David Etue | We Need Strong National Data Privacy Legislation
Connecting state and local government leaders
When the 110th Congress convenes in January 2007, one real issue it needs to address is data privacy.<p>
As the country moves closer to a national election, Congress is spending its time on symbolic issues keyed to the November election. When the new Congress takes power, one real issue it needs to address is data privacy.The past few years have seen a sharp increase in the leakage of personal data like credit card and social security numbers from institutions ranging from universities, to banks, to government agencies like the Veterans Affairs Department. According to a list maintained by the Privacy Rights Clearinghouse, a San Diego-based advocacy group, more than 190 such incidents have been reported since February 2005. The Federal Trade Commission estimates the inadvertent or deliberate extrusion of critical data costs consumers and businesses $50 billion a year. Beyond these immediate costs, data leakage threatens the integrity and growth of e-commerce. Even more ominously, it could harm national security.State governments and private organizations have responded with legislation and voluntary standards. The federal government has also entered the picture. Last year the FTC leveled the largest data privacy fine in its history. But the FTC has publicly stated its investigations and fines are not enough. It needs better tools to ensure that consumers' most important information isn't lost, stolen or peddled to the highest bidder. That means new and stronger legislation.Data privacy bills have been introduced in Congress. It's the job of the next Congress to pass one of them. Any legislation should be guided by the following principles: By the end of 2005, 17 states had some type of data privacy law. Compliance with multiple and often conflicting legal frameworks increases costs and, more important, minimizes the clarity necessary to inspire trust among users. Federal legislation should be clear, uniform and comprehensive. It should authoritatively define 'personal data' and 'identity.' It must establish national benchmarks that set a floor of protection, rather than a ceiling. Finally, privacy legislation should apply to private /and/ public enterprises, including Federal, state and local governments. Working together, public and private organizations have developed best practices that can and should be utilized in the development of a national standard. These best practices include an expansive understanding of private data; disclosure of a breach even if security procedures are in place; disclosure of a breach when data is reasonably believed to have been compromised; delayed disclosure to meet the legitimate needs of law enforcement; and an annual risk assessment by organizations that meet a certain threshold, such as the quantity of identities held. Appropriate government agencies must be fully empowered and possess necessary resources to enforce a data privacy law. In addition, penalties must be designed to encourage compliance that genuinely lessens the risk of private data loss. This translates into significant funding; substantial penalties for intentional violations; lesser penalties for unintentional violations; and penalties based on the number of identities disclosed. It is also critical that the legislation reward the organizations that make significant efforts to comply. To both deter potential perpetrators and protect users, penalties should be severe for intentional violations.Continued faith in the digital economy, and its ability to increase wealth and expand opportunity, rests on a widely shared trust that digitized data is used for proper purposes. While the rest of 2006 may see Capitol Hill dominated by positioning and even posturing, our economy's needs don't track the electoral calendar. 2007 must be the year for clear, uniform and comprehensive federal data privacy legislation.
1. Clear, Uniform and Comprehensive Application.
2. Use of Current Best Practices.
3. Vigorous Enforcement and Substantial Penalties.
David Etue is senior security strategist at Fidelis Security Systems of Bethesda, Md.
David Etue, senior security strategist, Fidelis Security Systems
1. Clear, Uniform and Comprehensive Application.
2. Use of Current Best Practices.
3. Vigorous Enforcement and Substantial Penalties.
David Etue is senior security strategist at Fidelis Security Systems of Bethesda, Md.
NEXT STORY: IBM to pay $1.3B for security provider