RealTime IT News

States Lead Congress on Breach Protections

As Congress holds hearings, press conferences and otherwise wrings its hands over the onslaught of data breaches and resulting identity theft, states are taking action. And California is leading the pack.

It was the California Legislature, after all, that passed a seminal data-breach disclosure law in 2003. Only because of that legislation, millions of Americans have been informed that their personal data might be in the hands of identity thieves.

Earlier this year, Congress decided California might be onto something. But now Congress is still dithering while states continue to pass laws.

California, for instance, didn't stop at a breach disclosure law. It also passed the nation's first credit file freeze law. Since then, nine other states -- Texas, Louisiana, Vermont, Colorado, Connecticut, Illinois, Maine, Nevada and Washington -- enacted credit file freeze laws.

That's the sort of momentum that catches Congress' attention, as well as that of credit bureaus, banks and think tanks that dread the prospect of myriad regulations that vary from state to state.

"File freeze legislation enacted in the states gives roughly one-third of all Americans some ability to freeze their credit report. These laws, however, are all over the map," Michael Turner, president and senior scholar at the Information Policy Institute, states in a new white paper.

Turner adds, "Given the existence of national credit markets and national credit reporting laws, it is sensible that all Americans enjoy the same ability to add another layer of control over who may access and use their personal credit information."

In other words, Turner wants a national law pre-empting any state laws. The Identity Theft Protection Act passed by the Senate Commerce Committee in July may be that ticket.

The proposed law requires data brokers, government agencies and educational institutions to disclose breaches to consumers if there is a "reasonable" risk of identity theft.

Once informed of a breach, some in Congress want to follow the states and give consumers rights to freeze their credit files.

"Ideally, an efficient credit freeze law benefits individuals, credit bureaus and lenders," Turner writes. "Individuals would benefit from additional protection against identity fraud. Bureaus would benefit from reduced inaccuracies in credit files … and lenders would benefit from diminished fraud costs."

Opponents of credit file freezing, primarily the entire business community, argue that consumers will lose out on discounts by not being able to apply for store credit cards or will miss the opportunity to purchase a house or a car when they cannot immediately access their credit.

Security experts worry credit file freeze legislation will simply give identity thieves another data platform to crack, freezing and unfreezing the files of identities they've swiped. Ironically, it appears, identity thieves could use a consumer protection tool to elude detection.

"The alarmist scenario of an identity thief taking over someone's identity so thoroughly as to control their entire account line and credit history is unlikely," Turner claims, pointing out that individuals with frozen files will still be able to access their credit reports with a PIN or some other access and verification system.

According to Turner, predictions of a consumer wholesale rush to freeze files will not result in businesses losing sales. Fewer than 2,000 Californians, he notes, have asked to have their files frozen. California, though, requires a mailed request to freeze files.

"Should individuals be able to freeze their credit files through the Internet or the telephone, the percentage of ID fraud victims who elect to freeze their files could increase significantly," he wrote.

Congress will have to sort out all of this when it returns to work after the Labor Day holiday. And while Congress spends time debating, as many as 12 more states are expected to move forward with freeze laws in the near future.