US House Commerce Panel Clears Data Security Bill

(Reuters) March 29, 2006 -- A U.S. House committee on Wednesday approved a bill to protect consumers from identity theft by setting a national standard for companies to secure personal information and monitor for security breaches.

The bill was cleared by the Energy and Commerce Committee and may now be considered on the floor of the House of Representatives. But it also competes with data security bills that have emerged from other committees and include distinct provisions and requirements.

Under the Energy and Commerce Committee bill, the U.S. Federal Trade Commission would be responsible for setting regulations that establish national standards for protecting personal information. The FTC also would be authorized to impose penalties of as much as $5 million for violations.

Personal information under the bill would be the combination of a consumer's name with either a social security number, driver's license or other state-issued identification number, or financial account number.

Like other bills under consideration on Capitol Hill, the the Energy and Commerce Committee legislation would preempt states' data security laws.

But it would give both the FTC and states' attorneys general power to enforce the law. Data security legislation recently approved by the House Financial Services Committee would keep states' attorneys general from acting as enforcers.

The Energy and Commerce Committee bill also requires companies whose data security has been breached to notify the FTC as well as consumers if the exposed data puts consumers at risk of identity theft, fraud or other unlawful activity.

"Financial information has benefited from security protections for many years," said Republican Rep. Joe Barton of Texas, the chairman of the committee. "But criminals can cause harm with other sensitive personal information that many companies have and it is time for a federal standard which protects that information."

Committee leaders agreed to the bill's provisions behind closed doors, and amendments proposed during Wednesday's panel session were rejected or withdrawn.

That included a measure that would have given financial institutions, which already must comply with data security requirements under the Gramm-Leach-Bliley Act, an exemption from the new law.

Banks and credit unions have argued that giving the FTC power to issue and enforce another set of data security regulations on top of those already imposed on financial institutions would be redundant and burdensome.

"We believe the (Gramm-Leach-Bliley Act) sets stringent standards and that the banking regulators have done a superb job of implementing it," said Robert Davis, executive vice president and managing director of government relations at America's Community Bankers. "Allowing a new layer of duplicate regulations is bad for community banks and financial institutions of all types."