Parties Split on Data-Protection Bill

House Democrats and Republicans split sharply yesterday over how to best protect consumers' personal data, as legislation to curb the persistent scourge of identity theft and fraud began to move on a fast track on Capitol Hill.

In a 13 to 8 vote along party lines, a subcommittee of the House Energy and Commerce Committee approved a bill that would require information brokers to submit plans for safeguarding private data to the Federal Trade Commission for monitoring and review.

The bill also would establish the first nationwide requirement for notification of consumers when certain breaches of data occur and would force brokers to submit to security audits if their data banks are compromised.

But Democrats on the panel said the bill was filled with loopholes and would leave consumers protected than they are now. They also accused the Republicans of shutting them out of bipartisan negotiations, and of making last-minute changes to agreed-upon provisions.

Under the bill, data brokers and other firms that store consumer data would have to notify consumers that their information [ TO BREACH ] only when it was determined that a "significant risk" of identity theft or other fraud might result.

That decision would be made by the company that was breached, which Democrats said was akin to having no requirement at all.

This year alone, tens of millions of consumers have been notified of breaches at information brokers such as ChoicePoint Inc. and LexisNexis, financial institutions, government agencies, universities, online retailers and other firms.

Many notices were sent out under a California law that covers any firm doing business in the state.

"No notices would have gone out under the standard put forth in this bill," which would preempt state laws, said Rep. Janice D. Schakowsky (D-Ill.). "We would not have known how badly corporations treat personal information, nor would consumers have been able to take action to protect themselves - even from financial identity theft - if this bill had been in place in February 2005."

Data brokers, direct marketers, financial institutions and several large technology companies supported the approach of the bill, as did FTC Chairman Deborah P. Majoras. They argue that thieves or hackers cannot always use data they might gain access to, and that bombarding consumers with notices every time a breach occurs would cause people to ignore them.

"That concern is disingenuous," Schakowsky said yesterday. "The right response to over-notification is not to restrict information and to keep consumers and Congress in the dark. If we want to stop over-notification, then corporations need to clean up their act so consumers' personal information is not compromised in the first place."

(Adapted from washingtonpost.com)