The Utah senator's bill is among at least 17 pending in Congress, many of which were initiated at the request of companies which find it difficult to deal with strict state laws enacted to protect consumer privacy and which hold businesses accountable when security fails, as it too often does.
Since 2004, security to protect nearly 90 million personal records has been breached. In 2005 the personal information of 140,000 people was stolen from a database run by the data-collection company ChoicePoint. The information is valuable to a new brand of criminals who have made identity theft the fastest-growing crime in this country, costing Americans nearly $53 billion a year.
In response to these lapses, 31 states, including Utah, have wisely passed laws requiring tighter security controls, notification of the people whose information has been lost, credit freezes and, sometimes, penalties against the companies.
Utah's law, passed this year, makes companies responsible for keeping personal data secure and letting customers know whenever their information has been tapped inappropriately.
Bennett's law would unwisely replace tougher state laws, such as Utah's, with a federal standard that would often keep consumers ignorant about whether their own data had been compromised, as it would allow companies to decide whether to notify their customers about security breaches.
Bennett's proposal would also unduly protect businesses at the expense of consumers by prohibiting lawsuits against a company for not adequately securing data or mishandling a breach. It also - incredibly - would prevent state attorneys general from filing charges against a company for failing to comply with the law.
We can buy Bennett's argument that a federal data-security law covering all states could help prevent identity theft, as this crime and those who perpetrate it move across state boundaries.
But any uniform federal law should incorporate the best of existing laws and allow the states to adopt even tougher statutes. Bennett's proposal does neither.
