ISR News: CA To Expand Breach Notification
Excerpts From Blog.Wired.com
California State Sen. Joe Simitian, the man responsible in large part for the nation’s first data-breach notification law, has introduced new legislation that would require companies doing business in the the state to provide more information in their breach notification letters to consumers, and to send simultaneous notices to state authorities.
But Simitian said getting consumers compensated for data breaches isn’t high on the priority list for legislators. Simitian, speaking at the Security Breach Notification symposium in Berkeley, said the new legislation would force organizations that are breached to admit the extent of the compromise, and to provide consumers with enough information to determine on their own whether they face a risk of harm.
Such information, combined with simultaneous notification to state authorities, he said, would give law enforcement, researchers and others better data for understanding the nature and scope of the data breach problem instead of relying on reports from media outlets, which don’t cover every breach that occurs.
“Right now, there is already a significant deterrent [to reporting a breach] in terms of the shame and cost factor,” Simitian said. “If that cost becomes more significant, will people push it aside in the hope that no one will ever determine they had a breach?”
Simitian hoped the shame of reporting a breach would be an incentive for companies to improve their security. He also hoped consumers outside California would benefit from the law since, from a public relations perspective, it would be hard for a company that experienced a nationwide breach to notify consumers in California and not notify consumers in other states.
“The future of e-commerce is directly linked to the public’s confidence in online protection and data security,” he said. “Enlightened self-interest should have made the hi-tech industry an advocate rather than an adversary for this legislation.”
Filed under: Breach, Class Action Lawsuit, D&O Liability, Financial, Government, ISR News, identity-theft, privacy
Comments
Tell me what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!
