Mr. President, I am proud to be an original cosponsor of the Personal Data Privacy and Security Act of 2007. This bill is a much-needed solution to the daunting problem of ensuring the privacy and…
Mr. President, I am proud to be an original cosponsor of the Personal Data Privacy and Security Act of 2007. This bill is a much-needed solution to the daunting problem of ensuring the privacy and the security of our personal data, which has become such a precious commodity.
Several forces are converging to make our personal information more valuable--and more vulnerable--than ever. The world is digital and so is our personal data. In this day and age, almost everything we do results in a third party creating a digital record about us--digital records that we may not even realize exist. We seek the convenience of opening bank accounts, managing our credit cards, and making major purchases over the Internet. And we often complete these transactions without ever speaking to another person face-to-face or over the telephone. Businesses, nonprofits, and political parties are personalizing their messages, products, and services to a degree we've never seen before, and they are willing to invest significant amounts of money in collecting personal information about potential customers or donors. And we are living in an age where identity-based screening and security programs can be vitally important, resulting in more information being collected about individuals in an attempt to identify them accurately.
As a result, personal information has become a hot commodity that is bought, sold, and--as so often happens when something becomes valuable--stolen.
We are at a crossroads. We all know about the security breaches that have been on the front pages of newspapers. They have placed the identities of hundreds of thousands of Americans at risk. The fear among the American public is so widespread that it has become the basis of an entire ad campaign by a credit card company.
But this is about much more than information security. Until California law required a company named ChoicePoint to notify individuals in 2005 that their information was compromised and that they might be vulnerable to identity theft, many Americans had never heard of ChoicePoint. As news stories focused on the data broker business, many Americans were surprised to discover that companies are creating digital dossiers about them that contain massive amounts of information, and that these companies sell that information to commercial and government entities. The revelations about these security breaches highlighted the fact that Americans need a better understanding of what happens to their information in a digital world-- and what kind of consequences they can face as a result.
When I am back home in Wisconsin, I hear from people who do not understand why companies have the right to sell their sensitive personal information. I hear from people who are shocked to discover that personal information about them is available for free on the Internet.
There is no question that data aggregators facilitate societal benefits, allowing consumers to obtain instant credit and personalized services, and allowing police officers to locate suspects. But these companies also gather a great deal of potentially sensitive information about individuals, and in many instances they go largely unregulated.
Too many of my constituents feel that they have lost control over their own information. Congress must return some power to individual Americans so that we can all better understand and manage what happens to our own personal data.
The Personal Data Privacy and Security Act takes a comprehensive approach to the privacy and security problems we face. It gives consumers back some control over their own information. The bill requires data brokers to allow consumers to access their own information and to investigate when consumers tell them that corrections are necessary. And it requires companies to give notice to affected consumers and to law enforcement if there is a serious security breach, so that individuals know their identity may be at risk and can take steps to protect themselves.
In addition, the bill extends existing criminal law to ensure that it covers unauthorized access of data broker systems, as well as concealment of security breaches. It requires companies that buy and sell information to have appropriate data security systems in place. These protections will help safeguard against future privacy violations and security breaches in the commercial data industry. But that is not all this bill accomplishes.
The bill also contains some critically important privacy and security provisions to govern the government's use of commercial data. This is an aspect of the data broker business that has not yet gotten as much attention in the wake of the security breaches over the past few years. The information gathered by these companies is not just sold to individuals and businesses; government agencies of all stripes also buy or subscribe to information from commercial sources. We all remember the discovery in 2005 that the Pentagon had a contract with a marketing firm to analyze commercial and other data about high school and college students.
Although the government should be able to access commercial databases in appropriate circumstances, there are few existing rules or guidelines to ensure this information is used responsibly. Nor are there restrictions on the use of commercial data for powerful, intrusive data mining programs. The Privacy Act, which governs when government agencies themselves are collecting data, likely does not apply because the information is held outside the government and is not gathered solely at government direction.
As a result, there is a great deal we do not know about government use of commercial data, even in clearly appropriate circumstances such as when the agency's goal is simply to locate an individual already suspected of a crime.
We don't know under what circumstances government employees can obtain access to these databases or for what purposes. We don't know how government agencies evaluate the accuracy of the databases to which they subscribe. We don't know how the accuracy level of the data affects government use of the data. We don't know how employees are monitored to ensure they do not abuse their access to these databases. We don't know how those who misuse the information are punished. And we don't know how government agencies, particularly those engaged in sensitive national security investigations, ensure that the data brokers cannot keep records of who the government is investigating, records which themselves could create a huge security risk in light of the vulnerabilities that have come to the forefront in recent months.
That is why I am so pleased that this bill includes provisions to address the government's use of commercial data. A comprehensive approach to data privacy and security would be incomplete without taking on this piece of the puzzle. The bill recognizes there are many legitimate reasons for government agencies to obtain commercially available data, but that they need to be subject to privacy and security protections. It takes a common sense approach, pushing government agencies to take basic steps to ensure that individuals' personal information is secure and only used for legitimate purposes, and that the commercial information the government is paying for and relying on is accurate and complete.
Specifically, the bill would require that federal agencies that subscribe to commercial data adopt standards governing its use. These standards would reflect long-standing basic privacy principles. The bill would ensure that government agencies consider and determine which personnel will be permitted to access the information and under what circumstances; develop retention policies for this personal data and get rid of data they no longer need, minimizing the opportunity for abuse or theft; rely only on accurate and complete data, and penalize vendors who knowingly provide inaccurate information to the Federal Government; provide individuals who suffer adverse consequences as a result of the agency's reliance on commercial data with a redress mechanism; and establish enforcement mechanisms for those privacy policies.
The bill also directs the General Services Administration to review government contracts for commercial data to make sure that vendors have appropriate security programs in place, and that they do not provide information to the government that they know to be inaccurate. And it requires agencies to audit the information security practices of their vendors.
These are basic good government measures. They guarantee that the Federal Government is not wasting money on inaccurate data and that vendors are undertaking the security programs that they have promised and for which the government is paying.
We live in a new digital world. The law may never fully keep up with technology, but we must make every effort we can. I am proud to be involved in this comprehensive, reasoned approach to privacy and security, and I hope it will move forward in this Congress. I congratulate Senators Leahy and Specter for their excellent work on this bill. This bill is important and it deserves serious consideration.
Mr. President, today, along with my colleague Senator Collins from Maine, I am introducing legislation to address the needs of the nearly one-quarter of all Medicare beneficiaries who live in rural America. These beneficiaries are systematically disadvantaged in the Medicare program. The beauty of Medicare is its equity, its universality, and its accessibility. But we have compromised these values by stratifying payments, by under-representing rural voices on the Medicare Payment Advisory Commission, and by continuing to use obsolete payment data that hurts rural America.
First, we must stop indexing physician payments for work based on geographic differences. Rural areas already have a hard enough time recruiting and retaining the Nation's top talent. Currently, even though 25 percent of Medicare beneficiaries live in rural areas, only 10 percent of the Nation's physicians serve them. Lower payments to doctors in these areas only perpetuate this dangerous shortage of medical expertise. We should not be discouraging medical school graduates from moving to underserved rural areas by continuing to offer sub-par pay--in fact, we should be providing incentives to encourage them to work in underserved areas. My legislation proposes a project to help rural facilities to host educators and clinical practitioners in clinical rotations.
Lack of dollars to rural health facilities has also prevented communities from investing in vital information technology. The Institute of Medicine published a report in 2005 detailing the ways in which health IT could assist isolated communities. For example, since rural physicians tend to be generalists rather than specialists, virtual libraries within physician offices would provide both doctors and patients with a wider and deeper source of information at their fingertips. Rural residents can also be quite far from health facilities, so technology that allows emergency room physicians to communicate with EMS workers in an ambulance can help patients receive life-saving treatment before they physically reach the hospital. These kinds of technologies will improve both the quality and efficiency of care given in rural areas. My legislation offers funding for
quality improvement demonstration projects, to allow isolated communities to invest in this otherwise out of reach technology.
Lastly, this legislation will end the disproportionately low representation of rural interests on the Medicare Payment Advisory Commission. This lack of representation has resulted in policies that hurt rural communities. Those policies have hurt--and continue to hurt--the people of my State of Wisconsin, and they hurt my colleague Senator Collins' constituents as well. For every dollar that Medicare spends on the average beneficiary in the average State in this country, Medicare spends only 82 cents on a beneficiary in Wisconsin. In Maine, Medicare spends only 80 cents per dollar it spends on the average beneficiary.
How is this the case, if beneficiaries in Wisconsin and in Maine pay the same payroll taxes as beneficiaries in other States? Because the distribution of Medicare dollars among the 50 States is grossly unfair to Wisconsin, and to much of the Upper Midwest. Wisconsinites pay payroll taxes just like every American taxpayer, but the Medicare funds we get in return are lower than those received in many other States.
With the guidance and support of people across my State who are fighting for Medicare fairness, I am introducing this legislation to address Medicare's discrimination against Wisconsin's seniors and health care providers. My bill will decrease some of the inequitable payments that harm rural areas. It will provide rural areas the help they need to grow crucial health information technology infrastructure. It will offer the necessary incentives to help attract the Nation's top medical talent to underserved rural areas. And it will mandate rural representation on the Medicare Payment Advisory Commission. Rural seniors are already underserved in their communities; they should not be underrepresented in Washington as well.
Rural Americans have worked hard and paid into the Medicare program all their lives. In return, they deserve full access to the same benefits as seniors throughout the country: their choice of highly skilled physicians, use of the latest technologies, and a strong voice representing their needs in Medicare policy.
I ask unanimous consent that the text of my bill be printed in the Record.