Data Security: Federal Legislative Approaches

Publication Date: January 2008

Publisher: Library of Congress. Congressional Research Service

Author(s):

Research Area: Media, telecommunications, and information

Type:

Abstract:

Numerous data security bills were introduced in the first session of the 109th Congress to address data security breaches; some of these bills preempt and sometimes limit recently enacted state laws. Three congressional hearings were held in 2005 to examine issues related to data breaches. Three bills were reported by Senate committees during the first session of the 109th Congress. The prospect for continued congressional attention is high during the second session of the 109th Congress, with eight congressional committees having jurisdiction over some aspect of data security, data breach notification, and data privacy.

This report discusses the core areas addressed in federal legislation, including the scope of coverage (who is covered and what information is covered); data privacy and security safeguards for sensitive personal information; requirements for security breach notification (when, how, triggers, frequency, and exceptions); restrictions on social security numbers (collection, use, and sale); credit freezes on consumer reports; identity theft penalties; causes of action; and preemption. For related reports, see CRS Report RS22374, Data Security: Federal and State Laws, by Gina Marie Stevens; CRS Report RL33005, Information Brokers: Federal and State Laws, by Angie A. Welborn; CRS Report RS20185, Privacy Protection for Customer Financial Information, by M. Maureen Murphy; and CRS Report RL31408, Internet Privacy: Overview and Pending Legislation, by Marcia S. Smith. This report will be updated as warranted.