Insurers raise uniformity concerns about house data-security bill.

Insurers are raising questions about jurisdictional uniformity after a U.S. House panel approved legislation that would establish new federal data-security standards for the financial services industry.

The data-security bill sponsored by Rep. Steve LaTourette, R-Ohio, would amend the Fair Credit Reporting Act to require that financial services firms immediately investigate any possible breaches of consumer data and provide notification where the breach has the potential to cause harm or inconvenience.

The Financial Data Protection Act originally called for disclosure in cases of "substantial" harm, but LaTourette agreed to remove that language in response to concerns raised by consumer advocates that the designation was too vague and open to potential abuse.

However, questions remain about how the standards would be implemented and enforced for the insurance industry. LaTourette said his intention was to create a single national standard for notification, pre-empting a "patchwork quilt" of existing state laws.

But though the law would direct the U.S. Treasury Department, the Federal Reserve Board of Governors and the Federal Trade Commission to jointly implement standards and guidelines, it defers enforcement to each industry's "functional regulator." Because insurance is regulated at the state level, insurers remain unclear whether the standards would be implemented or interpreted uniformly across the United States.

Frank Keating, president and chief executive officer of the American Council of Life Insurers, said ACLI still is reviewing the final language but plans to continue working with the bill's drafters as it proceeds in the House.

"It is of utmost importance to ACLI member companies that the substantive requirements of any federal legislation relating to investigation and notification of security breaches be clearly and completely pre-emptive of state law applicable to life insurers," Keating said in a statement. "We still are reviewing the actions taken by the House Financial Services Committee over the past two days to determine whether the bill now accomplishes that goal."

Dennis Kelly, a spokesman for the American Insurance Association, said AIA also is seeking a "uniform national standard" and seeks further clarity on the bill's requirements for notification.

"Insurers should be allowed to notify policyholders as quickly as possible," Kelly said. "That should include a wide range of means of notification, including telephone, e-mail and regular mail."

But according to Charles E. Symington, senior vice president for government affairs and federal relations at the Independent Insurance Agents & Brokers of America, state insurance commissioners--rather than the Treasury Department or the FTC--are the best "functional regulators" to ensure compliance by the insurance industry.

"We strongly believe that this is the proper approach--using federal standards to establish uniformity in combating a very serious problem, but also relying on the expertise and strengths of state insurance regulators to enforce those standards," Symington said in a statement.