Senate Introduces Strong Privacy Bill

amigoro writes "US Senators introduced a bill that better protects the privacy of citizens' personal information in the face of data security breaches across the country. Key features of the bipartisan legislation include increasing criminal penalties for identity theft involving electronic personal data and making it a crime to intentionally or willfully conceal a security breach involving personal data."

A little late isn't it?

[AltGrendel]

I thought that horse was already out of the barn.

Fix it the right way

[Anonymous Coward]

Why isn't it fixed the right way? If the use of Social Security numbers by non-government agencies was ended then much of this would fix itself. Each company would likely pick a different number/id for each individual and it would partition the information. Then, stealing a single number wouldn't give you access to an entire individual.

Re:A little late isn't it?

[mr_matticus]

A few horses are out of the barn, but that doesn't mean someone shouldn't close the gate to keep the rest in.

So what are the implications

[o'reor]

concerning whistleblowers who want to draw attention on possible security breaches inside a company, and who've been hit on hard both by corporations and justice every time it happened so far ?

Would not pass.

[EveryNickIsTaken]

The bill would increase oversight of government programs to collect personal information on citizens. I wouldn't expect this bill to move anywhere right now, with the 2008 presidential candidates starting to gear up. Nobody wants to vote for a bill that would "Let the terrorists win."

Damned if you do, damned if you don't

[Anonymous Coward]

So what is it? Store everything to protect the children and hand it over to the ex-wife when she sues, or protect the privacy of your customers by not storing personal data?

Enforcement, not new laws

[imag0]

I happen to deal with a lot of regulated information (PHI with HIPPA, PCI in some environments as well). One thing that always astonishes me is not that security breaches happen (we're human, things happen), but that there is little to no reported repercussions from those losses.

It's one thing to have a security breach, but it's another one just to announce it, issue new cards to everyone and keep on working like nothing happened.

I think the best thing would be that the gov steps up to the plate and actually *enforce* the current laws and not spend our time and taxpayer money to create a new raft of laws that will end up never getting enforced in the first place.

Cheers,

imag0

Just an empty gesture

[140Mandak262Jamuna]

Nothing will come out of Senate to increase privacy. Remember CAN-SPAM act and how it stamped out all the spam emails? This bill will protect privacy exactly the same way. If you think this bill will improve privacy, contact me. I have 22 million dollars stuck in a bank in Nigeria. Help me get it out I will give you 33% of it. Please dont be greedy and steal all that 22 million dollars from me. OK?

Re:wait a minute, I'm confused

[SwedishPenguin]

Where have you been for the past few years? Republicans are very much in favor of invasion of privacy.
This is the party in favor of extending the invasions of privacy in the "Patriot act" and refused to even consider launching an investigation into Bush's warantless wiretapping.

Re:wait a minute, I'm confused

[gbulmash]

Isn't this the Republicans domain, increasing privacy?

Are you being sarcastic?

The Republicans have always positioned themselves as champions of law and order, and their favorite tool for it is intelligence gathering. Things like the Patriot Act as well as the warrantless wiretapping controversy just prove that out.

Both parties like to pick and choose which civil liberties they defend and which ones they attack in the name of fighting crime. While the Republicans are big on intelligence gathering at the expense of our right to privacy, the Democrats are big on gun control at the expense of our right to bear arms.

Re:Fix it the right way

[mwilliamson]

The SSN should be only considered as a gov't assigned userid. The government should now issue everyone in the USA a password and provide a government sponsored pluggable authentication system anyone could use for their company. Those using this system to authenticate customers would fund it. Password reset would be available at SSN offices only with verified photo ID. Lets end this bullshit once and for all and empower the end user to protect their identify credentials via at least a password, maybe even a RSA dongle.

What a wash...

[flajann]

While I respect Patrick Leahy and what he's generally been doing for privacy and rights of speech in the past, I consider it a wash to think that a bill will "protect" our security.

Raising criminal penalties for those commiting the breaches will not prevent them from happening (duh). Also, if the breacher is not within the jurisdiction of the US, it's pointless in any case.

It will give all false sense of security without addressing the real problems and issues regarding data security. The real issue is that our information is not secure, period. It is also an issue that creating really secure systems is a hard thing to do. But more important, "security" many times is an afterthought or has not been well throught through.

Any database on a machine connected to the Internet is a big security issue right up and front and center. And even if the database is not connected to the Internet, the weakness still lies with the employees and bureaucrats themselves and their approach to security.

Encryption of the data can solve many of these problems. Doesn't totally eliminate it, of course, but can at least put another roadblock in the way of breachers. A public key apprach, for instance, where the data is encrypted with one key before it hits the hard drive, but decrypted with another key only at the client computer requesting the information would go a long way to making breached data virtually useless. I used this approach in one system containing sensitive credit card information, and it worked quite well.

Ultimately, it is not bills and laws that will protect us, but well considered security policy and practices that will. And really, I'd actually like to see some penalties for those who are lax on the security front. We know that breaches will still occur even with the best laid plans of mice and men. Holding the implementors of these systems at least partially responsible, at least if it can be shown they were not diligent, would do much more to protect our privacy than some idle threat to lock the breacher away!

Re:Fix it the right way

[Silver Sloth]

Err... We Brits have exactly that. If you hack one of my bank accounts you haven't hacked them all. There is no reason for any one of my credit cards to know, or have anything in common, with any of my other credit cards. It works fine for us, we're not confused, credit report agencies work as well here as they do anywhere, and tax avoidance isn't a particular problem

I am not a number, I am a free man!

And long may it remain that way.

Re:A little late isn't it?

[TheMeuge]

I am just wondering when there will be a bipartisan legislative effort to institute mandatory minimums for violation of the constitution by congress or the executive.

It's not strong, esp. compared to Europe

[Nicolas MONNET]

It's extremely weak.

In Europe, basically, your personal information belongs to you. No one (with obvious *limited* exceptions for law enforcement and tax collection) can keep information about you without your knowledge & consent. You have a right to have your record erased / corrected. Infringers face jail time.

Re:wait a minute, I'm confused

[db32]

Exactly, the current crop of Republicans are failing absolutely to hold to any kind of Republican values. True Republican values does not involve this twisted religious bent on things, it advocates personal responsibility, no nanny state crap, no blame society crap. You screwed up making yourself poor by signing a 20% interest rate payday loan and Rent-to-own contracts to live above your means...not my problem to bail your ass out. (Now the fact is, most of the poor are poor by choice doing stupid crap like this and its a failure of the education system not teaching financial responsibility, the gap between rich and poor wouldn't be growing nearly as fast and eliminating the middle class if everyone didn't buy all their wizbang-gottahavits on credit...when it was normal to save for years for a house/car/stuff the gap was much smaller and the middle class was much larger)

Additionally traditional Republican values want lowered taxes (the current crop pay lipservice to this with tax cuts), but the financial responsibility part of low taxes involves less spending. Leaving the war out since that is a twisted mess of a wreck to begin with, we can see the bloat in HomeSec, TSA, and other such nonsense. Our state sponsored paranoia is costing us billions. Ironically the current Republicans bitch about how we are all doomed because the Democrats will break the bank on social programs, but as much as I disagree with most of those programs (ain't the governments problem, and sure as shit ain't mine, why should I have to pay taxes because some fat bastard needs a quadruple bypass that he can't afford because he eats McDonalds 18 times a day) at least they have more of a positive impact on society as a whole vs x-ray scans, anal probings and other such nonsense every time I go through an airport.

All in all the traditional Republican is more concerned about making the people take care of themselves instead of the government doing everything. This includes heathcare, legislating morality, church and state issues, the whole nine, ideally are handled outside of the government and outside of the federal budgets. This also includes not being Team America World Police. I can't figure out if I got modded as flamebait for making a joke about Republicans protecting big business or saying that I am mostly Republican (I am guessing the latter since this is /.)

Wow, yet again deterrence and punishment!

[uradu]

The cornerstones of American justice, which have reduced criminality in this country to practically zero. How about for a change doing something effective, like restricting the rights of companies from even OBTAINING data they don't need? If you don't have information to begin with, it's much harder to abuse. The level of unnecessary information collection in the US is mind boggling, yet you cannot usually question or refuse any such requests without being denied the service you're trying to obtain. European--in particular German--data privacy has historically been much, much more effective, because it approaches information on a need-to-know basis and empowers the citizen to refuse to provide information they deem unnecessary. Only recently have these systems started to weaken, primarily because they have been pressured into adopting some of the cavalier American attitudes towards data privacy, often under the guise of fighting terrorism or international crime (child pornography, money laundering, etc.)

Re:Fix it the right way

[nasor]

A much better solution would be for companies to simply stop pretending that knowing a social security number somehow magically proves that you are who you claim to be.

Re:wait a minute, I'm confused

[WhiplashII]

when it was normal to save for years for a house/car/stuff the gap was much smaller and the middle class was much larger

I wonder how much advertising/marketing had to do with this. After all, marketing has changed from "explaining how you fill a need" to "create a need and then fill it". Should marketing to certain segnments have government oversight?

(I'd say no - any government oversight is bad oversight by definition, but as you say the problem is education - and these people are getting their education from marketing departments...)

Re:That's a myth.

[homer_ca]

The myth of social mobility in the US is the relief valve that prevents violent revolution. We know rags to riches stories happen, but it's so rare that it very probably won't happen to you. Still, we see stories all the time, whether it's entertainers, athletes, lottery winners, or someone who got lucky with a small time business deal. As long as people think there's a chance for themselves, that the game isn't rigged, they won't turn against the system. I've seen my share of rags to riches stories since I went to some good schools growing up. There were a lot of smart kids from poor or ordinary families who got a chance from financial aid and merit scholarships to join the elites. There were even more smart kids from upper middle class and rich families who were already elite.

So next time someone points to a rags to riches story to show that hard work pays, get ready to call bullshit. If you're smart, talented and hard-working, you'll probably end up a little better than an average guy, but you won't get rich without a lot of luck. We may not have a rigid caste system or a formal system of hereditary nobles, but don't pretend that privilege doesn't exist.