The Obama Administration’s Personal Data Notification & Protection Act: An Analysis

On January 12, 2015, President Obama proposed the Personal Data Notification & Protection Act, which would create a federal standard for data breach notification.¹ The proposed bill is part of a more wide-ranging effort by the Obama administration to shore up the nation's cybersecurity.² The measure comes at a time when both the public and private sectors, especially the retail and banking industries, have been under increasing attack by cyber criminals and state actors; the Sony hack attributed to North Korea is only the latest in a series of high-profile cyber incidents.

The Obama administration's draft bill follows a long line of legislative proposals that have failed to gain passage despite the rising incidence of high-profile data breaches. In just the last two years, five data breach notification bills were introduced in the Senate alone, yet none garnered sufficient support for passage.³ However, the public's heightened interest in the issue, combined with the