Introductory Statement on S. 495
Mr. President, today I am pleased to join Senator Specter in reintroducing the Leahy-Specter Personal Data Privacy and Security Act. This is a comprehensive data privacy package aimed at better protecting Americans' privacy. Senator…
Mr. President, today I am pleased to join Senator Specter in reintroducing the Leahy-Specter Personal Data Privacy and Security Act. This is a comprehensive data privacy package aimed at better protecting Americans' privacy. Senator Specter has been a valuable partner on this, and I also thank Majority Leader Reid for his leadership and commitment to enacting data privacy legislation this year.
When Senator Specter and I introduced this bill in 2005, we had high hopes of bringing urgently needed data privacy reforms to the American people. The Judiciary Committee reported this bill favorably in November of 2005, but with the last Congress, it simply sat on the calendar. The leadership would not bring it forward.
The irony is while they refused to bring it forward, the problems of data breaches remained a persistent and pernicious threat to Americans' privacy. Yesterday we learned that the Department of Veterans Affairs has lost a portable hard drive containing the sensitive personal information on as many as 48,000 veterans. I can imagine what the veterans in my State feel about that. I can imagine what the veterans in Montana feel about that.
Last week, there was a major data breach involving a State computer server in my home State of Vermont. It jeopardized the financial data of at least 69,000 Vermonters whose personal financial information had been stored on the computer used by the Vermont Agency of Human Services. Can you imagine 69,000 people, in a State of barely over 600,000 people.
This is not unique to Vermont. Last month mega retailer TJX disclosed that it suffered a major computer breach involving credit and debt card purchases involving possibly hundreds of thousands of American consumers. And, even as disturbing as that is, while they knew about the breach in mid-December, none of those customers were told about it until a month later. It is as if a thief had gone to each one of their houses and stolen their data.
Of course, all of this comes on the heels of the theft of the personal data of 26.5 million of our veterans and active-duty personnel at the VA last year. Think about this: You are a man or a woman serving your country in Afghanistan or Iraq, and this information is stolen-- with data about where you live and what family members are left at home while you are overseas. How do you think that makes you feel?
According to the Privacy Rights Clearinghouse, more than 100 million records containing sensitive personal information have been involved in data security breaches since 2005. We need strong Federal data privacy and security laws to protect Americans' personal data, and to address the ills of lax data security.
Our bill requires that data brokers let consumers know what sensitive personal information they have about them and to allow individuals to correct this. It is a simple matter of fairness. There is a clear precedent for our approach in the credit reporting context. Our bill also requires that companies who have databases with sensitive personal information about Americans establish and implement data privacy and security programs. In the information age, any company that wants to be trusted by the public must earn that trust by vigilantly protecting the databases that they use and maintain. In addition, our bill requires notice when sensitive personal information has been compromised. The American people need to know when they may be exposed to a data breach. Whether it is a government agency or a private company, if they lose your sensitive information, your Social Security number, your address, or anything about you,
you have a right to know. If they are holding that information about you, and they lose it, you have the right to know it has been lost.
We also have tough criminal penalties for anyone who would intentionally or willfully conceal the fact that a data breach has occurred when that breach causes economic damage to consumers.
Then finally, we address the important issue of the Government's use of personal data. This would require Federal agencies to notify affected individuals when Government data breaches occur.
We should never have to worry about our Government having this information on us and losing it, but certainly in the last 2 or 3 years, we have seen so many millions of files that have been lost or put in jeopardy. We live in a world in which our Government also is increasingly turning to the private sector to get personal data that they, in some instances, couldn't legally get on their own. To address this, our bill puts protecting Americans' privacy first and foremost: Government data has to be protected and we have to know if the Government falls down on the job.
This is a comprehensive bill. It not only deals with the need to provide Americans notice when they have been victims of a data breach, it also deals with the underlying problems of lack of security and lack of accountability to prevent data breaches from occurring in the first place.
Today, Americans live in a world where their most sensitive personal information can be accessed and sold to the highest bidder with a few keystrokes on their computer. Our privacy laws greatly lag behind both the capabilities of our technology and the cunning of identity thieves. This legislation closes that gap. I commend the leadership for being willing to bring up our data privacy bill. I wish that the leadership in the last Congress had brought this bill up last year. But, I am glad that the new leadership will do so this year.
For the sake of all Americans, I urge all Senators to support this legislation and to act now to pass comprehensive data privacy and security legislation.
I ask unanimous consent that the text of the bill be printed in the Record.