Since few things are more politically safe to hate, a bipartisan coalition of U.S. senators has proposed legislation designed to protect consumers from identity theft.
The senators, all leaders of the Senate Commerce Committee have introduced The Identity Theft Protection Act (S. 1408), setting national standards for notifying consumers of data breaches, requiring businesses to improve their safeguards for sensitive consumer information, giving consumers the right to freeze their credit reports to thwart identity theft, and limiting the solicitation of Social Security numbers.
The legislative effort is led by Senators Gordon Smith (R-Ore.) and Bill Nelson (D-Fla.) and is co-sponsored by Commerce Committee Chairman Ted Stevens (R-Alaska), Co-Chairman Daniel Inouye (D-Hawaii), Sen. John McCain (R-Ariz.), and Sen. Mark Pryor (D-Ark.). The Commerce Committee has primary jurisdiction over the Federal Trade Commission, which enforces identity theft and fraud laws.
The Internet and new business technologies have added a lot to daily life, but theyve also made us more vulnerable, Sen. Smith said in a press release. We need this bill because having the world at your fingertips shouldnt get you into a financial world of hurt.
The bills bipartisan support signals that Congress is poised to act on first-ever regulations for data brokers and other companies that handle consumers' most private information," said Sen. Nelson. If we don't do something, and do it now, none of us will have any privacy left.
I am particularly proud that the Members of our Committee were able to work in a bipartisan fashion to write this important piece of legislation, said Chairman Stevens. With the problem of identity theft reaching epidemic proportions, a bill designed to protect Americans is absolutely essential. I look forward to continuing to work with my colleagues on legislation that will mitigate to the greatest extent possible the occurrence of identity theft in this country, but without inhibiting an information sharing system that yields extraordinary benefits to every American.
The bill addresses two core problems: 1) recent data breaches of sensitive personal identification and 2) the current lack of tools for consumers to protect themselves from identity theft. Included below are some of the key aspects of the legislation:
INFORMATION COLLECTORS: The bill covers any business, school, or other entity that collects sensitive personal information, including Social Security numbers, financial account information, drivers license information, and other information that the Federal Trade Commission determines can be used for identity theft. The bill also covers any third party that purchases or otherwise acquires this information.
SAFEGUARDS: Businesses, schools and other organizations that hold sensitive personal information will be required to secure it with physical and technological safeguards that will be specified by the Federal Trade Commission.
CONSUMER NOTICE: If any of the sensitive personal identification is lost or otherwise breached, and there is a reasonable risk that the information could be used for identity theft, the holder of that information is required to notify the consumers affected. The information holder also must report data breaches affecting more than 1,000 individuals to the Federal Trade Commission or the holders primary regulator. If a business, school or other information holder fails to notify consumers or the FTC of a breach, the FTC or state attorneys general may pursue a fine in federal court of up to $11,000 per individual consumer (capped at $11 million per breach) affected by the security breach.
CREDIT FREEZE: The bill will allow consumers the choice of placing a credit freeze on their consumer credit report. That means an identity thief would be prevented from taking out credit in the name of any person who placed such a freeze on their consumer report. Consumers would have the option of lifting the freeze in advance of applying for new credit. The decision whether or not to place a freeze on ones own credit report is the choice of each individual consumer.
SOCIAL SECURITY NUMBERS: Businesses, schools and other information holders would be prohibited from requesting a persons social security number unless no other type of identifier can be used in its place. Those holding sensitive personal information also would be prohibited from using social security numbers on identification cards and other forms of identification. Companies would be prohibited from allowing prison-work programs to handle information containing social security numbers.
STATE PRE-EMPTION: The bill would pre-empt state law on all these issues to create more uniform and efficient compliance by businesses, schools, and information holders.