Leahy Urges Passage Of Data Privacy Bill
…Broadest Data Breach Underscores Need For Safeguards
To Protect Americans’ Privacy

WASHINGTON (Friday, March 30) -- Senator Patrick Leahy (D-Vt.), chairman of the Senate Judiciary Committee, Friday said the exposure of the largest data theft in U.S. history spotlights the need for action on comprehensive data privacy legislation.

Earlier this week, TJX announced a data breach which affected 47.5 million credit and debit card accounts.

“This latest breach underscores the serious threat that lax data security poses to Americans’ privacy,” said Leahy.  “While we now know more about this devastating data breach, the full scope of the damage to Americans’ privacy resulting from this theft remains unknown.  Meanwhile, our privacy laws continue to lag far behind the capabilities of both of today’s technology and the cunning of identity thieves.”  

“The TJX data breach is just the latest compelling example of why we need strong federal data privacy and security laws to better secure Americans’ sensitive personal data,” Leahy continued.  “The Senate Judiciary Committee in coming weeks will consider the Personal Data Privacy and Security Act, comprehensive data privacy legislation that Senator Specter and I reintroduced earlier this year, and the Congress should promptly act to pass this legislation this year.  We can and must do more to protect Americans’ most sensitive personal information.”

Earlier this year Leahy and Senator Arlen Specter (R-Pa.), the ranking member on the panel, reintroduced their Personal Data Privacy and Security Act, S. 495, to protect Americans’ privacy.  They introduced a similar bill in the last Congress following serious data breaches at ChoicePoint and LexisNexis.  Since then breaches at several other firms and within state and federal governments have also exposed millions of Americans to identity theft by leaking or losing their personal data, which included names, addresses, and sometimes Social Security numbers. 

Key features of the Leahy-Specter legislation include:

• Increasing criminal penalties for identity theft involving electronic personal data and making it a crime to intentionally or willfully conceal a security breach involving personal data

• Giving individuals access to, and the opportunity to correct, any personal information held by commercial data brokers;

• Requiring entities that maintain personal data to establish internal policies that protect the personal data of Americans;

• Requiring entities that maintain personal data to give notice to individuals and law enforcement when they experience a breach involving sensitive personal data; and

• Requiring the government to establish rules protecting privacy and security when it uses information from commercial data brokers, to conduct audits of government contracts with data brokers and impose penalties    on government contractors that fail to meet data privacy and security requirements.

# # # # #