Preemption, ID Theft at Stake in Data Breach Bills

Legislation to require additional disclosures of data breaches may be limited to only breaches that compromise financial data and pose a direct threat of identity theft, and include preemption of conflicting state laws.

Several competing bills are being considered by different Congressional

A broader bill, opposed by business groups as over-reaching, was tabled at least temporarily during a Senate Judiciary Committee mark-up on Oct. 20. The Committee unanimously approved a more narrow version, similar to that being considered by the House Financial Services Committee.

The Committee Chairman, Arlen Specter, R-Pa., postponed the vote on his own bill, cosponsored with ranking Democrat Sen. Patrick Leahy, D-Vt., after receiving objections from fellow Republicans.

Sen. Specter's bill would subject banks to rules in addition to Gramm-Leach-Bliley, allow consumers to correct inaccurate information that companies keep on them, and increase civil and criminal penalties. That panel may soon be detracted by hearings on the Supreme Court nomination.

The Senate Commerce and Banking committees are also expected to have competing bills for consideration during full Senate debate. At least 18 states now have laws addressing data security and breach notification.

A growing number of business groups have said they support the more limited versions of proposed legislation.