![\"\"](\"\/dome\/files\/2018\/07\/images.jpeg\")
<\/a><\/p>\nA vast majority of states<\/a> have laws on the books requiring a breached company to take some kind of action after a security breach. These laws define \u201cpersonal information\u201d and require that notice of the breach is given to either breached consumers or a state government entity such as the Attorney. States wielding their police power<\/a> to regulate the response to data breach incidents makes sense because data breach litigation is usually focused upon a theory involving negligence, privacy invasion, or breach of a fiduciary duty (Solove & Citron, at 8<\/a>). Each of these causes of action are firmly rooted in state law. Yet, the patchwork approach to data breach legislation leaves many companies scrambling to comply with very different laws<\/a> in the various jurisdictions where individuals with breached data reside.<\/p>\n Yet, many data breaches end up litigated in federal court. The most common reason for this is the Class Action Fairness Act (28 U.S.C. \u00a7\u00a7 1332(d), 1453(b); \u201cCAFA<\/a>\u201d), which provides a federal forum to claims where the parties maintain minimum diversity (at least one plaintiff located in a state different from at least one defendant) and an amount in controversy of at least $5 million. Because many data breaches impact a disparate plaintiff class residing throughout the country, and because the sought-after remedy is much larger than $5 million, these cases are frequently removed<\/a> to federal court.<\/p>\n Other data breaches are litigated in federal court from the start, with causes of action arising under federal statutes. Claims are often brought under Fair Credit Reporting Act (15 U.S.C. \u00a7 1681 et seq.<\/a>, \u201cFCRA\u201d), which requires companies that send information to credit reporting agencies to take \u201creasonable procedures\u201d to protect the confidentiality of sensitive personal information. The federal government also regulates data security in several industries, including the healthcare industry through the Health Insurance Portability and Accountability Act (Pub. L. 104\u2013191<\/a>, \u201cHIPPA\u201d) and the financial services industry through the Gramm-Leach-Bliley Act (Pub. L. 106\u2013102<\/a>, \u201cGLBA\u201d). Lastly, the Federal Trade Commission (\u201cFTC\u201d) regulates some data security matters pursuant to the agency\u2019s authority to prosecute unfair competition<\/a>.<\/p>\n These statutes make clear that the federal government has some role to play in the data security sphere, and with good reason \u2013 data security can quickly become a matter of national security. First, many data breaches are thought to involve state-sponsored actors<\/a>, implicating international law and sovereignty concerns. Next, data breaches can give rise to other federal crimes, including identity fraud (Internet Research Agency Indictment<\/a>; Counts 3-8 at \u00b6\u00b6 96-98). When that identity fraud was apparently perpetrated with an intent to interfere in America\u2019s free and democratic elections, the concern is only exacerbated.<\/p>\n So, what can Congress do to address this issue? While the problem is very complex and requires an equally complex response, Congress often prefers to address problems in a piecemeal fashion. There have been two bills put forth, one from Senators Nelson, Blumenthal, and Baldwin<\/a>, and another from Senators Warren and Warner<\/a>. It is important to note that the two bills cover different topics under the greater umbrella of data privacy \u2013 they are not mutually exclusive and they are not merely two different solutions to a single problem.<\/p>\n Senator Nelson\u2019s bill, called the Data Security and Breach Notification Act, would require the FTC to establish minimum \u201cpolicies and procedures regarding information security practices for the treatment and protection of personal information.\u201d \u00a7 2(a)(1)<\/a>. This bill includes provisions that exempt financial institutions in compliance with GLBA, but it covers a large number of different organizations and industries. It also creates a series of new penalty provisions authorizing fines up to $5 million for infractions. Notably, \u00a7 7(a)<\/a> dictates that this bill would preempt state information security laws. This provision is sure to be unpopular with certain states, especially those (like Massachusetts) that have been proactive in regulating data at the state level (see the testimony of Sara Cable, Assistant Mass. AG, to the U.S. House of Representatives\u2019 Financial Services Committee, Part II.C, page 4<\/a>).<\/p>\n Senator Warren\u2019s bill has a narrower scope, addressing only \u201ccredit reporting agencies\u201d with annual revenue \u201cnot less than $7 [million]\u201d. \u00a7 2(4). After the Equifax breach<\/a> announced in the Fall of 2017, the credit reporting agencies themselves became the focus of new scrutiny. Given the immense volume of sensitive information that these agencies possess, and their critical role in our financial system, it makes sense that these entities should satisfy more exacting standards. Senator Warren\u2019s bill would establish an \u201cOffice of Cybersecurity\u201d within the FTC, and that office would be charged with promulgating regulations and investigating non-compliance with those regulations. \u00a7\u00a7 3(b)(B), (D)<\/a>. The bill also contains a fairly restrictive notification requirement \u2013 mandating that covered credit reporting agencies alert customers within 10 days after a breach. \u00a7 4(a)<\/a>. Such notification requirements present interesting policy question. On the one hand, the sooner customers know of a breach, the sooner they can take action to prevent identity theft and fraudulent use of their finances. On the other hand, in countries like Australia that have recently implemented mandatory notification laws, companies have expressed concern that such a notification would amount to an \u201cadmission of guilt<\/a>\u201d that may come back to haunt the company in subsequent litigation.<\/p>\n Though there are many issues underlying data privacy and security, one thing is clear \u2013 something must be done. Because these bills address different areas of cybersecurity, they should both pass. Even if that were to happen, much more needs to be done. States undoubtedly have an important role to play, but it is much faster and more efficient for federal legislation to address an issue like this that impacts citizens nationwide. But, what precisely needs to be done, however, is a much more complex question. The 115th<\/sup> Congress has been derided for its lack of action on many important issues, including an immigration fix for DACA recipients<\/a> and addressing firearms in the aftermath of the Parkland shooting<\/a>. So, will anything actually happen? Only time will tell.<\/p>\n