regarding data security, mandatory notices of all security breaches, and the ability of states to provide stronger identity theft protections.
"If lobbyists working for big financial companies and the data broker industry get their way, consumers may be left in the dark when sensitive information about them is lost or stolen due to lax security," said Consumer Unions Susanna Montezemolo.
"Consumers are counting on Congress to resist pressure from industry groups and provide meaningful protection against the growing threat of identity theft."
Among the protections consumer groups say they want to see in the bill are stricter data security rules, special protection for Society Security numbers, and the right of all consumers to freeze their credit files, preventing anyone from looking at them.
