The Personal Data Privacy Act

By Sarah D. Scalet

September 10, 2007 — CSO —

Incorporating feedback from CSOonline.com and proposed by attorneys Cynthia Larose and Stefani Watterson of the law firm Mintz, Levin

Purpose: To prevent the use of personally identifiable information in a way that is harmful to individuals and to provide for notice in the event of a breach of such information.

Definitions: 1. Business or businesses. All organizations (including, but not limited to, incorporations, partnerships, limited liability companies, sole proprietorships) engaged in interstate commerce.

2. Personally identifiable information. The name of an individual used in combination with Social Security number, drivers license number, passport number and two of the following: address, account number, date of birth, mothers maiden name or a unique biometric identifier.

3. Data breach. Unauthorized access to personally identifiable information that results in, or could result in, inappropriate use of the data. This does not include good faith acquisition of data.

Data breach notification: Any business that uses, stores or transfers personally identifiable information must notify all individuals whose personally identifiable information is compromised through a data breach. Notification must occur within 30 days of the breach and must be by either mail, phone or electronic means.

Safe harbor: Notification is not required if a business meets the industry standard for methods of encryption and the business has taken preventive measures to secure its systems and data.

Preventive measures: Businesses can meet the safe harbor if they have taken the following preventive measures:

1. Adopted established industry standards for data security and encryption.

2. Implemented an internal data security program that includes regular internal and external audits.

3. Implemented a regular employee education and training program to raise awareness of data security issues.

Use of Social Security numbers: By the year _____, businesses must phase out the use of Social Security numbers as a method of identification.

Enforcement: The attorney general or state attorneys general may bring a civil action against any business that violates the provisions of this act. Fines for violations shall not exceed $1,000 per day per individual whose personally identifiable information has been compromised. The maximum penalty per violation shall be $1,000,000.

No private cause of action: This act does not establish a private cause of action against any business for violations of the act.

Relation to state law: This act shall supersede any state law relating to notification of breach of personally identifiable information.