The Data Accountability and Trust Act (DATA) 170
An anonymous reader writes "The U.S. House of Representatives will soon be considering the Data Accountability and Trust Act (DATA). If passed it would require all companies to inform customers of security breaches that affect their personal data. The bill requires consumers to be told if their privacy has been violated because of a breach. Under the proposals, if a breach does occur, a company must notify any customers concerned and the FTC, which can then demand an audit."
Long Overdue (Score:5, Insightful)
It's about time a law like this was enacted.
On the average, I tend towards favoring less legislation, rather than more, but the simple fact is since it is not in the companies' best interests to disclose information about security failures, it can't be too much of a shock when they decide not to. This law is necessary to safeguard the information that citizens entrust to these companies, and given how inextricably our society is intertwined with the digital realm in this day and age, it's way overdue.
Across corporate America (Score:3, Insightful)
Re:So how much is this going to cost? (Score:5, Insightful)
You work for ChoicePoint or something?
Why the hell do people bristle so much at corporate regulation? A corporation is chartered by the state; it's not like you have some God-given right to run whatever business organization you want in whatever way you want without somebody watching what you do.
Exemption... (Score:5, Insightful)
Re:So how much is this going to cost? (Score:5, Insightful)
The problem is, if they're going to have to 'fess up, but then get away with nothing more than a slap on the wrist anyway, then this law is unlikely to do much to improve the security of personal information and the integrity with which it is handled. What they ought to do, IMHO, is enact a law that both requires disclosure and hits the offender with a financial penalty proportionate to the damage caused and the degree to which the offender's negligence caused it.
If a business carelessly loses 1,000 customers' credit card details but then gets hit with a dent to their bottom line of 1,000 x $AVERAGE_COST_PER_CARD_FRAUD + $COSTS_INCURRED_BY_AUDITORS + $SIGNIFICANT_PENALTY_CHARGE, then maybe it will become enough of a priority on the executive radar to do something about it. Similarly, if identity thefts or other more serious consequences arise, the costs of cleaning those up can be incorporated into the penalty; naturally, this should include compensation for the time spent by the affected individuals and any third parties they had to deal with to fix the problem.
At the same time, this approach removes the financial burden of conducting after-disaster audits from the taxpayer, and passes it onto the offending party instead.
Definition is everything (Score:2, Insightful)
Re:Exemption... (Score:3, Insightful)
Even if the encryption isn't lame or broken, it's still data out there on the loose. How long would it take to crack, given all the available information on encryption? There are precious few "uncrackable" encryption schemes and I doubt most major corporations are going to go to those lengths to protect data. From what I've seen behind the scenes, most will use tricks and simple algorithms, figuring it makes the data "mostly" secure.
Re:Long Overdue (Score:3, Insightful)
What? How? You can't just pretend those documents say something they don't. Well, you shouldn't.
We can't publish sensitive data from a major corporation on the Internet, or we would get sued.
What makes you think that?That being said, it should be implied, understood, and common practice to prevent big business from doing some of the things that they should be doing in the first place (privacy violations, overcharging, bastardly interest rates, etc).
What is the advantage to having regulation be "implied, understood, and common practice" as opposed to clearly spelling it out in statute?
From The Bill: (Score:4, Insightful)
What's more scary for me... (Score:2, Insightful)
They suggested that I simply attach the
I guess the point I'm trying to make is most companies don't give a SHIT about your data. They'll play along and act like they do, but implementing proper internal security practices is HARD and EXPENSIVE. This law is a step in the right direction, but it simply isn't enough.
Re:Long Overdue (Score:3, Insightful)
Don't worry, after a couple months it will become such a beaten dead horse, everyone will think "Oh, this stuff happens all the time. My chances of having my identity stolen are next to nil." And the notice gets tossed in the trash never to be worried about again.
And WHERE do they have to inform you? (Score:2, Insightful)
I'm not even concerned about the various loopholes and excemptions that this bill will most likely have (I have to admit, I did not read it. Nor is it worth the time reading it 'til it's passed for the simple reason that if it COULD present a benefit against spyware in software it WILL be changed). Even without loopholes it's pointless as long as the customer is not informed in a separate EULA-like info field, in laymen's terms, what is going to happen to his PC!
Re:why the hell? natural cynicism! (Score:3, Insightful)
You mean there are people out there that actually trust, private companies?!!
Private companies are the most untrustworthy entities on planet earth. They exist for one reason and one reason only, making money by whatever means necessary. If your "trust" in them stands in the way, they'll gladly walk all over it. Nay, eagerly. At least Mob bosses and pimps have some kind of reputation to keep together. Private companies have no such scruples.
Government Databases: BAD (Score:3, Insightful)
But that's chump change compared to the damage that gets caused when government databases' content is lost, or unprotected.
Now, given that:
With all the above in mind, surely it makes sense to limit what data the Government collects, and to keep that data compartmentalized in local databases, rather than a nice, juicy, massive, single federal instance? Right!?!?!
Yet, that's exactly what is happening right now, with the "Real-ID" bill. (Here's what Bruce Schneier [schneier.com] has to say on that).
Every single U.S. State except one has lined up like crack addicts to accept the federal money to implement Real-ID. That one State is New Hampshire, aka the Free State [freestateproject.org].
Here's a link to some pretty cool info about how and why the NH House rejected Real-ID:
http://freestateblogs.net/node/306 [freestateblogs.net]
Re:And WHERE do they have to inform you? (Score:1, Insightful)
Re:Government Databases: BAD (Score:1, Insightful)