Mr. President, today we introduce the Specter-Leahy Personal Data Privacy and Security Act of 2005. Reforms are urgently needed to protect Americans' privacy and to secure their personal data. There have been steady waves of security…
Mr. President, today we introduce the Specter-Leahy Personal Data Privacy and Security Act of 2005. Reforms are urgently needed to protect Americans' privacy and to secure their personal data. There have been steady waves of security breaches over the past 6 months, with the latest involving a database containing 40 million credit card numbers at a company that most Americans never knew existed.
These security breaches are a window on a broader, more challenging trend. Advanced technologies have improved our lives and can help make us safer. Private data about Americans has become a hot commodity. This personal and financial information about each of us suddenly is a treasure trove, valuable and vulnerable, but our privacy and security laws have not kept pace. The reality is that in the digital era, a robust market has developed for collecting and selling personal information. Today, all types of corporate and governmental entities routinely traffic in billions of digitized personal records about Americans.
The data broker market has exploded in size to meet this demand. Insecure databases are now low-hanging fruit for hackers looking to steal identities and commit fraud. We are seeing a rise
in organized rings that target personal data to sell in online, virtual bazaars.
In this information-saturated age, the use of personal data has significant consequences for every American. People have lost jobs, mortgages and control over their credit and identities because personal information has been mishandled or listed incorrectly. This trend raises new threats to our personal security as well as to our privacy. In one disturbing case, a stalker purchased the Social Security number of a woman with whom he was obsessed, used that information to track her down. He killed her, and then shot himself.
Americans everywhere are wondering, ``Why do all these companies have my personal information? What are they doing with it? Why aren't they protecting it better?'' And they are right to wonder. It is time for Congress to catch up with the data market and to show the American people that we are aware of these threats and will protect the privacy and security of their personal information.
Chairman Specter and I have worked closely together over many months to craft comprehensive legislation to fix key vulnerabilities in our information economy. We thought through these issues carefully and took the time needed to develop well-balanced, focused legislation that provides strong protections where necessary. We also provide tough penalties and consequences for failing to protect Americans' most personal information. Reforms like these are long overdue. This issue and our legislation deserve to become a key part of this year's domestic agenda so that we can achieve some positive changes in areas that affect the everyday lives of Americans.
First, our bill requires data brokers to let people know what information they have about them, and to allow people to correct inaccurate information. These principles have precedent from the credit report context, and we have adapted them in a way that makes sense for the data brokering industry. It's a simple matter of fairness.
Second, we would require companies that have databases with personal information on Americans to establish and implement data privacy and security programs. Any company that wants to be trusted by the public in this day and age must vigilantly protect databases housing Americans' private data. They also have a responsibility in the next link in the security chain, to make sure that contractors hired to process data are on the up-and-up and secure. This is critical as Americans' personal information is increasingly processed overseas.
Third, our bill requires notice when sensitive personal information has been compromised. The American people have a right to know when they are at risk because of corporate failures to protect their data, or when a criminal has infiltrated data systems. The notice rules in our bill were crafted carefully to ensure that the trigger for notice is tied to risk and to recognize important fraud prevention techniques that already exist. But our priority was making sure that victims have that critical information as a roadmap providing the assistance necessary to protect themselves, their families and their financial well-being.
Fourth, our bill provides tough new protections for Social Security numbers, which are the keys to unlocking so much of our financial and personal lives. The use of Social Security numbers has expanded well beyond the intended purposes. Some uses provide important benefits, but others have made Americans vulnerable. Social Security numbers are for sale online for small fees. Earlier this year, it was reported that a payroll and benefits company put the Social Security numbers of 1,000 workers on postcards--on postcards--brazenly visible for anyone to see. Worse still, those postcards described in detail how those Social Security numbers could be used to access employee benefits online. This is unacceptable, and this bill would make that kind of disregard and sloppiness illegal.
Finally, our bill addresses the government's use of personal data. We are living in a world where the government is increasingly looking to the private sector to get personal data that it could not legally collect on its own without oversight and appropriate protections. So ingrained has the data broker-government partnership become that a ChoicePoint executive stated, ``We do act as an intelligence agency, gathering data, applying analytics.'' While these relationships can help protect us, there must be oversight and appropriate protections.
The recent decision to award ChoicePoint an IRS contract highlights this tension. It is especially galling right now to be rewarding firms that have been so careless with the public's confidential information. The dust has not yet settled and the investigations are incomplete on ChoicePoint's lax security practices. We should at least take a pause before rewarding such missteps with even more government contracts. This bill would place privacy and security front and center in evaluating whether data brokers can be trusted with government contracts that involve sensitive information about the American people. It would require contract reviews that include these considerations, audits to ensure good practice, and contract penalties for failure to protect data privacy and security.
The Specter-Leahy legislation meets other key goals. It provides tough monetary and criminal penalties for compromising personal data or failing to provide necessary protections. This creates an incentive for companies to protect personal information, especially when there is no commercial relationship between individuals and companies using their data.
Our legislation also carefully balances the need for Federal uniformity and State leadership. States are often on the forefront of protecting privacy and spurring change. The California security breach law has been an important lesson. My State of Vermont was among the first--if not the first--to require individual consent before sharing financial information with third parties, and to require a person or business to obtain consent from individuals before reviewing their credit reports. The role of States is important, and our bill identifies areas that require uniformity while leaving the States free to act elsewhere as they see fit. We also would authorize an additional $100 million over 4 years to help state law enforcement fight misuse of personal information.
This is a solid bill--a comprehensive bill--that not only deals with providing Americans notice when they have already been hurt, but also deals with the underlying problem of lax security and lack of accountability in dealing with their most personal and private information.
I commend Senator Specter for his leadership on this emerging problem. A number of us have been working on these issues--Senator Feinstein, Senator Nelson, Senator Cantwell and Senator Schumer, among others. I appreciate and recognize their hard work and look forward to making progress together. I am pleased to work closely with Senator Specter on this and believe that we have a bill that significantly advances the ball in protecting Americans.
I ask unanimous consent that a copy of the bill be printed in the Record.
Mr. President, along with Senator Collins and 28 of our colleagues, today I am introducing this resolution to halt the Bush administration's flawed and dangerous new rule on toxic mercury emissions. I am pleased that another leading cosponsor of this resolution is the ranking member of the Committee on Environment and Public Works, Senator Jeffords.
The Bush administration's new rule will continue to allow mercury, a substance so toxic that it causes birth defects and IQ loss, to continue to poison children and pregnant women. This disastrous rule should not be allowed to stand as the law of the land.
The bipartisan work that produced the Clean Air Act and the 1990 amendments established a process for us to begin cleaning up the toxic mercury spewing out of dirty power plants across the country. The 1990 amendments require the Environmental Protection Agency, EPA, to control each power plant's emissions of mercury and other toxics by 2008 at the latest. The act requires each plant to use the ``maximum achievable control technology'' on every generating unit. That is the law of the land. Anything less means more pollution.
But instead of working to enforce and implement the Clean Air Act, as two previous administrations had, the Bush administration has turned the Clean Air Act on its head. With this rule the administration revokes a 2000 EPA finding that it is ``necessary and appropriate'' to require that each power plant apply technology to reduce mercury emissions.
Let me repeat those plain, startling facts: By revoking the earlier EPA finding and deciding instead to coddle the biggest mercury polluters, the administration is saying it is no longer necessary or appropriate to adequately control mercury emissions. Although I am somewhat impressed that they can make this statement with straight faces, I am appalled at their audacious disregard for the health of the American people, and, like the scientific community, I am baffled by their gymnastic arguments.
The plain and simple truth is that this rule will allow more mercury into our environment than does the current law. Hundreds of the oldest, dirtiest power plants will not even control mercury emissions for more than a decade. That is what this rule gives us: More pollution, for longer than the Clean Air Act allows.
This rule is all the more shameful because the evidence of public health and environmental damage from mercury and other toxics is clear enough for action right now. We do not need to wait 10 or 20 years to know the facts about mercury's threats to human health. In fact EPA itself admits these threats. Look at EPA's own estimate of the number of newborns at risk of elevated mercury exposure, which has doubled to 630,000. EPA also found that 1 in 6 pregnant women has mercury levels in her blood above EPA's safe threshold. The National Academy of Sciences has confirmed scientific research showing that maternal consumption of unsafe levels of mercury in fish can cause neuro- developmental harm in children, resulting in learning disabilities, poor motor function, mental retardation, seizures and cerebral palsy.
Yet it seems the majority in Congress and this administration want to avoid any public daylight on this flawed rule. The Environment and Public Works Committee has refused to even hold a single hearing on this rule. Their aim is to keep the public in the dark, and I would guess that most Americans in fact do not yet know what EPA and the big polluters have been up to with this rule.
One reason for the administration's lack of candor clearly is the discovery that this rule has polluting industries' fingerprints all over it. EPA's first proposal for these rules lifted exact texts from memorandum provided by utility industry lobbyists. Another reason may be because the American people would find a process where the lobbyists are shut in and the public is shut out, where the scientific and economic analysis was manipulated, and where the public's health was ignored.
But the administration's arrogance does not stop there. EPA's own inspector general and the Government Accountability Office criticized almost every aspect of how EPA drafted this rule. Unfortunately, their recommendations to improve it were also ignored. So were more than 680,000 public comments--a record for any EPA rule. So were the comments of many state environment departments, attorneys general, doctors, educators, sportsmen groups and EPA's own advisory committees. And, although it should not come as a surprise after 4 years working with this administration, the comments of 45 Senate and 184 House members were also ignored.
Many of us in the Senate have spent the past 2 years--working with 3 different administrators--trying to make the administration follow the Clean Air Act and produce a rule that puts the public's health over the profits of special interests. A rule that heeds the science and encourages available technologies to solve this problem. They failed on all fronts, big time.
Instead they produced a rule that will do nothing for at least a decade, despite years of analysis by EPA showing the need for quick action. According to EPA's own regulatory impact analysis, we will be lucky if 1 percent of power plant capacity will have mercury controls by 2015, and only 3 percent by 2020.
As a Vermonter I know it is ``appropriate and necessary'' to limit the pollution plumes from grandfathered power plants. You cannot even see my state on EPA's maps showing mercury pollution because so much of it is being dumped on us from upwind power plants. Vermonters and New Englanders have been waiting for decades for EPA to take action so that our lakes can be cleaned up.
For all their talk of family values, the administration has yet again put the value of corporate contributions--not families--first. It is not a family value to tell a whole generation of women that their health is not important. It is not a family value to put another generation of young kids at risk of learning disabilities. These mercury rules do just that.
It is time to put people first, and to stop letting the big polluters and the special interests write the rules and run the show over at EPA.
This resolution will ensure that the health and safety of U.S. citizens are fully considered, before EPA rescinds its commitment to protect public health from the dangers of mercury pollution. To leave mercury pollution from power plants as the only source of toxic air pollution that is allowed to avoid rigorous emissions standards under the Clean Air Act is a risk to the public's health that we need not, and should not, accept.
I urge my colleagues to support this resolution.