Congressional Whistleblower Protection Act of 2007

Mr. President, I am proud to be an original cosponsor of the Personal Data Privacy and Security Act of 2007. This bill is a much-needed solution to the daunting problem of ensuring the privacy and the security of our personal data, which has become such a precious commodity.

Several forces are converging to make our personal information more valuable--and more vulnerable--than ever. The world is digital and so is our personal data. In this day and age, almost everything we do results in a third party creating a digital record about us--digital records that we may not even realize exist. We seek the convenience of opening bank accounts, managing our credit cards, and making major purchases over the Internet. And we often complete these transactions without ever speaking to another person face-to-face or over the telephone. Businesses, nonprofits, and political parties are personalizing their messages, products, and services to a degree we've never seen before, and they are willing to invest significant amounts of money in collecting personal information about potential customers or donors. And we are living in an age where identity-based screening and security programs can be vitally important, resulting in more information being collected about individuals in an attempt to identify them accurately.

As a result, personal information has become a hot commodity that is bought, sold, and--as so often happens when something becomes valuable--stolen.

We are at a crossroads. We all know about the security breaches that have been on the front pages of newspapers. They have placed the identities of hundreds of thousands of Americans at risk. The fear among the American public is so widespread that it has become the basis of an entire ad campaign by a credit card company.

But this is about much more than information security. Until California law required a company named ChoicePoint to notify individuals in 2005 that their information was compromised and that they might be vulnerable to identity theft, many Americans had never heard of ChoicePoint. As news stories focused on the data broker business, many Americans were surprised to discover that companies are creating digital dossiers about them that contain massive amounts of information, and that these companies sell that information to commercial and government entities. The revelations about these security breaches highlighted the fact that Americans need a better understanding of what happens to their information in a digital world-- and what kind of consequences they can face as a result.

When I am back home in Wisconsin, I hear from people who do not understand why companies have the right to sell their sensitive personal information. I hear from people who are shocked to discover that personal information about them is available for free on the Internet.

There is no question that data aggregators facilitate societal benefits, allowing consumers to obtain instant credit and personalized services, and allowing police officers to locate suspects. But these companies also gather a great deal of potentially sensitive information about individuals, and in many instances they go largely unregulated.

Too many of my constituents feel that they have lost control over their own information. Congress must return some power to individual Americans so that we can all better understand and manage what happens to our own personal data.

The Personal Data Privacy and Security Act takes a comprehensive approach to the privacy and security problems we face. It gives consumers back some control over their own information. The bill requires data brokers to allow consumers to access their own information and to investigate when consumers tell them that corrections are necessary. And it requires companies to give notice to affected consumers and to law enforcement if there is a serious security breach, so that individuals know their identity may be at risk and can take steps to protect themselves.

In addition, the bill extends existing criminal law to ensure that it covers unauthorized access of data broker systems, as well as concealment of security breaches. It requires companies that buy and sell information to have appropriate data security systems in place. These protections will help safeguard against future privacy violations and security breaches in the commercial data industry. But that is not all this bill accomplishes.

The bill also contains some critically important privacy and security provisions to govern the government's use of commercial data. This is an aspect of the data broker business that has not yet gotten as much attention in the wake of the security breaches over the past few years. The information gathered by these companies is not just sold to individuals and businesses; government agencies of all stripes also buy or subscribe to information from commercial sources. We all remember the discovery in 2005 that the Pentagon had a contract with a marketing firm to analyze commercial and other data about high school and college students.

Although the government should be able to access commercial databases in appropriate circumstances, there are few existing rules or guidelines to ensure this information is used responsibly. Nor are there restrictions on the use of commercial data for powerful, intrusive data mining programs. The Privacy Act, which governs when government agencies themselves are collecting data, likely does not apply because the information is held outside the government and is not gathered solely at government direction.

As a result, there is a great deal we do not know about government use of commercial data, even in clearly appropriate circumstances such as when the agency's goal is simply to locate an individual already suspected of a crime.

We don't know under what circumstances government employees can obtain access to these databases or for what purposes. We don't know how government agencies evaluate the accuracy of the databases to which they subscribe. We don't know how the accuracy level of the data affects government use of the data. We don't know how employees are monitored to ensure they do not abuse their access to these databases. We don't know how those who misuse the information are punished. And we don't know how government agencies, particularly those engaged in sensitive national security investigations, ensure that the data brokers cannot keep records of who the government is investigating, records which themselves could create a huge security risk in light of the vulnerabilities that have come to the forefront in recent months.

That is why I am so pleased that this bill includes provisions to address the government's use of commercial data. A comprehensive approach to data privacy and security would be incomplete without taking on this piece of the puzzle. The bill recognizes there are many legitimate reasons for government agencies to obtain commercially available data, but that they need to be subject to privacy and security protections. It takes a common sense approach, pushing government agencies to take basic steps to ensure that individuals' personal information is secure and only used for legitimate purposes, and that the commercial information the government is paying for and relying on is accurate and complete.

Specifically, the bill would require that federal agencies that subscribe to commercial data adopt standards governing its use. These standards would reflect long-standing basic privacy principles. The bill would ensure that government agencies consider and determine which personnel will be permitted to access the information and under what circumstances; develop retention policies for this personal data and get rid of data they no longer need, minimizing the opportunity for abuse or theft; rely only on accurate and complete data, and penalize vendors who knowingly provide inaccurate information to the Federal Government; provide individuals who suffer adverse consequences as a result of the agency's reliance on commercial data with a redress mechanism; and establish enforcement mechanisms for those privacy policies.

The bill also directs the General Services Administration to review government contracts for commercial data to make sure that vendors have appropriate security programs in place, and that they do not provide information to the government that they know to be inaccurate. And it requires agencies to audit the information security practices of their vendors.

These are basic good government measures. They guarantee that the Federal Government is not wasting money on inaccurate data and that vendors are undertaking the security programs that they have promised and for which the government is paying.

We live in a new digital world. The law may never fully keep up with technology, but we must make every effort we can. I am proud to be involved in this comprehensive, reasoned approach to privacy and security, and I hope it will move forward in this Congress. I congratulate Senators Leahy and Specter for their excellent work on this bill. This bill is important and it deserves serious consideration.

Mr. President, today, along with my colleague Senator Collins from Maine, I am introducing legislation to address the needs of the nearly one-quarter of all Medicare beneficiaries who live in rural America. These beneficiaries are systematically disadvantaged in the Medicare program. The beauty of Medicare is its equity, its universality, and its accessibility. But we have compromised these values by stratifying payments, by under-representing rural voices on the Medicare Payment Advisory Commission, and by continuing to use obsolete payment data that hurts rural America.

First, we must stop indexing physician payments for work based on geographic differences. Rural areas already have a hard enough time recruiting and retaining the Nation's top talent. Currently, even though 25 percent of Medicare beneficiaries live in rural areas, only 10 percent of the Nation's physicians serve them. Lower payments to doctors in these areas only perpetuate this dangerous shortage of medical expertise. We should not be discouraging medical school graduates from moving to underserved rural areas by continuing to offer sub-par pay--in fact, we should be providing incentives to encourage them to work in underserved areas. My legislation proposes a project to help rural facilities to host educators and clinical practitioners in clinical rotations.

Lack of dollars to rural health facilities has also prevented communities from investing in vital information technology. The Institute of Medicine published a report in 2005 detailing the ways in which health IT could assist isolated communities. For example, since rural physicians tend to be generalists rather than specialists, virtual libraries within physician offices would provide both doctors and patients with a wider and deeper source of information at their fingertips. Rural residents can also be quite far from health facilities, so technology that allows emergency room physicians to communicate with EMS workers in an ambulance can help patients receive life-saving treatment before they physically reach the hospital. These kinds of technologies will improve both the quality and efficiency of care given in rural areas. My legislation offers funding for

quality improvement demonstration projects, to allow isolated communities to invest in this otherwise out of reach technology.

Lastly, this legislation will end the disproportionately low representation of rural interests on the Medicare Payment Advisory Commission. This lack of representation has resulted in policies that hurt rural communities. Those policies have hurt--and continue to hurt--the people of my State of Wisconsin, and they hurt my colleague Senator Collins' constituents as well. For every dollar that Medicare spends on the average beneficiary in the average State in this country, Medicare spends only 82 cents on a beneficiary in Wisconsin. In Maine, Medicare spends only 80 cents per dollar it spends on the average beneficiary.

How is this the case, if beneficiaries in Wisconsin and in Maine pay the same payroll taxes as beneficiaries in other States? Because the distribution of Medicare dollars among the 50 States is grossly unfair to Wisconsin, and to much of the Upper Midwest. Wisconsinites pay payroll taxes just like every American taxpayer, but the Medicare funds we get in return are lower than those received in many other States.

With the guidance and support of people across my State who are fighting for Medicare fairness, I am introducing this legislation to address Medicare's discrimination against Wisconsin's seniors and health care providers. My bill will decrease some of the inequitable payments that harm rural areas. It will provide rural areas the help they need to grow crucial health information technology infrastructure. It will offer the necessary incentives to help attract the Nation's top medical talent to underserved rural areas. And it will mandate rural representation on the Medicare Payment Advisory Commission. Rural seniors are already underserved in their communities; they should not be underrepresented in Washington as well.

Rural Americans have worked hard and paid into the Medicare program all their lives. In return, they deserve full access to the same benefits as seniors throughout the country: their choice of highly skilled physicians, use of the latest technologies, and a strong voice representing their needs in Medicare policy.

I ask unanimous consent that the text of my bill be printed in the Record.

Mr. President, I seek recognition today to discuss the Personal Data Privacy and Security Act of 2007, which I am introducing with Senator Leahy. Not long ago, personal information--Social Security numbers, birthdates, mothers' maiden names, addresses--all remained relatively private. Some information--for example,

whether you had a mortgage on your home--might have been publicly available, but finding that information required a trip to the local courthouse. For the most part, the sheer difficulty of obtaining personal information kept it private. This privacy--what Justice Brandeis called the freedom to be left alone--has been a cherished value throughout American history.

As everyday transactions increasingly occur electronically, personal information can be stored, transmitted and accessed much more easily. Most Americans have benefited from this change. Because personal information is available electronically, Americans enjoy the convenience of purchasing goods over the phone or on the Internet. They can obtain a home mortgage in a matter of hours. They can apply for a credit card while they wait at the store. The availability of such information also helps law enforcement agencies conduct investigations and apprehend criminals.

In electronic form, personal information is both more valuable and more vulnerable. As the multitude of security breaches that have occurred over the past 2 years demonstrate, electronic information is more vulnerable because it can be accessed anonymously from afar and can be stolen in a split second. According to the Privacy Rights Clearing House, since February 2005, over 100 million records containing personal information have been subject to some sort of security breach. The first of these incidents to come to light involved commercial data broker ChoicePoint, which in February 2005 reported that identity thieves had gained access to personal information of 163,000 people. The identity thieves had obtained the information by setting up sham accounts with ChoicePoint. ChoicePoint eventually settled with the FTC for $15 million, including $5 million for consumer redress. However, consumers might never have found out about the breach. The incident only came to light because of a law California had recently adopted requiring ChoicePoint and others to provide notice of security breaches involving personal information to California residents who were affected by the breach. As a result of the California law, Americans for the first time began learning that data brokers and others were routinely collecting and selling their personal information, and in so doing, they were not always keeping the information secure.

After the ChoicePoint incident came a long series of security breaches involving major American companies. In March of 2005, Designer Shoe Warehouse reported that hackers had gained access to personal information, including credit card numbers, on over 100,000 of its customers. Weeks later, Lexis Nexis reported that hackers had gained access to the personal information of over 300,000 individuals. Other blue-chip companies where unauthorized persons have gained access to personal information include Wal-Mart, General Motors, Wachovia Bank, H&R Block, Honeywell, AT&T, Lloyd's of London, ARCO, Visa, MasterCard, Bank of America, FedEx, OfficeMax, Blue Cross Blue Shield and Ralph Lauren. The largest incident came in June 2005, when Card Systems, which processes payments for the country's largest banks and credit card companies, reported that hackers had accessed 40 million records containing personal information. Most recently, TJ Maxx Stores and MoneyGram both had the personal information of their customers stolen from their computer systems. This list only includes security breaches involving wrong-doers who were trying to obtain personal information. The list would be much longer had it included inadvertent disclosure of personal information or incidents involving stolen computers or other equipment that happened to contain personal information.

A large number of colleges and universities have also suffered significant breaches, including the University of Southern California, which in July of 2005 reported that hackers has accessed 270,000 records containing personal data. Other educational institutions that have been hacked include Boston College, Northwestern University, Tufts University, UCLA, Michigan State, Carnegie Mellon, Perdue, Stanford, Duke, the University of Iowa, the University of Colorado, and the University of Utah.

Governments also have not been immune from attempts by identity thieves to obtain personal information. Hackers have accessed personal data at the Department of Defense, Department of Energy, the Air Force and the Department of Agriculture. Hackers obtained over half a million records containing personal data from a State agency in Georgia. The San Diego County Employees Retirement Association, the California Department of Corrections, the Nebraska Treasurers office, the city of Lubbock, TX, and a Women, Infants and Children (WIC) program in Hawaii have all been the victims of similar thefts.

Electronic personal data is more valuable because identity thieves can steal a large volume of data and use it before anyone even knows their personal information has been compromised. For the last 5 years, identity theft has topped the FTC's list of consumer complaints. From 2002 to 2004, the number of complaints rose 52 percent, to 246,570. Put another way, that's one complaint every 2 minutes. But this is only the tip of the iceberg. Not all consumers report identity theft to the FTC. Not all victims report identity theft to their local police. Sixty percent of those who did file a report with the FTC did not call their local police department. It stands to reason that many did not call the

Mr. President, today I am pleased to join Senator Specter in reintroducing the Leahy-Specter Personal Data Privacy and Security Act. This is a comprehensive data privacy package aimed at better protecting Americans' privacy. Senator Specter has been a valuable partner on this, and I also thank Majority Leader Reid for his leadership and commitment to enacting data privacy legislation this year.

When Senator Specter and I introduced this bill in 2005, we had high hopes of bringing urgently needed data privacy reforms to the American people. The Judiciary Committee reported this bill favorably in November of 2005, but with the last Congress, it simply sat on the calendar. The leadership would not bring it forward.

The irony is while they refused to bring it forward, the problems of data breaches remained a persistent and pernicious threat to Americans' privacy. Yesterday we learned that the Department of Veterans Affairs has lost a portable hard drive containing the sensitive personal information on as many as 48,000 veterans. I can imagine what the veterans in my State feel about that. I can imagine what the veterans in Montana feel about that.

Last week, there was a major data breach involving a State computer server in my home State of Vermont. It jeopardized the financial data of at least 69,000 Vermonters whose personal financial information had been stored on the computer used by the Vermont Agency of Human Services. Can you imagine 69,000 people, in a State of barely over 600,000 people.

This is not unique to Vermont. Last month mega retailer TJX disclosed that it suffered a major computer breach involving credit and debt card purchases involving possibly hundreds of thousands of American consumers. And, even as disturbing as that is, while they knew about the breach in mid-December, none of those customers were told about it until a month later. It is as if a thief had gone to each one of their houses and stolen their data.

Of course, all of this comes on the heels of the theft of the personal data of 26.5 million of our veterans and active-duty personnel at the VA last year. Think about this: You are a man or a woman serving your country in Afghanistan or Iraq, and this information is stolen-- with data about where you live and what family members are left at home while you are overseas. How do you think that makes you feel?

According to the Privacy Rights Clearinghouse, more than 100 million records containing sensitive personal information have been involved in data security breaches since 2005. We need strong Federal data privacy and security laws to protect Americans' personal data, and to address the ills of lax data security.

Our bill requires that data brokers let consumers know what sensitive personal information they have about them and to allow individuals to correct this. It is a simple matter of fairness. There is a clear precedent for our approach in the credit reporting context. Our bill also requires that companies who have databases with sensitive personal information about Americans establish and implement data privacy and security programs. In the information age, any company that wants to be trusted by the public must earn that trust by vigilantly protecting the databases that they use and maintain. In addition, our bill requires notice when sensitive personal information has been compromised. The American people need to know when they may be exposed to a data breach. Whether it is a government agency or a private company, if they lose your sensitive information, your Social Security number, your address, or anything about you,

you have a right to know. If they are holding that information about you, and they lose it, you have the right to know it has been lost.

We also have tough criminal penalties for anyone who would intentionally or willfully conceal the fact that a data breach has occurred when that breach causes economic damage to consumers.

Then finally, we address the important issue of the Government's use of personal data. This would require Federal agencies to notify affected individuals when Government data breaches occur.

We should never have to worry about our Government having this information on us and losing it, but certainly in the last 2 or 3 years, we have seen so many millions of files that have been lost or put in jeopardy. We live in a world in which our Government also is increasingly turning to the private sector to get personal data that they, in some instances, couldn't legally get on their own. To address this, our bill puts protecting Americans' privacy first and foremost: Government data has to be protected and we have to know if the Government falls down on the job.

This is a comprehensive bill. It not only deals with the need to provide Americans notice when they have been victims of a data breach, it also deals with the underlying problems of lack of security and lack of accountability to prevent data breaches from occurring in the first place.

Today, Americans live in a world where their most sensitive personal information can be accessed and sold to the highest bidder with a few keystrokes on their computer. Our privacy laws greatly lag behind both the capabilities of our technology and the cunning of identity thieves. This legislation closes that gap. I commend the leadership for being willing to bring up our data privacy bill. I wish that the leadership in the last Congress had brought this bill up last year. But, I am glad that the new leadership will do so this year.

For the sake of all Americans, I urge all Senators to support this legislation and to act now to pass comprehensive data privacy and security legislation.

I ask unanimous consent that the text of the bill be printed in the Record.

Mr. President, the bill that I am introducing today, along with Senators Warner, Landrieu, Vitter, Coleman, Smith, and Nelson of Nebraska, would increase and expand the Teacher Tax deduction provided in current law. The Teacher Tax deduction is available to school teachers and other educators who incur out-of-pocket expenses in order to purchase classroom supplies for their students. The bill we are offering today would increase this above-the-line tax deduction to $400, allow the deduction to be taken for expenses related to professional development, and make the deduction permanent.

This bill builds upon a $250 tax deduction in current law authored by Senator Warner and myself, which became law as part of the tax relief package in 2001. This tax relief was later extended through the end of this year, but we need to act to extend it further.

I would suggest that there is no reason why we should not make the deduction permanent. Teachers who buy classroom supplies in order to improve the educational experience of their students deserve more than just our gratitude. They deserve this modest tax relief to thank them for their hard work.

So often teachers in my State, and throughout the country, spend their own money in order to improve the classroom experiences of their students. Many of us are familiar with a survey of the National Education Association that found that teachers spend, on average, $443 a year on classroom supplies. Other surveys show that they are spending even more than that. In fact, the National School Supply and Equipment Association found that educators spend an average of $826 to supplement classroom supplies, plus $926 for instructional materials on top of that--for a total of over $1,700 out of their own pockets.

In most States, including mine, teachers are very modestly paid for their jobs. I think it is so impressive that despite challenging jobs and modest salaries, teachers are willing to dig deep into their own pockets to enrich the classroom experience, because they care so deeply for their students.

Indeed, I have spoken to dozens of teachers in Maine who tell me they routinely spend far in excess of the $250 deduction limit that is in current law. I have made a practice of visiting schools all over Maine, and so far, I have had the opportunity to visit more than 160 schools in my State. At virtually every school I visit, I find teachers who are spending their own money to benefit their students. Year after year, these teachers spend hundreds of dollars on books, bulletin boards, computer software, crayons, construction paper, stamps, inkpads-- everything you can think of. Let me just give you a couple of examples. Anita Hopkins and Kathi Toothaker, who are elementary school teachers from Augusta, ME, purchase books for their students to have as a classroom library, as well as workbooks and sight cards. They have also purchased special prizes for positive reinforcement for their students. Mrs. Hopkins estimates that she spends $800 to $1,000 of her own money on extra materials to make learning fun and to create a stimulating classroom environment.

This bill would also expand the Teacher Tax deduction to make it available to teachers who incur expenses for professional development. Whenever the provisions of ``No Child Left Behind'' are being debated, we hear a lot of discussion about the need for highly-qualified teachers. One of the best ways for teachers to improve their qualifications is through professional development. Yet, in towns in my State, and I suspect throughout the country, school budgets are often very tight, and money for professional development is either very limited or non-existent. For that reason, I believe we should allow this tax deduction to also apply when a teacher takes a course or attends a workshop and has to pay for it out of his or her own pocket.

In my view, students are the ultimate beneficiaries when teachers receive professional development to sharpen their skills or to learn a new approach to presenting material to their students. Studies have consistently shown that, other than involved parents, the single greatest determinant of classroom success is the presence of a well- qualified teacher. Educators themselves understand just how important professional development is to their ability to make a positive impact in the classroom.

The Teacher Tax relief that we have made available since 2001 is certainly a positive step, and I was proud to have authored that law, along with Senator Warner. This bill would increase that deduction from $250 to $400, reflecting more accurately what teachers really spend, and would make the deduction permanent. The National Education Association has endorsed this bill, and I ask unanimous consent that a copy of the NEA's letter be printed in the Record at the end of my statement.

This bill is a small but appropriate means of recognizing the many sacrifices that our teachers make every day to benefit the children of America. I urge my colleagues to support it.

Mr. President, I rise today to introduce the Long-Term Care Trust Account Act of 2007. I am pleased to be joined by my colleague Senator Blanche Lincoln who has been a tireless leader on issues of importance to the health of our Nation. I look forward to continuing to work with Senator Lincoln on this legislation as well as other opportunities to improve health care in America.

We are an aging Nation. With babyboomers rapidly retiring, the need for long-term care planning is becoming even more critical. However, we know all too well that planning for the likelihood of disability in young or old age is not done as actively as we would like it to be. Currently, only about 7 percent of all money spent on long-term care comes from private insurance. Too often, insurance is not being purchased, funds are not being saved and persons with disabilities are forced to rely on Medicaid for their daily care.

As a Nation, we need to do better. Senator Lincoln and I believe that our bill will encourage Americans to invest in their futures and in their care, which is an important first step.

Specifically, our legislation will create a new type of savings mechanism for the purpose of preparing for the costs associated with long-term care services and purchasing long-term care insurance. An individual who establishes a long-term care trust account can contribute up to $5,000 per year to their account and receive a refundable 10 percent tax credit on that contribution. Interest accrued on these accounts will be tax free, and funds could be withdrawn for the purchase of long-term care insurance or to pay for long-term care services. Our bill also will allow an individual to make contributions to another person's Long-Term Care Trust Account. This will allow relatives to help their parents or a loved one prepare for their future health care needs.

The Centers for Medicare and Medicaid Services estimates that national spending for long-term care was more than $190 billion in 2004, representing about 12.5 percent of all personal health care expenditures. While those numbers already are staggering, we also know that the need for long-term care is expected to grow significantly in coming decades. Almost two-thirds of people receiving long-term care are over age 65, with this number expected to double by 2030. We also know that the population over age 85, those most likely to need long- term services and supports, is expected to increase more than 250 percent by 2040 from 4.3 million to 15.4 million.

Today, millions of Americans are receiving or are in need of long- term care services and supports. Surprisingly, more than 40 percent of persons receiving long-term care are between the ages of 18 and 64. Some were born with disabilities; others came to be disabled through accident or illness. No one can predict their long-term health care needs. Therefore, everyone needs to be prepared.

Currently, long-term care insurance is the main way to prepare for possible future care and support needs. Long-term care insurance helps protect assets and income from the devastating financial consequences of long-term health care costs. Today's comprehensive long-term care insurance policies allow consumers to choose from a variety of benefits and offer a wide range of coverage choices. They allow individuals to receive care in a variety of settings including nursing homes, home care, assisted living facilities and adult day care. Some of the most recent policies also provide a cash-benefit that a consumer can spend in the manner he or she chooses. When we buy long-term care insurance, we are also working to ensure that we can make more independent long- term care decisions and reduce the strain on state Medicaid budgets.

Unfortunately, for too many, the struggle to pay the immediate costs of long-term care insurance sometimes outweighs the security these products would provide. As Americans are spending more and saving less, I fear the American middle class is woefully unprepared to meet the coming challenges of their long-term care needs. Moving forward in our effort to help individuals prepare for life in their later years, we must encourage them to purchase long-term care insurance and save for long-term care services. The Long-Term Care Trust Account Act of 2007 is designed to achieve both goals.

It is my hope that this legislation will help all Americans save for their future and their independence during times of vulnerability. I urge my colleagues on both sides of the aisle to support this important bill.

I ask unanimous consent that the text of the bill be printed in the Record.