Data breach victims four times more likely to be victims of identity theft

According to a recent study called "Data Breach Notifications: Victims Face Four Tmes Higher Risk of Fraud", those individuals whose information is exposed via a data breach are four times more likely to have their identity stolen than the average person.  The results of this study are contrary to the party line spewed by most companies that victims of their data breaches typically are not later victimized by fraudsters or identity thieves.  The study, conducted by Javelin Research, also underscores the need for stronger legislation to protect individuals from data breaches and require notification when data breaches occur.  As I posted earlier, the Senate Judiciary Committee has approved two such bills - S. 139 and S. 1490.

The study utilized multiple years of data including 2009 data breaches. The report also presents a timeline overview of the most recent and egregious data breaches in U.S. history, with recommendations for how individuals and companies can increase safety.

Possible new law on the horizon regarding data breaches?

On November 5, the Senate Judiciary Committee approved two bills regarding data security.  The first is Senator Feinstein's Data Breach Notification Act (S. 139).  The text of this proposed law can be found here - http://thomas.loc.gov/cgi-bin/query/z?c111:S.139:. 

The Data Breach Notification Act would greatly expand the amount of data combinations that, if breached, would require notification.  Currently, most laws only require notification if a name is released in conjunction with a Social Security number, driver's license number or financial account number.  If S. 139 is passed as is, it would require notification if only the first and last name, address/phone number and date of birth are stolen or inadvertantly released.  The bill would also require notification of the Department of Justice and fines up to $1000 per day per victim up to $1,000,000.

The second bill approved by the Senate Judiciary Committee was Senator Leahy's Personal Data Privacy and Security Act (S. 1490), the text of which can be found here - http://thomas.loc.gov/cgi-bin/query/z?c111:S.1490:.

Senator Leahy's bill goes beyond Senator Feinstein's in that it is styled to be proactive to prevent data breaches, rather than reactive to data breaches that have already occurred.  Think "Red Flag Rules" but with the emphasis on protecting against data breaches of any kind, rather than just recognizing and preventing identity theft.  The bill would require companies maintaining information on 10,000 or more United States persons to implement a comprehensive personal data privacy and security program that includes administrative, technical and physical safeguards to prevent data breaches as well as requiring employee training and vulnerability testing of the safeguards. 

I will do my best to follow these two bills and update you on their status.