The U.S. Senate is considering a new U.S. federal privacy breach
notification law, entitled The Data Security and Breach Notification Act of
2012. The Bill is currently before the Committee on Commerce,
Science and Transportation.
If enacted, the Bill would apply to organizations over which the
U.S. Federal Trade Commission has authority ("covered
entities"). For these organizations, the Bill's provisions
would pre-empt a patch-work of state laws dealing with privacy
breach notification. It would not regulate financial institutions
or certain health care institutions that are governed by other U.S.
federal legislation.
Notably, the Bill recognizes the reality of the outsourcing of
data processing and integrates that into a hierarchy of
responsibilities so that data breach notification can be
implemented in an organized way. The following are some of the
highlights of the Bill:
