Rep. Bono Mack releases draft of data breach bill

Rep. Mary Bono Mack (R-Calif.) released a draft of a bill on Monday that would establish national notification standards for firms that suffer data breaches that compromise customers' personal information.

The chairman of the House Energy and Commerce Committee's Manufacturing subpanel called the recent string of high-profile hacker attacks "a threat to the future of electronic commerce." The Subcommittee is set to hold a hearing on the Secure and Fortify Data Act (SAFE DATA Act) Wednesday morning at Rayburn House Office building.

“You shouldn’t have to cross your fingers and whisper a prayer when you type in a credit card number on your computer and hit ‘enter.’ E-commerce is a vital and growing part of our economy. We should take steps to embrace and protect it – and that starts with robust cyber security,” Bono Mack said in a statement.

“Most importantly, consumers have a right to know when their personal information has been compromised, and companies and other organizations have an overriding responsibility to promptly alert them.”

The bill would require companies to notify the Federal Trade Commission and consumers within 48 hours of when a data breach has been secured and the scope assessed. The FTC could levy fines if companies fail to do so in a timely manner. Nonprofits and charities would also be subject to the law.

The lack of a national data breach reporting standard has been highlighted in recent months by a string of data breaches at firms including Citigroup and Epsilon. Some firms including Sony have drawn heat from lawmakers for waiting before notifying customers that their information may have been breached.

“These eye-popping data breaches only reinforce my long held belief that much more needs to be done to protect sensitive consumer information," Bono Mack said. "Americans need additional safeguards to prevent identity theft, and the SAFE Data Act will help to accomplish this goal.”

The White House proposed a national data breach reporting standard as part of the comprehensive cybersecurity legislation the administration unveiled last month.

---