Congress Has New Data Security Bill Moving. 5 Highlights.

Bipartisanship Lives. Last week a new data security bill was unvieled to create standardized requirements for data breach and security issues. 

Co-sponsors of the bill:

  • Representative Marsha Blackburn (R-TN)
  • Representative Peter Welch (D-VT)
  • Both are members of the House Subcommittee on Commerce, Manufacturing, and Trade, and Blackburn also serves as Vice Chairman of the Energy and Commerce Committee.

The Bill is Titled: “Data Security and Breach Notification Act of 2015. 

What the bill does:

  • Companies would be required to use “reasonable security measures” to protect an individual’s personal information. 
  • Companies would be required “to notify affected individuals as “expeditiously as possible” but no later than 30-days after the company has taken the “necessary measures to determine the scope of the breach and restore reasonable integrity, security, and confidentiality of the data system,” unless the delay is attributed to law enforcement or national security reasons.  ” 
  • No individual notice obligation if there was no reasonable risk that the breach of security resulted in, or would result in, identity theft, economic loss or harm, or financial fraud.
  • Effectively preempt the current patchwork of state statutes governing data breach notification and data security.  
  • Enforcement:
    • A violation of this legislation would constitute an unfair and deceptive act or practice
    • Federal Trade Commission or state attorneys general would have authority to enforce.  
    • civil penalties for violations of the data security and breach notification requirements.  

National Law Review

Do Data Security Regulations Harm Productivity? Old Business vs. New Business

European companies are struggling with the 28 different data security laws that the EU has enacted for each of its member countries. Multinational companies have different compliance standards for each country. 

However, an attorney for technology and innovation sector says data regulations, even those that differ by member state increase productivity in fields of innovation and technology. This productivity increases due to the globalization of data.

Computer Weekly

Financial Institution Sues Retailer Over Data Breach

An Illinois Credit Union has sued Kamart/Sears over a 2014 data breach because the retailers reaction to a data breach harmed financial institutions. Here’s why, note same thing can happen in Texas:

  • The financial institutions were required:
    • to refund fraudulent charges
    • respond to a higher volume of customer complaints, and
    • increase fraud monitoring efforts
  • The financial institutions lost revenue
  • The retailers failed to maintain adequate data security under applicable payment card industry standards
  • The retailer delayed notification to consumers by at least 5 weeks. 
  • The causes of actions rooted in :
    • Illinois Personal Information Protection Act,
    • Consumer Fraud and Deceptive Business Act,
    • New York General Business Law,
    • negligence, and negligent misrepresentation and/or omission.​

JDSupra InfoBytes Blog

Education Apps Make Student Data Security Vulnerable

What kind of information can hackers get from a student’s education app?

  • first name, middle initial, last name,
  • gender
  • date of birth
  • parent email address
  • name and address of school
  • usernames (some with associated passwords)
  • teacher email addresses
  • teacher and class roster affiliations
  • class photos with students labeled by name,
  • in-class behavior records,
  • reading level and progress assessments, and math skill and progress assessments.

An identity could easily be created with this information, which sparked Congress to address the situation with the Student Digital Privacy and Parental Rights Act. 

States can address the situation by requiring data security protocols on stored student data and for third party education software and apps.   EdSurge

Lege Trend: Attorney General Forms Data Security Department

To handle data breach investigations and litigation, the Connecticut Attorney General created a Privacy and Data Security Department.

The Department emerged from a 2011 task force studying how the state can best address data breaches, and is staffed with a ” cross-disciplinary team of experts in health, finance and other disciplines.” 

Westfair Communications