A massive security breach at the U.S. Department of Veterans
Affairs (VA) this month may refocus Congress on stalled data breach
legislation, some backers of the legislation said.
The VA data theft, involving the unencrypted personal records of
26.5 million military veterans and their spouses, lead to a
management shakeup at the VA last week. Several members of Congress
are calling on colleagues to move ahead with bills that would
require breached companies to report losses to affected
customers.
More than 10 data breach bills have been introduced in Congress
since 2005, but none has made it through in the last year. Congress
is scheduled to adjourn for the year in early October, and any
bills not passed by then would have to be reintroduced in 2007.
The VA data theft happened May 3 after a break-in at a VA
analyst's home. The analyst had taken home the database of
veterans' names, dates of birth, Social Security numbers, and some
health records to work on a project, according to the VA.
Data breaches like the VA's highlight the need for data breach
legislation, Representative Cliff Stearns, a Florida Republican and
sponsor of another data breach notification bill, said in a
statement. Stearns said his bill, which also requires the U.S.
Federal Trade Commission to create data-handling rules, "goes to
the heart of this problem of the critical need to protect
consumers' personal information."
Some observers see the VA data theft as a wake-up call for
Congress, but that still doesn't mean that any legislation will
pass this year, especially with multiple bills to reconcile, said
Ari Schwartz , deputy director at the Center for Democracy and
Technology (CDT).
"The politics are very complex and there is not that much time
left," he said.
icon.
