Members of a Congressional subcommittee last week heard an essentially unanimous call from a panel of witnesses for a national data-breach notification standard to replace the wide-ranging laws currently on the books in 48 states.
The disagreement, such as it was, came in the form of how such a law should be tailored, but witnesses and lawmakers alike expressed broad support for a national law to replace what Rep. Lee Terry (R-Nebraska), the chairman of the Energy and Commerce Committee’s subcommittee on commerce, manufacturing and trade, called the “patchwork of state and territory-specific statutes.”
The word “patchwork” was uttered often as witnesses described the compliance burden of adhering to the notification requirements prescribed by the various states, which can include different triggers for sending out a notice of a breach, such as inconsistent definitions for personally identifiable information. California, which was the first state to mandate consumer notification, has expanded to require businesses report certain levels of breach to the state attorney general. A report of 2012’s security failures was recently released.
Guidance for business
“While many businesses have managed to adapt to these various laws, a properly defined data breach notification standard would go a long way to guide organizations on how to address cyber threats in their risk management policies,” said Kevin Richards, senior vice president for federal government affairs with the trade group TechAmerica.
To read this article in full or to leave a comment, please click here
Source: FULL ARTICLE at PCWorld



