Congress I Need Your Help

You see, I and almost every other American have put a lot of trust into many companies. Some company or another has our credit card numbers, social security numbers, health records…etc. We’ve all seen those late night news magazines showing how devastating ID theft can be.

What’s worse is that most of these companies (outside of California and 22 other states), are not required to notify anyone if there is a data breach.

Currently Congress attempting to pass a bill (that is currently 10 proposed bills) that makes notification a federal law. One of the things being debated is:

What is the threshold for notification and who decides that?
(Some of the bills actually let the companies decide!!)

Congress needs to take a cue from California and New York, both of which have competent notification laws (that don’t let the companies decide what a data breach is, for one) and get something passed this year. Us in the security field can work to provide encryption and all sorts of other neat things to protect data, but as long as companies are allowed to sell our personal information and not disclose if it is stolen…a major problem exists for everyone. Kind of like getting an alarm system for your house and giving the key to someone who can make copies, sell them to anyone and they don’t have to tell you if one of the house keys is stolen or missing.

How secure is your house really then?