California Leaders Urge Congress Not to Undermine State’s Personal Data Standards
The California State Capitol in Sacramento Feoktistoff / Shutterstock.com
State rules on data breach notifications are stronger than pending legislation on Capitol Hill.
A group of California lawmakers is pressing leaders of their congressional delegation to revise a bill moving through the U.S. House, saying it would weaken the Golden State’s standards for when people need to be notified that their personal data has been hacked.
The “Data Security and Breach Notification Act of 2015,” is intended to set national guidelines for when consumers need to be alerted that their personal data has been compromised.
But the legislation would also preempt state laws in an effort to ensure uniform nationwide standards. Four California legislators see that aspect of the bill as problematic. They say California’s existing data breach protections are tougher than those in the House legislation.
They voiced their concerns about the bill in a letter sent on Tuesday to House Majority Leader Kevin McCarthy (R-Calif.) and Minority Leader Nancy Pelosi (D-Calif.).
“While we support a strong national standard for data breach notification, Congress should not preclude states from enacting stronger laws that provide an even greater level of protection to our citizens,” the letter said.
California Assembly Speaker Toni Atkins (D-San Diego), Senate President Pro Tempore Kevin de Leon (D-Los Angeles), Assemblyman Mike Gatto (D-Glendale), and Sen. Hannah-Beth Jackson (D-Santa Barbara) signed the letter. They asked McCarthy and Pelosi to make changes to the bill before it receives a vote on the House floor.
The legislators raised a number of specific issues in the letter.
One has to do with the definition of personal information. They said the definition in the House bill would not cover login information for non-financial accounts, or medical and health insurance information. According to the letter, “California law includes both of these kinds of information.”
The lawmakers also said that the congressional bill only requires consumer notifications if there is a “reasonable risk” that breached data has resulted in, or will lead to, identity theft, economic losses, or other financial harm. This is in contrast to California standards, the letter states, which call for notifications if it’s reasonably believed that an unauthorized person has acquired personal data.
“The leap from acquired to proving financial harm places substantial subjective authority with the breached entity to decide whether a data breach requires customer notification,” the letter said.
According to the state legislators, the bill would also restrict individuals harmed by data breaches from filing lawsuits to recover damages.
California, their letter notes, was the first state to enact a data breach notification law. It did so in 2003.
NEXT STORY: 5 metrics for effective video