	Data Breaches

A data breach occurs when there is a loss or theft of, or other unauthorized access to, data containing sensitive personal information that results in the potential compromise of the confidentiality or integrity of data. In response to state security breach notification laws enacted thereafter in numerous jurisdictions, over 2,676 data breaches and computer intrusions have been disclosed by the nation's largest data brokers, businesses, retailers, educational institutions, government and military agencies, healthcare providers, financial institutions, nonprofit organizations, utility companies, and Internet businesses. In February 2005, the data broker ChoicePoint disclosed a security breach, as required by the California Security Breach Act, involving the personal information of 163,000 persons. Identity theft involves the misuse of any individually identifying information to commit a violation of federal or state law. State Security Breach Notification Laws

The imposition of data security and security breach notification obligations on entities that own, possess, or license personal information is a recent phenomenon. The majority of states have enacted laws requiring notice of security breaches of personal data. As of January 2012, 46 states, the District of Columbia, Puerto Rico, and the Virgin Islands have enacted laws requiring notification of security breaches involving personal information. Security breach notification laws typically include definitions for "personal information" or "personally identifiable information." In information privacy law, there is no uniform definition of "personally identifiable information." Federal regulations were issued to implement information security programs and provide standards for security breach notice to affected persons. Federal departments and agencies are obligated by memorandum to provide breach notification, while the Department of Veterans Affairs is statutorily obligated to do so. Other federal laws and regulations, such as the Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act (GLBA), require private sector entities to maintain security safeguards to ensure the confidentiality, integrity, and availability of personal information, and require notification of security breaches. Others distinguish between private data held by the government and private data held by others, and advocate a higher duty of care for governments with respect to sensitive personal information in the U.S. public sector and to data breaches. This section describes information security and data breach notification requirements included in the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act, and the Health Information Technology for Economic and Clinical Health Act. Because some of the federal security breach notification bills would also apply to federal agencies, we are including an overview of the Office of Management and Budget's "Breach Notification Policy" for federal agencies. Gramm-Leach-Bliley Act (GLBA)

Title V of the Gramm-Leach-Bliley Act of 1999 (GLBA) requires financial institutions to provide customers with notice of their privacy policies and requires financial institutions to safeguard the security and confidentiality of customer information, to protect against any anticipated threats or hazards to the security or integrity of such records, and to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer. Using its authority under the Safeguards Rule, the commission has brought a number of enforcement actions to address the failure to provide reasonable and appropriate security to protect consumer information.
A data security breach occurs when there is a loss or theft of, or other unauthorized access to, sensitive personally identifiable information that could result in the potential compromise of the confidentiality or integrity of data. Forty-six states, the District of Columbia, Puerto Rico, and the Virgin Islands have laws requiring notification of security breaches involving personal information. Federal statutes, regulations, and a memorandum for federal departments and agencies require certain sectors (healthcare, financial, federal public sector, and the Department of Veterans Affairs) to implement information security programs and provide notification of security breaches of personal information. In response to such notification laws, over 2,676 data breaches and computer intrusions involving 535 million records containing sensitive personal information have been disclosed by data brokers, businesses, retailers, educational institutions, government and military agencies, healthcare providers, financial institutions, nonprofit organizations, utility companies, and Internet businesses. As a result, a significantly large number of individuals have received notices that their personally identifiable information has been improperly disclosed.
This report provides an overview of state security breach notification laws applicable to entities that collect, maintain, own, possess, or license personal information. The report describes information security and security breach notification requirements in the Office of Management and Budget's "Breach Notification Policy," the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH), and the Gramm-Leach-Bliley Act (GLBA).
The Senate Judiciary Committee marked up three data security bills and reported the three bills with substitute amendments. See CRS Report R42474, Selected Federal Data Security Breach Legislation, by [author name scrubbed]. S. 1151 (Leahy), the Personal Data Privacy and Security Act of 2011, would apply to business entities to prevent and mitigate identity theft, ensure privacy, provide notice of security breaches, and enhance criminal penalties. It would provide law enforcement assistance and other protections against security breaches, fraudulent access, and misuse of personally identifiable information. S. 1408 (Feinstein), the Data Breach Notification Act of 2011, would require federal agencies and persons engaged in interstate commerce, in possession of data containing sensitive personally identifiable information, to disclose any breach of such information. S. 1535 (Blumenthal), the Personal Data Protection and Breach Accountability Act of 2011, would protect consumers by mitigating the vulnerability of personally identifiable information to theft through a security breach, provide notice and remedies to consumers, hold companies accountable for preventable breaches, facilitate the sharing of post-breach technical information, and enhance criminal and civil penalties and other protections against the unauthorized collection or use of personally identifiable information. The House Subcommittee on Commerce, Manufacturing and Trade marked up H.R. 2577 (Bono Mack), the SAFE Data Act, to protect consumers by requiring reasonable security policies and procedures to protect data containing personal information, and to provide for nationwide notice in the event of a security breach. Several subcommittee Democrats objected to the bill's definition of personal information, arguing that the description is limited and does not adequately protect consumers from identity theft. The House Commerce, Manufacturing and Trade Subcommittee approved H.R. 2577 by voice vote and the measure was referred to the full committee for consideration. H.R. 1707 (Rush) and H.R. 1841 (Stearns) were also introduced to protect consumers by requiring reasonable security policies and procedures to protect computerized data containing personal information and providing for nationwide notice in the event of a breach. Congress may address data security during its consideration of cybersecurity legislation.