Data security bill loosens notification requirements.

Insurers and other businesses would be subject to less burdensome data-security notification requirements under the terms of a bill filed by Sen. Dianne Feinstein, D-Calif.

The Notification of Risk to Personal Data Act, S. 239, would be a boon to businesses that have complained that state laws requiring blanket notifications of data-security breaches are costly and onerous. Feinstein's bill would require businesses and government agencies alike to tell people without "unreasonable delay" if their data has been compromised, but exemptions are broad, and the bill preempts state notification laws, most of which are stronger than Feinstein's measure.

The bill requires "any agency, or business entity engaged in interstate commerce, that uses, accesses, transmits, stores, disposes of or collects sensitive personally identifiable information" to notify anyone in the United States if their private information has been accessed, or even if it is "reasonably believed to have been" compromised.

Yet businesses need not make the disclosure if a "risk assessment" concludes that there is no "significant" risk that the breach has caused any harm, according to the bill. A company would then have to tell the U.S. Secret Service within 45 days of the discovery of the breach that it has decided to invoke the "risk assessment" exemption, and provide the results of that assessment. The Secret Service would be tasked with oversight; the agency could, within 10 days, tell the company that notice of the security breach should be given.

At the same time, law enforcement agencies, which are also subject to the legislation, would not be required to tell people of a breach if the agency decides that notification would hinder an investigation or jeopardize national security. The business or government agency involved in a data breach would also have to notify major media outlets if the number of people affected is more than 5,000.

Feinstein introduced similar legislation in November 2005. That bill passed the Senate Judiciary Committee but failed to make it to a vote before the full Senate. "Since then, the problem of identity theft has worsened," Feinstein said from the Senate floor. "There have been numerous large-scale data security breaches involving companies, federal agencies, and universities. We cannot afford to keep waiting to act."

According to the Privacy Rights Clearinghouse, there have been data-security breaches involving more than 100 million personal records, involving many of the country's corporate giants, such as Bank of America, Boeing, Ford Motor Co., Veriton, and Wells Fargo, among others.

A widely publicized security breach at data aggregator ChoicePoint Inc. in February 2005 spurred lawmakers in statehouses across the country to try to address the problem. Nevertheless, a number of significant data-security breaches have made headlines since then.

In February 2006, a U.S. Agriculture Department contractor responding to a request for public information accidentally released the Social Security and tax identification numbers of about 350,000 tobacco farmers. In March 2006, a hacker obtained the Social Security numbers and banking information of about 570,000 Georgia state retirees. In May 2006, a Department of Veterans Affairs employee's laptop containing the names, birth dates, and Social Security numbers of 26.5 million veterans was stolen from his car. That information was later recovered,