The 4 Issues the group wants covered by federal data breach legislation:
- A flexible, scalable standard for data protection that factors in:
- the size and complexity of an organization
- the cost of available tools to secure data
- the sensitivity of the personal information an organization holds, as well as guarantees that small organizations are not burdened by excessive requirements.
- Notification when a reasonable risk exists. A notification regime requiring timely notice to impacted consumers, law enforcement, and applicable regulators when there is a reasonable risk that a breach of unencrypted personal information exposes consumers to identity theft or other financial harm.
- Consistent, exclusive federal enforcement of the new national standard by the Federal Trade Commission (FTC) and state Attorneys General, other than for entities subject to state insurance regulation or who comply with the Gramm-Leach-Bliley Act or the Health Insurance Portability and Accountability Act of 1996/HITECH Act. For entities under its jurisdiction, the FTC should have the authority to impose penalties for violations of the new law.
- Clear preemption of the existing patchwork of often conflicting and contradictory state laws.
The group supporting federal data security legislation:
ACT | The App Association
American Bankers Association
American Insurance Association
American Land Title Association
BSA | The Software Alliance
Consumer Bankers Association
Credit Union National Association CTIA
Electronic Transactions Association
Financial Services Roundtable
Independent Community Bankers of America
Independent Insurance Agents and Brokers of America
Internet Commerce Coalition
National Association of Federally-Insured Credit Unions
National Association of Mutual Insurance Companies
National Business Coalition on E-Commerce & Privacy
Property Casualty Insurers Association of America
Reinsurance Association of America
Retail Industry Leaders Association
TechNet
Twenty-First Century Privacy Coalition
USTelecom