The draft Personal Data Privacy and Security Act of 2005 will
now move forward to a full Senate hearing.
The bill, sponsored by Senators Arlen Specter and Patrick Leahy,
will ensure that companies with databases containing personal
information on more than 10,000 US citizens establish and implement
data privacy and security programs and vet third-party contractors
hired to process data.
Under the bill, data brokers will generally be required to let
individuals know what information is held about them and, where
appropriate, allow individuals to correct demonstrated
inaccuracies. They will also be obliged to notify law enforcement
agencies, consumers and credit reporting agencies when digitised
sensitive personal data has been compromised.
The bill tackles the question of Government databases run by
private contractors, requiring an evaluation of potential
contractors involved in handling personal data; an audit of
commercial data brokers hired for projects involving personal data;
and a privacy impact assessment on the use of commercial databases
by federal departments.
Penalties should be included in Government contracts for failure
to protect data privacy and security, according to the draft.
The bill also sets out stiff monetary penalties for failing to
provide privacy and security protections and notices of security
breaches, and toughens criminal penalties for those who infiltrate
systems to compromise personal data.
It also imposes a criminal penalty in the cases were there is
intentional and wilful concealment of a security breach known to
require notice.
“This bill will ensure that our laws keep pace with technology,”
said Senator Leahy after the Committee vote. “In this
information-saturated age, the use of personal data has significant
consequences for every American. People have lost jobs, mortgages
and control over their credit and identities because personal
information has been mishandled or listed incorrectly.”
The bill is not the only data security legislation to be
discussed in Congress at present. The Senate Commerce Committee
recently approved the Identity Theft Protection Act, while the Data
Accountability and Trust Act is still at the Committee stage in the
House of Representatives.
The raft of legislation is a result of growing public concern
arising from serious data breaches over the past year – including
attacks on data brokers LexisNexis and ChoicePoint.
