Intellectual Property Law

The Right Information-Security Systems for the U.S.

By mengj

There are two bills on the personal information data security issue right now: Rep. Rick Boucher’s draft bill, at http://www.boucher.house.gov/index.php?option=com_content&view=article&id=1957:boucher-stearns-release-discussion-draft-of-privacy-legislation-may-4-2010&catid=33&Itemid=41., requires “notice to and consent of an individual prior to” the collection of personal information.Sen. Dianne Feinstein introduced “Data Breach Notification Act,” S. 139, which requires organizations that have been breached to inform the data owners.

What is the right personal information security system for the U.S.? And should we let the government set the standards and impose requirements on businesses?

State level: Massachusetts enacted a risk-based approach regulation in 2009, which covers “any entity that owns or licenses personal information about a Massachusetts resident, both in paper and in electronic form, including ‘laptops or other portable devices.” It requires encryptions for “all transmitted records” and for “all personal information stored on laptops or other portable devices.”   Nevada (S.B. 227), Washington (H.B. 1149) have also enacted state regulations. The standards varies with each state.

Federal level: There is no all-encompassing federal law for the general class of personally identifiable information. The Fair Credit Reporting Act covers credit-card related information;

International level: The OECD’s seven governing principles on safeguarding security information is from 1980. At http://www.oecd.org/documentprint/0,3455,en_2649_34255_1815186_1_1_1_1,00.html.

Full post as published by BC Law Intell. Prop. & Tech. Forum on September 22, 2010 (boomark / email).