U.S. lawmakers push for data privacy legislation

WASHINGTON - Following the disclosure of two recent large-scale identity theft operations, the U.S. data brokerage industry will most likely face new laws this year governing what personal data it collects and shares, several U.S. lawmakers said Tuesday.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

As the chief executives of ChoicePoint and a LexisNexis division looked on, nearly all the members of a House of Representatives subcommittee blasted the companies for collecting personal data and sharing it with other companies without telling the people whose data is being collected. Since mid-February, both companies have disclosed that identity thieves have stolen the personal information of tens of thousands of U.S. residents.

Representative Joe Barton, chairman of the House Energy and Commerce Committee, called such security breaches "intolerable," and he promised to look into legislation that would regulate data brokers, including a ban on the sale of Social Security numbers without the permission of the owner of the number, except when needed by law enforcement.

In the Internet age, ID thieves have easy access to personal information such as bank records contained in huge databases operated by data brokers, said Barton, a Texas Republican. "Under current law, anyone has a near-perfect right to package your personal information and do almost anything they want with it," he said. "They can change it, share it, rent it or sell it. The constraints are so flimsy they're laughable."

The two companies' chief executives seemed to disagree, saying most of the personal information they collect is governed by the U.S. Fair Credit Reporting Act, which allows individuals to check their credit records and ask credit reporting agencies to make corrections.

A law that would prohibit almost all sales of Social Security numbers could hamper financial institutions investigating fraud, bill collection companies and law enforcement investigations, said Derek Smith, chairman and chief executive officer (CEO) of ChoicePoint, and Kurt Sanford, president and CEO of U.S. Corporate and Federal Government Markets at LexisNexis. In some cases, consumers may not give explicit permission for a data broker to share their Social Security numbers in transactions that benefit them, such as pre-employment background checks, Smith said.

Smith told lawmakers that his company provides a valuable service to lenders, insurance companies and even law enforcement agencies hunting down criminals. ChoicePoint has done "some serious soul-searching" since its breach and has decided that it should have acted more quickly when it discovered the breach, he said.

"Every advance in technology that makes our lives easier also makes it easier for our enemies to move swiftly against us," Smith said. "You and I can be approved for a bank account in a matter of minutes, but a person can use that same technology to get a false or real drivers' license or to create a fake business." In February, ChoicePoint disclosed that up to 145,000 U.S. residents are potential victims of an ID theft scheme, discovered in September, in which thieves set up a bogus business that requested background checks from ChoicePoint.

This month, LexisNexis' parent company, Reed Elsevier PLC, announced that hackers compromised databases and stole the personal information of at least 32,000 people. The company is still investigating how thieves gained access to passwords that allowed them into a LexisNexis database, Sanford said.

Both executives told the House Commerce, Trade and Consumer Protection Subcommittee that their companies have taken steps to ensure their recent breaches do not happen again and to help the people whose personal information may have been stolen. Both companies are offering victims free credit reports and free one-year access to a credit monitoring service.

One free year of credit monitoring isn't enough for victims of ID theft, who often struggle for years to clear up their credit, said Representative Edward Markey, a Massachusetts Democrat.

Markey suggested a lifetime credit monitoring service paid for by ChoicePoint would be more appropriate. "Will you give them 10 years?" he asked Smith. "Will you give them five years, will you give them two years?"

ChoicePoint will "take a hard look" at additional ways to help the victims, Smith said, but he didn't commit to giving away credit monitoring services for a longer period. The company will spend nearly US$2 million on the one year of credit monitoring services, he said. "We will continue to look at other remedies," he added.

On March 3, Markey introduced a bill, the Information Privacy and Security Act, that would require the U.S. Federal Trade Commission (FTC) to develop rules for data brokers, including methods of protecting personal data, ways for individuals to check if their personal data is held by a data broker, and a way for individuals to correct mistakes in data held by data brokers.

FTC Chairwoman Deborah Platt Majoras, like Smith and Sanford, questioned whether a new law should prohibit nearly all sales of Social Security numbers without permission, but Markey ripped into the two CEOs for suggesting such a law could be too broad. "To whom do you think my Social Security number could be sold?" he said. "Who would it be appropriate for you to sell it to?"

Both companies said they supported additional data privacy laws. Sanford and Smith endorsed Platt Majoras' call for a national law that requires companies to tell consumers when personal data has been compromised and there is "significant risk" to consumers. Only California now has a data notification law, and both executives said they preferred a national law to a number of conflicting state laws.

Both companies called for increased penalties for ID thieves, and Sanford also agreed with an FTC proposal that would extend data safeguard requirements in the Gramm-Leach-Bliley Act, governing financial institutions, to data brokers.

But Markey criticized both companies for not backing stronger regulation, such as a ban on the sale of Social Security numbers.

"What we're hearing today is basically an industry that is still in denial, that still doesn't recognize how highly all Americans value their privacy, and who hope to be able to ride out this scandal," Markey said.