Welcome to the Future!
Strong economies rely on investor confidence. According to a poll by the Center for Audit Quality, increased data security regulation leads to improved investor confidence.
Investor confidence in the U.S. economy stands at 70%. [Journal of Accountancy]
Early this year privacy advocates had a win when ICE retracted its planned policy to allow access to a national law enforcement license-plate tracking system.
Local ICE offices didn’t like this. So, they started buying access to a private company’s vehcile registration database. Houston ICE office is noted as buying the private company’s vehicle database.
On going criminal investigations, where constitutional protections apply, are one thing, but open access to a private company’s vehicle registration database is concerning to privacy rights adovates and civil libertarians. [Washington Post]
A New Jersey data security bill is called best practices for businesses and government, but also increases the costs of government and of doing business.
The bill would require notification for more data breaches. Like most states notification in New Jersey was required for traditional indentify fraud issues- like when a name and social security number are released.
The new legidslation requires disclosure of a breach if usernames and email addresses, in combination with a password or security question-and-answer, are released or captured. [Philadelphia Business Journal]
Washington Post points out that local regulations on ride share continuously forego obtianing access to anonymized ride share data. Its the same data local governments collect from taxicab drivers.
The data serves two purposes.
(1) It strengthens transportation systems and gives tools for transportation planners, and
(2)It provides an understadning of how many jobs ride share is creating. [Washington Post]
Lots of nobel bills become studies and reports when the opposition is vocal. For the last years, the Attorney General of California has released data breach reports.
In 2013, there were 167 breaches reported to the California Attorney General, exposing data of 18.5 Million Californians.
The California Attorney General also makes the following recommendations:
For the health care industry:
– Use strong encryption to protect medical information on laptops and on other portable devices, and consider encryption for desktop computers.
For the Legislature:
– Consider legislation to amend the breach notice law in order to strengthen the substitute notice procedure; clarify the roles and responsibilities of data owners and data maintainers; and require a final breach report to the Attorney General.
– Consider legislation to provide funding to support system upgrades for small California retailers.
Data Breach Legislation History from California:
“In 2003, California was the first state to pass a law (AB 700, Simitian) mandating data breach notifications. This law requires businesses and state agencies to notify Californians when their personal information is compromised in a security breach.
In 2012, companies and state agencies subject to the law were also required, for the first time, to report any breach that involved more than 500 Californians to the Attorney General’s Office. (SB 24, Simitian).” [Lake County News]
Does this sound familiar? A state entity sends unecrypted names and social security numbers? Yes, much like the Texas Comptroller incident, a Pension system in Arizona sent unecrypted filed in regular mail to a third party provider.
The third party provider never received the unecrypted disks. Now, the state is spending $300,000 to provide indentity protection for the affected retirees. [News 4 Tucson]
Canada is considering imposing $100,000 fines on businesses that fail to notify customers of data breaches. Currently Canada utilizes a regional patch work of data security legislation, the national fine for businesses would be a first for Canada. [Info Security Magazine]
Refreshing Recollection: The FCC can and does impose fines on businesses, like it did on two telecom companies late last week.
RollCall argues that the down side of hightened data security legislation is that it makes consumers complacent. Consumers aren’t encouraged or empowered to protect their own personal data. Are more regulations on business the answer to data security? [Roll Call]
New Jersey Legisalture is moving a bill that would place new burdens on business and government in the Garden State.
Businesses & government would be required to maintain databases that allow quick contact to customers/clients/citizens in case of a data breach.
The bill also expands the type of breaches that have to be disclosed to include usernames and passwords. [NJ A3146]
Florida passed a data security bill earlier this year. A Republican in a neighboring state, Alabama, is filing legislation to require companies and financial institutions to disclose to customers when their personal information is exposed.
The Alabama Governor also initiated a push to upgrade all state software to better protect personal privacy. [Decatur Daily]