```

[House Hearing, 109 Congress]
[From the U.S. Government Publishing Office]

 
     SECURING CONSUMERS' DATA: OPTIONS FOLLOWING SECURITY BREACHES

=======================================================================

                                HEARING

                               before the

                            SUBCOMMITTEE ON
                COMMERCE, TRADE, AND CONSUMER PROTECTION

                                 of the

                    COMMITTEE ON ENERGY AND COMMERCE
                        HOUSE OF REPRESENTATIVES

                       ONE HUNDRED NINTH CONGRESS

                             FIRST SESSION

                               __________

                              MAY 11, 2005

                               __________

                           Serial No. 109-14

                               __________

      Printed for the use of the Committee on Energy and Commerce

 Available via the World Wide Web: http://www.access.gpo.gov/congress/
                                 house

                                 ______

                     U.S. GOVERNMENT PRINTING OFFICE
                            WASHINGTON : 2005

21-635PDF

For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512-1800  
Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-0001

                    COMMITTEE ON ENERGY AND COMMERCE

                      JOE BARTON, Texas, Chairman

RALPH M. HALL, Texas                 JOHN D. DINGELL, Michigan
MICHAEL BILIRAKIS, Florida             Ranking Member
  Vice Chairman                      HENRY A. WAXMAN, California
FRED UPTON, Michigan                 EDWARD J. MARKEY, Massachusetts
CLIFF STEARNS, Florida               RICK BOUCHER, Virginia
PAUL E. GILLMOR, Ohio                EDOLPHUS TOWNS, New York
NATHAN DEAL, Georgia                 FRANK PALLONE, Jr., New Jersey
ED WHITFIELD, Kentucky               SHERROD BROWN, Ohio
CHARLIE NORWOOD, Georgia             BART GORDON, Tennessee
BARBARA CUBIN, Wyoming               BOBBY L. RUSH, Illinois
JOHN SHIMKUS, Illinois               ANNA G. ESHOO, California
HEATHER WILSON, New Mexico           BART STUPAK, Michigan
JOHN B. SHADEGG, Arizona             ELIOT L. ENGEL, New York
CHARLES W. ``CHIP'' PICKERING,       ALBERT R. WYNN, Maryland
Mississippi, Vice Chairman           GENE GREEN, Texas
VITO FOSSELLA, New York              TED STRICKLAND, Ohio
ROY BLUNT, Missouri                  DIANA DeGETTE, Colorado
STEVE BUYER, Indiana                 LOIS CAPPS, California
GEORGE RADANOVICH, California        MIKE DOYLE, Pennsylvania
CHARLES F. BASS, New Hampshire       TOM ALLEN, Maine
JOSEPH R. PITTS, Pennsylvania        JIM DAVIS, Florida
MARY BONO, California                JAN SCHAKOWSKY, Illinois
GREG WALDEN, Oregon                  HILDA L. SOLIS, California
LEE TERRY, Nebraska                  CHARLES A. GONZALEZ, Texas
MIKE FERGUSON, New Jersey            JAY INSLEE, Washington
MIKE ROGERS, Michigan                TAMMY BALDWIN, Wisconsin
C.L. ``BUTCH'' OTTER, Idaho          MIKE ROSS, Arkansas
SUE MYRICK, North Carolina
JOHN SULLIVAN, Oklahoma
TIM MURPHY, Pennsylvania
MICHAEL C. BURGESS, Texas
MARSHA BLACKBURN, Tennessee

                      Bud Albright, Staff Director

        David Cavicke, Deputy Staff Director and General Counsel

      Reid P.F. Stuntz, Minority Staff Director and Chief Counsel

                                 ______

        Subcommittee on Commerce, Trade, and Consumer Protection

                    CLIFF STEARNS, Florida, Chairman

FRED UPTON, Michigan                 JAN SCHAKOWSKY, Illinois
NATHAN DEAL, Georgia                   Ranking Member
BARBARA CUBIN, Wyoming               MIKE ROSS, Arkansas
GEORGE RADANOVICH, California        EDWARD J. MARKEY, Massachusetts
CHARLES F. BASS, New Hampshire       EDOLPHUS TOWNS, New York
JOSEPH R. PITTS, Pennsylvania        SHERROD BROWN, Ohio
MARY BONO, California                BOBBY L. RUSH, Illinois
LEE TERRY, Nebraska                  GENE GREEN, Texas
MIKE FERGUSON, New Jersey            TED STRICKLAND, Ohio
MIKE ROGERS, Michigan                DIANA DeGETTE, Colorado
C.L. ``BUTCH'' OTTER, Idaho          JIM DAVIS, Florida
SUE MYRICK, North Carolina           CHARLES A. GONZALEZ, Texas
TIM MURPHY, Pennsylvania             TAMMY BALDWIN, Wisconsin
MARSHA BLACKBURN, Tennessee          JOHN D. DINGELL, Michigan,
JOE BARTON, Texas,                     (Ex Officio)
  (Ex Officio)

                                  (ii)

                            C O N T E N T S

                               __________
                                                                   Page

Testimony of:
    Barrett, Jennifer, Chief Privacy Officer, Acxiom Corporation.    12
    Buege, Steve, Senior Vice President, Business Information, 
      News and Public Records, North American Legal..............    18
    Burton, Daniel, Vice President of Government Affairs, 
      Entrust, Inc...............................................    25
    Ireland, Oliver I., Partner, Financial Services Practice 
      Group, Morrison and Foerster, LLP, on Behalf of Visa USA...    22
    Solove, Daniel J., Associate Professor of Law, George 
      Washington University Law School...........................    31
Additional material submitted for the record:
    ARMA International, prepared statement of....................    51
    Hillebrand, Gail, Senior Attorney, Consumers Union, prepared 
      statement of...............................................    53

                                 (iii)

     SECURING CONSUMERS' DATA: OPTIONS FOLLOWING SECURITY BREACHES

                              ----------                              

                        WEDNESDAY, MAY 11, 2005

              House of Representatives,    
              Committee on Energy and Commerce,    
                       Subcommittee on Commerce, Trade,    
                                   and Consumer Protection,
                                                    Washington, DC.
    The subcommittee met, pursuant to notice, at 11:05 a.m., in 
room 2123 of the Rayburn House Office Building, Hon. Cliff 
Stearns (chairman) presiding.
    Members present: Representatives Stearns, Upton, Cubin, 
Radanovich, Bass, Pitts, Bono, Terry, Rogers, Myrick, Murphy, 
Blackburn, Barton (ex officio), Schakowsky, Ross, Markey, and 
Baldwin.
    Staff present: David Cavicke, chief counsel; Chris Leahy, 
policy coordinator; Will Carty, professional staff; Larry Neal, 
deputy staff director; Billy Harvard, clerk; Kevin Schweers, 
communications director; Lisa Miller, press secretary; Consuela 
Washington, minority counsel; Turney Hall, staff assistant; and 
Alec Gerlach, staff assistant.
    Mr. Stearns. Good morning. The subcommittee will come to 
order. My colleagues, today we continue the subcommittee's 
examination of consumer data security and identity theft. As 
all of us are keenly aware, our important work is set against 
the backdrop of almost daily reports of consumer data, security 
breaches at data brokers, retailers, banks, universities, and 
the list, of course, goes on. It seems like every corner of our 
economy has been touched. Understandably, the public is 
worried. The reported breaches involve everything from 
elaborate high-tech hacker attacks to simply theft of physical 
consumer data that had been poorly secured in the first place.
    The consumer impact of these breaches has been just as 
varied. Some cases never result in identity theft or financial 
loss, while others affect significant consumer populations. 
With some estimates of those affected ballooning past initial 
numbers as further investigations reveal even larger cracks in 
the digital infrastructure.
    And while our initial assessment of the extent of this 
problem for consumers and businesses is still a bit fuzzy, the 
cracks and vulnerabilities are becoming more apparent to the 
committee and to the public. Questions are starting to be 
raised about the inherent security of a large segment of the 
commercial marketplace. This should concern all of us. The 
committee understands this concern, and to address it, there 
are a number of issues that need careful examination.
    First, we must ensure that existing Federal law does not 
leave open ways for certain entities to skirt the objectives of 
the primary laws governing such areas, including the Fair 
Credit Reporting Act and the Gramm-Leach-Bliley.
    Second, if we determine that existing law is inadequate, we 
need to get a clearer and more accurate assessment of the scope 
of the problem across all sectors, assess the current legal 
tools we have to attack it, and weigh the need for additional 
regulation and other approaches. Other non-regulatory 
approaches could include applying good old American 
technological ingenuity to buttress current consumer data 
security regulations.
    Throughout this series of hearings, we have heard from a 
number of experts that data security breaches go hand in hand 
with identity theft, a phenomenon that keeps getting larger and 
more insidious. The numbers are sobering. At our March hearing, 
the FTC testified that over 10 million people were victims of 
identity theft during the 1-year period of its latest survey. 
The FTC estimated that this figure translates into loss of 
nearly $48 billion for businesses, almost $5 billion for 
consumers, and close to 300 million hours spent by those 
individuals and businesses trying to resolve the problems just 
generated by these crimes.
    We cannot allow our consumer economy to be undermined by 
these criminals. Consumers, businesses, and the public sector 
needs to strengthen defenses collectively. The reality is that 
the bad guys will always be around. It is up to us as 
consumers, businesses, and public institutions to make sure 
that our data is locked down and is accounted for. The best 
offense to combat identity theft is simple prevention coupled 
with an assurance that entities dealing in consumer data adhere 
to consistent and comprehensive security standards with a bite.
    The accessibility and portability of consumer data in an 
information-driven market has made controlling who has access 
to what more difficult than ever. Consumer data breaches and as 
a result in identity theft continues to grow and affect broader 
commercial activity at all levels, not just a specific industry 
or a specific sector.
    Consumer data in our modern markets has become a commodity. 
It is bought and sold. It is processed and analyzed. And it is 
now an integral ingredient in disciplines as varied as finance, 
demographics, research, direct marketing, academic study, and 
law enforcement. I believe the majority of these activities 
improve our lives and well-being. They make us more productive, 
allow a higher standard of living, and afford us better 
personal and national security, particularly in a post-9/11 
world.
    What it is lacking, my colleagues, however, is a safeguard 
system in which our personal data is shielded by a robust 
security no matter where it goes or whoever possesses it. We 
need to examine approaches that enable robust security measures 
to surround personal data as it speeds through commerce.
    I think this is where advanced technology can play a larger 
role in helping reduce the incidence of identity theft. 
Technologies like sophisticated encryption techniques, advanced 
password authentication systems, as well as better and more 
widespread use of advanced data security software all can play 
an important role in improving our defenses. Technology can 
also be used to facilitate more uniform best practices in 
affected sectors that deal in consumer data.
    Let me be clear. I do believe that additional measures are 
necessary, but for those still undecided, this hearing and the 
proceedings should provide a great deal of information to help 
everyone make a judgment call here. I think it is a fair thing 
to say that one thing is certain--criminals cannot be allowed 
to capitalize on another high-tech nefarious business model to 
steal and defraud American consumers, businesses, and public 
institutions. We have seen this happen with spyware and spam. 
It can't be allowed to happen here.
    Therefore, our focus needs to be on first, clearly 
identifying what is not working before we act on a national 
scale. But with each new breach we are losing more valuable 
time to put an end to a new breed of professional cyber 
criminals and the inappropriate and illegal activities that are 
slowly corroding consumer confidence in the integrity of 
information-driven commerce and technology.
    I would like to thank our distinguished panel for being 
here this morning and for joining us today, and we look forward 
to your testimony. With that, the ranking member, Ms. 
Schakowsky.
    [The prepared statement of Hon. Cliff Stearns follows:]
Prepared Statement of Hon. Clifford Stearns, Chairman, Subcommittee on 
                Commerce, Trade, and Consumer Protection
    Good Morning. Today, we continue the Subcommittee's examination of 
consumer data security and identity theft. As all of us are keenly 
aware, our important work is set against the backdrop of almost daily 
reports of consumer data security breaches at data brokers, retailers, 
banks, universities--and the list goes on. It seems like every corner 
of our economy has been touched. Understandably, the public is worried. 
The reported breaches involve everything from elaborate high-tech 
hacker attacks to simply theft of physical consumer data that had been 
poorly secured. The consumer impact of these breaches has been just as 
varied. Some cases never result in identify theft or financial loss 
while others affect significant consumer populations, with some 
estimates of those affected ballooning past initial numbers as further 
investigation reveals even bigger cracks in the digital infrastructure. 
And while our initial assessment of the extent of this problem for 
consumers and businesses is still a bit fuzzy, the cracks and 
vulnerabilities are becoming more apparent to the Committee and to the 
public. Questions are starting to be raised about the inherent security 
of a large segment of the commercial marketplace. This should concern 
us all.
    The Committee understands this concern. And to address it, there 
are a number of issues that need careful examination. First, we must 
ensure that existing federal law is not leaving open ways for certain 
entities to skirt the objectives of the primary laws governing this 
area, including the Fair Credit Reporting Act and Gramm-Leach-Bliley. 
Second, if we determine that existing law is inadequate, we need to get 
a clearer and more accurate assessment of the scope of the problem 
across all sectors, assess the current legal tools we have to attack 
it, and weigh the need for additional regulation and other approaches. 
Other non-regulatory approaches could include applying good old 
American technological ingenuity to buttress current consumer data 
security regulations.
    Throughout this series of hearings we have heard from a number of 
experts that data security breaches go hand in hand with identify 
theft--a phenomenon that keeps getting bigger and more insidious. The 
numbers are sobering. At our March hearing, the FTC testified that over 
10 million people were victims of identity theft during the one-year 
period of its latest survey. The FTC estimated that this figure 
translates into loses of nearly $48 billion for businesses, almost $5 
billion for consumers, and close to 300 million hours spent by those 
individuals and businesses trying to resolve the problems generated by 
these crimes. We cannot allow our consumer economy to be undermined by 
these criminals. Consumers, business, and the public sector need to 
strengthen defenses collectively. The reality is that the bad guys will 
always be around. It is up to us as consumers, businesses, and public 
institutions to make sure that our data is locked down and accounted 
for. The best offense to combat identity theft is simple prevention 
coupled with an assurance that entities dealing in consumer data adhere 
to consistent and comprehensive security standards with bite.
    The accessibility and portability of consumer data in an 
information-driven market has made controlling who has access to what 
more difficult than ever. Consumer data breaches and resultant identity 
theft continues to grow and affect broader commercial activity at all 
levels, not just a specific industry or sector. Consumer data in our 
modern markets has become a commodity. It is bought and sold. It is 
processed and analyzed. And it is now an integral ingredient in 
disciplines as varied as finance, demographic research, direct 
marketing, academic study, and law enforcement. I believe that the 
majority of these activities improve our lives and wellbeing. They make 
us more productive, allow higher standards of living, and afford us 
better personal and national security, particularly in a post 9/11 
world. What is lacking, however, is a safeguard system in which our 
personal data is shielded by robust security no matter where it goes or 
who possess it. We need to examine approaches that enable robust 
security measures to surround personal data as it speeds through 
commerce.
    I think this is where advanced technology can play a larger role in 
helping reduce the incidence of identity theft. Technologies like 
sophisticated encryption techniques, advanced password authentication 
systems, as well as better and more widespread use of advanced data 
security software all can play an important role in improving our 
defenses. Technology can also be used to facilitate more uniform best 
practices in affected sectors that deal in consumer data.
    Let me be clear, I do believe that additional measures are 
necessary. But for those still undecided, this hearing and the 
preceding ones should provide a great deal of information to make a 
judgment. I think it's fair to say that one thing is certain--criminals 
cannot be allowed to capitalize on another high-tech, nefarious 
business model to steal and defraud American consumers, business, and 
public institutions. We've seen that happen with spyware and spam. It 
can't be allowed to happen here. Therefore, our focus needs to be on 
first clearly identifying what is not working before we act on a 
national scale. But with each new breach, we are losing more valuable 
time to put an end to a new breed of professional cyber-criminal and 
the inappropriate and illegal activities that at are slowly corroding 
consumer confidence in the integrity of information-driven commerce and 
technology.
    I would like to thank our distinguished panel of witnesses for 
joining us today. We look forward to your testimony. Thank you.

    Ms. Schakowsky. Once again I want to thank you, Chairman 
Stearns, for holding a hearing on how we can further protect 
consumers from the stealing of their most personal information. 
We need to close the canyon-size gaps in the law that are 
putting consumers and their sensitive, private information at 
serious risk of invasion--identity theft and other crimes.
    I look forward to hearing from our witnesses today about 
their ideas of what we can do, and I look forward to working 
with you, Chairman Stearns and Chairman Barton and Ranking 
Member Dingell and Representative Markey and others, on 
legislation to restore consumers' control of private 
information.
    The Privacy Rights Clearinghouse has been keeping an 
ongoing tally of data breaches revealed since news first broke 
on the ChoicePoint incident. In the past 3 months alone we have 
learned that approximately 4,736,400 individuals have had their 
personally identifiable information compromised. Again, that is 
in just months. And those are the cases about which we know.
    The means of access are varied. Computers have been hacked 
and stolen, backup tapes lost, passwords compromised, 
information exposed online, and fake businesses established. 
And it has not just been the data brokers' stockpiles that have 
been raided. University stores, banks, and government offices 
have seen their data bases breached and their students, alumni, 
customers, and constituencies exposed. If there is personal 
information to be had, there are criminals out to get it from 
anyplace and in any way they can.
    From the recent wave of breaches we know data insecurity is 
endemic, and it is time for us to close whatever loopholes 
there are in privacy laws to ensure that consumers are not 
stuck with the short end of the stick as they are now. We need 
to address privacy and data security with comprehensive 
legislation governing the handling and use of personal and 
consumer information. I believe we should explore the 
possibility of giving consumers the power to lock up their 
information, making it available only when consumers give 
affirmative consent. We should also look into giving consumers 
the opportunity to inspect their information, and if it is not 
accurate, then a chance to correct it. We should also place a 
heightened responsibility on record keepers to ensure that they 
are truthfully representing consumers. And we should give 
victims of lost or stolen information a place to turn, like an 
office of an omdetsman in order to help them through repairing 
whatever damage has been done by their information being 
compromised. We also need to explore the government's use of 
information compiled by data brokers to make sure that Big 
Brother is not handing the binoculars to Big Business in order 
to skirt the Privacy Act.
    Inaccuracies can cost people their jobs, insurance, the 
right to vote, good credit histories, or even their lives. I 
believe that if consumers have the tools, resources, and the 
rights to protect their personal information, and if companies 
were held to a higher standard of accountability, we would not 
have 4.7 million letters being sent out over 3 months warning 
consumers that their information could be in the hands of 
criminals.
    We need to keep in mind that perhaps the only reason we 
know about these breaches is because of tough State laws like 
California's that made sure these breaches were reported. If 
those companies with security breaches had to comply only with 
Federal legislation, there is a good chance we would be hearing 
from more and more identity theft victims and had no idea what 
was going on to cause the potential upsurge.
    When we craft the legislation to contend with data 
insecurity, we need to provide a floor and not a ceiling for 
how personal information is handled and protected. Let the 
States pressure us to do better instead of us limiting what 
they can do.
    Again, Chairman Stearns, I look forward to working with you 
and the other members of our committee to do what we can to 
protect consumers. I thank you.
    Mr. Stearns. I thank the gentlelady. The gentlelady from 
California, Ms. Bono.
    Ms. Bono. Thank you, Mr. Chairman. I just would like to 
thank you for holding this hearing, but I will waive an opening 
statement.
    Mr. Stearns. The gentlelady waives. Mr. Ross, is he here? 
Ms. Baldwin? No. The gentlelady waives. Mr. Pitts, gentleman--
waive. Mr. Markey?
    Mr. Markey. Thank you, Mr. Chairman, very much. Mr. 
Chairman, in ``Bonfire of the Vanities'' the novelist Tom Wolfe 
wrote about ``the Bororo Indians, a primitive jungle tribe who 
live along the Vermelho River in the Amazon Jungles of 
Brazil.'' According to Wolfe, the Bororos believed that ``there 
is no such thing as a private self.'' Instead, they ``regard 
the mind as an open cavity, like a cave or a tunnel or an 
arcade, if you will, in which the entire village dwells and the 
jungle grows.'' Wolfe compared this to the situation faced by 
someone in the middle of a public scandal in the last quarter 
of the 20th century, when he suggested ``one's self--or what 
one takes to be oneself--is not a mere cavity open to the 
outside world but has suddenly become an amusement park to 
which everybody, todo el mundo, tout le monde, comes 
scampering, skipping and screaming, nerves a-tingle, loins 
aflame, ready for anything, all you have got, laughs, tears, 
moans, giddy thrills, gasps, horrors, whatever, the gorier the 
merrier.''
    In the 21st Century, Mr. Chairman, we now face the prospect 
of a world in which all of us--not just Sherman McCoy's caught 
in the midst of scandal--will be forced to live without a 
private self: with the entire ``village'' able to obtain access 
to some of the most personal aspects of our lives.
    In the emerging surveillance society of the 21st Century, 
the Bororo Indians seeking to inhabit our private selves are 
the data mining and information brokerage firms. These 
companies are collecting and selling a vast array of personal 
information about the American public. For a fee, these 
companies will tell you someone's Social Security number, their 
address, phone number, driver's license number, driving record, 
any criminal record information, court records, insurance 
claims, divorce records, and even credit and financial 
information.
    Recent press reports have chronicled the adverse privacy 
consequences of this phenomenon. As we have seen company after 
company acknowledging that the security and confidentiality of 
the personal information it holds about American citizens has 
been compromised. Each week the list of companies who have 
suffered data security breaches or acknowledged lax practices 
with respect to access to sensitive personal data has grown 
longer and longer.
    I have introduced three bills aimed at addressing the 
current threats to personal privacy. My first bill, the 
Information Protection and Security Act, would subject 
information brokers to regulation by the Federal Trade 
Commission, and specifically to a set of new, fair information 
practice rules that the FTC would be required to issue within 6 
months of enactment.
    The FTC rules would address the security of information 
held by information brokers, the right of consumers to obtain 
access to incorrect information held by the broker, the 
responsibility of the broker to protect the information from 
unauthorized users or from users seeking the information for 
impermissible and unlawful purposes. The bill also provides the 
enforcement of the bill's substantive provisions by the FTC, 
the State Attorney General, and a private right of action.
    My second bill would generally restrict the purchase and 
sale of Social Security numbers. And my third bill would allow 
consumers to block a company from transferring their personal 
information to entities located in countries that fail to 
provide adequate and enforcement privacy protection.
    In other words, the outsourcing of privacy to countries 
like India and Pakistan that do not have privacy laws in 
conformance with the EU or with the United States of America. 
Our x-rays should not be going to be read in countries that do 
not have the same privacy laws which we have. Our tax records 
should not be going there, our financial records should not be 
going there, our health records should not be going there. 
These are personal records to go to the very identity of us as 
Americans and as a people. I thank you, Mr. Chairman, for 
having this very important hearing.
    [The prepared statement of Hon. Edward J. Markey follows:]
   Prepared Statement of Hon. Edward J. Markey, a Representative in 
                Congress from the State of Massachusetts
    Thank you, Mr. Chairman.
    In Bonfire of the Vanities, the novelist Tom Wolfe wrote about 
``The Bororo Indians, a primitive jungle tribe who live along the 
Vermelho River in the Amazon Jungles of Brazil.'' According to Wolfe, 
the Bororos believed that ``there is no such thing as a private self.'' 
Instead, they ``regard the mind as an open cavity, like a cave or a 
tunnel or an arcade, if you will, in which the entire village dwells 
and the jungle grows.'' Wolfe compared this to the situation faced by 
someone in the middle of a public scandal in the last quarter of the 
20th century--when, he suggested:
        ``. . . one's self--or what one takes to be one's self--is not 
        a mere cavity open to the outside world but has suddenly become 
        an amusement park to which everybody, todo el mundo, tout le 
        monde, comes scampering, skipping and screaming, nerves a-
        tingle, loins aflame, ready for anything, all you've got, 
        laughs, tears, moans, giddy thrills, gasps, horrors, whatever, 
        the gorier the merrier.''
    In the 21st Century, we now face the prospect of a world in which 
all of us--not just the Sherman McCoy's caught in the midst scandal--
will be forced to live without a private self--with the entire 
``village'' able to obtain access to some of the most personal aspects 
of our lives.
    In the emerging surveillance society of the 21st Century, the 
Bororo Indians seeking to inhabit our private selves are the data 
mining and information brokerage firms. These companies are collecting 
and selling a vast array of personal information about the American 
public. For a fee, these companies will tell you someone's Social 
Security Number, their address, phone number, driver's license number, 
driving record, any criminal record information, court records, 
insurance claims, divorce records, and even credit and financial 
information.
    Recent press reports have chronicled the adverse privacy 
consequences of this phenomenon, as we have seen company after company 
acknowledging that the security and confidentiality of the personal 
information it holds about American citizens has been compromised. Each 
week, the list of companies who have suffered data security breaches, 
or acknowledged lax practices with respect to access to sensitive 
personal data, has grown longer and longer.
    I have introduced three bills aimed at addressing the current 
threats to personal privacy. My first bill, the ``Information 
Protection and Security Act,'' would subject information brokers to 
regulation by the Federal Trade Commission, and specifically, to a set 
of new fair information practice rules that the FTC would be required 
to issue within 6 months of enactment. The FTC rules would address the 
security of information held by information brokers, the right of 
consumers to obtain access to and correct information held by the 
broker, the responsibility of the broker to protect the information 
from unauthorized users, or from users seeking the information for 
impermissible or unlawful purposes. The bill also provides for 
enforcement of the bill's substantive provisions by the FTC, the State 
Attorney's General, and a private right of action.
    My second bill, H.R. 1078, would generally restrict the purchase or 
sale of Social Security numbers, which has become a ubiquitous personal 
identifier used by corporations and identity thieves to access 
sensitive personal information.
    My third bill, H.R. 1653, would allow consumers to block a company 
from transferring their personal information to entities located in 
countries that fail to provide adequate and enforceable privacy 
protections.
    All three of these bills have been referred to this Subcommittee, 
and I look forward to hearing the testimony of the witnesses at this 
morning's hearing, and to discussing the proposals set forth in these 
bills with them.

    Mr. Stearns. I thank my colleague for a very thoughtful 
opening statement. And we are going to Mr. Terry. Mr. Terry 
waives. Ms. Cubin.
    Ms. Cubin. Thank you, Mr. Chairman, and thank you for 
holding this timely hearing. It is especially timely for me. I 
also want to thank the witnesses that are here today who have 
joined us to help us hopefully guide us on shaping future 
legislation regarding personal data security.
    Throughout my tenure on this subcommittee we have 
continuously addressed issues regarding privacy protection and 
the ability of third parties to access and distribute 
personally identifiable information. Though there are most 
certainly valid and necessary uses of personal data collection, 
recent breaches of seemingly secure data have demonstrated that 
there are just as many opportunities for criminal use of this 
information.
    Identify theft, as we all know, is a whole new realm of 
crime, and America does not currently have the proper legal 
tools to prevent it, rectify it, or mitigate it. ID theft can 
invade people's homes, bank accounts, financial assets, often 
undetected. This can be devastating to victims and Congress 
must determine the best course of action to help this from 
happening.
    As I said, I think this hearing is timely because just on 
Monday of this week I was notified that I was one of over 
96,000 people in one incident and one of 1.4 million people in 
another affected by an identity theft incident. According to a 
letter that I received from the companies to notify me of this 
breach, stolen personal information included bank account 
numbers and driver's license numbers and other information 
that's provided on checks. While I was lucky enough I think--I 
am not sure at this point--that my Social Security number 
wasn't stolen and that my address wasn't stolen, millions of 
Americans aren't that lucky--if you want to call my situation 
lucky.
    Financial institutions whose systems have been breached 
have an immediate responsibility to notify victims as well as 
to provide an explanation of the breach of the security system, 
which did happen with me. Once again I thank--I hope that I was 
notified of everything. I am hopeful that today's hearing will 
outline what other further steps must be taken to assist us in 
identifying victims and rectifying fraudulent bank transactions 
and correcting inaccurate file information for future 
dissemination.
    I hope this subcommittee will continue to examine this 
issue in the light of the need for harsher punishment for both 
data thieves and commercial entities who forfeit personal 
information, albeit unintentionally.
    I thank the chairman and I yield back the balance of my 
time.
    [The prepared statement of Hon. Barbara Cubin follows:]
Prepared Statement of Hon. Barbara Cubin, a Representative in Congress 
                       from the State of Wyoming
    Thank you, Mr. Chairman, for holding this timely hearing.
    I would also like to thank the witnesses who have joined us here 
today. As we found during the previous hearing, the current laws 
governing data security are very complex. I anticipate an open dialogue 
with the panel of witnesses to help guide Members of the Subcommittee 
in shaping future legislation regarding personal data security.
    Throughout my tenure on this subcommittee, we have continuously 
addressed issues relating to privacy protection and the ability of 
third parties to access and distribute personally identifiable 
information. Though there are most certainly valid and necessary uses 
of personal data collection, recent breaches of seemingly secure data 
have demonstrated that there are just as many opportunities for 
criminal use of this information. Identity theft is a whole new realm 
of crime, and America does not currently have the proper legal tools to 
prevent, rectify or mitigate it. ID theft can invade people's homes, 
bank accounts, and financial assets, often undetected. This can be 
devastating to victims, and Congress must determine the best course of 
action to halt this crime.
    I myself have just recently been notified that I was a one of over 
1.4 million people affected by the DSW identity theft incident. 
According to the letter DSW sent to notify me of this breach, stolen 
personal information included bank account and drivers license numbers 
provided on checks. While the stolen information did not include names, 
addresses, or Social Security numbers, millions of Americans affected 
in other data theft incidents have not been so lucky. It is crucial we 
call attention to the need for consumers to have proper recourse. 
Financial institutions whose systems have been breached have an 
immediate responsibility to notify victims, as well as provide an 
explanation of the nature of the system's breach. I am hopeful today's 
hearing will outline what further steps must be taken to assist 
identity theft victims in rectifying fraudulent bank transactions and 
correcting inaccurate file information for future dissemination.
    I hope the subcommittee will continue to examine this issue in 
light of the need for harsher punishment for both data thieves and the 
commercial entities who forfeit personal information, albeit 
unintentionally. I thank the chairman, and I yield back the balance of 
my time.

    Mr. Stearns. I thank the gentlelady, and it is very 
appropriate that you bring to our attention that letter. And I 
thank you very much, and I think that lends credence to why we 
are attempting to grapple with this problem to come up with a 
solution. Mr. Radanovich? The gentleman waives. Ms. Myrick?
    Ms. Myrick. I waive also.
    Mr. Stearns. Okay. I think everybody has completed their 
opportunity for an opening statement. We move now to our 
witness list. And we welcome them. Before I start, Mr. Ross 
would like to make an introduction. Mr. Ross.
    Mr. Ross. Thank you, Mr. Chairman and Ranking Member 
Schakowsky for having this important hearing today to address 
the issue of protecting consumers' data. I am pleased that we 
have Jennifer Barrett to testify from Acxiom, which is located 
in my home State of Arkansas.
    Since it was founded in 1969, Acxiom has used technology 
and consumer data to help some of the largest, most respected 
companies in the world improve their business results. Acxiom 
is based in Little Rock, Arkansas and employs more than 6,300 
people in eight countries with an annual revenue of about $1.2 
billion.
    Jennifer Barrett is the chief privacy officer of Acxiom 
Corporation and is one of the world's leading authorities on 
information practices and policies and their impact on 
consumers, commerce, and the global economy. Jennifer has been 
with Acxiom almost since its inception after earning a degree 
in computer science and mathematics from the University of 
Texas, which those of us in Arkansas do not hold against her. 
She has worked at almost every facet of the company. In the 
early 1990's she became one of the first executives in any 
industry to become what is now commonly referred to as a chief 
privacy officer, assigned to help her company and its clients 
achieve the critical balance of protecting consumer privacy 
while preserving the benefits of this new information age. 
Jennifer is now sought out by leading companies, international 
business leaders, lawmakers, regulators, and many others for 
her counsel and views on the responsible uses of data. She has 
appeared many times before committees and forums here in 
Washington, and we appreciate her again offering her insights 
to us today. So I would like to thank you, and I look forward 
to the testimony from Mrs. Barrett as well as the other 
witnesses on the panel today and the questions from the members 
here as well.
    Mr. Stearns. I thank my colleague.
    [Additional statements submitted for the record follow:]
   Prepared Statement of Hon. George Radanovich, a Representative in 
                 Congress from the State of California
    Mr. Chairman, I would like to thank you for holding this important 
hearing today on securing consumers' data.
    With recent reports from the Federal Trade Commission's study 
survey indicating that over 10 million people were victims of identity 
theft during a one year period and estimates that translate into $48 
billion loss for businesses and $5 billion loss for consumers, I 
believe it is evident that the time is right for Congress to determine 
what needs to be done to protect our constituents from these thieves.
    I am happy to report that California has been one of the most 
active state governments in regulation data security. In 2002 
California passed a consumer security breach notification law that 
requires any state agency, or any person or business that owns or 
licenses computerized data that includes personal information to 
disclose any breach of security of the data to any resident of that 
state whose unencrypted information was, or is reasonably believed to 
have been, acquired by an unauthorized person. In addition to 
California I would like to commend the states of Georgia, Texas and 
Illinois who are considering similar legislation.
    As we hear from our witnesses today it is important to determine if 
the current federal laws are sufficient to protect the data security of 
consumer's and if technologies exist that could aid in protecting 
sensitive consumer data and prevent unauthorized access to computerized 
databases.
    Recent reports of data security breaches by data brokers, financial 
institutions, and retailers have raised questions about the sufficiency 
of current laws to protect consumer information from identity theft.
    During the Subcommittee's March hearing on issues related to the 
Choicepoint breach, the FTC testified that the results of a recent FTC 
study indicated that over 10 million people were victims of identity 
theft during the one year period the study's survey covered. The FTC 
estimates that the losses translate into $48 billion for businesses and 
$5 billion to consumers.
    While there are Federal laws that provide standards for disclosure 
of consumer information and require certain entities to take steps to 
safeguard consumer information, there is NO comprehensive Federal law 
dealing with data security that governs ALL uses of consumer data. 
There are two main bodies of Federal law that deal with privacy and 
data security related to certain types of entities and certain uses of 
information: The Fair Credit Reporting Act and the Gramm-leach Bliley 
Act; however the universe of entities to which these bodies of law 
apply is limited.
    Several other states have passed or are considering similar 
legislation, including GA, TX, and Il. A number of federal bills 
introduced in this Congress are modeled after the CA statute.
    The social security number was created to identify each U.S. 
citizen for the sole purpose of tracking employment and benefits 
however, over time our social security number has been used by both 
public and private entities for purposes both related and unrelated to 
the social security program. The usage of this unique identifier has 
benefited both businesses and consumers, but unfortunately it has led 
to misuse and most importantly identity theft.
    The FTC has reported that over 10 million people were victims of 
identity theft in one year and they estimate that this translates into 
upwards of a $48 billion loss for businesses and $5 billion loss for 
consumers, but a price tag can not be put on the loss of one's 
identity.
    I look for to hearing our witness' testimony today. Hopefully this 
will help us determine if our current laws are adequate enough to 
protect the integrity of our social security numbers and if not, what 
we need to do to protect them.
                                 ______
                                 
 Prepared Statement of Hon. Joe Barton, Chairman, Committee on Energy 
                              and Commerce
    Thank you Mr. Chairman for holding this hearing today. I have spent 
considerable time focusing on information security issues such as the 
spyware legislation that this Committee passed unanimously. I'm 
confident that that bill will be received favorably by the full House 
as well. Our Committee's work on these issues will continue in earnest, 
particularly in light of the alarming and ever-growing list of data 
security breaches recently.
    Nothing seems safe. In recent months, we have learned about the 
loss of personally identifiable information--even including Social 
Security numbers--from ChoicePoint, LexisNexis, Blockbuster, as well as 
a company called RuffaloCODY that manages information systems for a 
number of colleges and universities. Most recently, data tapes 
belonging to Time Warner were stolen from a storage company called Iron 
Mountain--a company, I might add, that also stores some sensitive 
information for the Congress. I suspect that there are more thefts of 
this nature about which we have not yet learned.
    This is simply unacceptable.
    In the Internet age, personal information can be accessed in any 
number of ways and from any number of outlets. To not guard it closely 
is to open the door to thieves. Sensitive personal information must be 
secure, and companies that legally gather and distribute this 
information need to be held accountable if they do not take reasonable 
steps to ensure that security.
    The recent breaches have focused our attention on ``data brokers''' 
who compile public and non-public information in ways that seem 
downright Orwellian. They can share it, rent it, and sell it. 
Constraints on these companies and their practices are few and thin. 
Some of these companies provide an important service for individuals 
trying to protect their families or investments, as well as for the 
government trying to protect us all. It is essential that only those 
who have an appropriate, legitimate reason for having access to such 
information are allowed to view it. Those who provide this access must 
be responsible for verifying both the legitimacy of the business or 
person inquiring, as well as the appropriateness of their reason for 
doing so. Of course, other entities such as credit card companies, 
department stores--even the video store, as I mentioned--have sensitive 
information as well. They must be similarly responsible with the data, 
and take vigorous steps to protect it.
    Congress has not laid out a comprehensive framework for data 
security and data brokers, and it is clear that we need to act. This 
Committee must take the lead in developing appropriate safeguards for 
consumer information, and we will proceed to that end on a bipartisan 
basis. I am glad that Chairman Stearns has put together a diverse panel 
to discuss this topic, and to explore options for how we as 
policymakers can help address the concerns of the American public.
    With that, I would like to welcome the witnesses and thank them for 
their participation. I am very interested to hear what these companies 
and their industries are doing to help prevent identity theft, and the 
misuse of personal information in general.
    Thank you, and I yield back the balance of my time.
                                 ______
                                 
Prepared Statement of Hon. Ed Towns, a Representative in Congress from 
                         the State of New York
    Thank you Mr. Chairman for holding this important hearing. Since we 
last met, the privacy of our constituents has been compromised further 
and their worries have increased ten-fold. I was encouraged by the 
feedback that we received in our hearing this past March, but there is 
much more work to be done.
    I was pleased to learn that banks and credit card companies are 
detecting fraud at a quicker rate and successfully shutting down 
information-sharing websites before identity theft becomes more rampant 
and uncontrollable. While I understand that stolen or lost credit cards 
still account for the largest losses to consumers, the danger these on-
line thieves pose must be confronted and dealt with.
    According to an article in Monday's Wall Street Journal, the Anti-
Phishing Working Group says 2,870 active phishing sites were reported 
in March alone, and that since last July such sites have increased 28% 
a month. The article goes on to state that about 980,000 American 
consumers had encountered identity-theft fraud via phishing in the 
prior year, costing banks and credit card issuers more than $1.2 
billion in direct losses.
    I have had a long-standing interest in protecting consumers' 
privacy. I first began advocating for safeguarding medical records when 
I found my own records in a public trash bin following a doctor's 
appointment. In response, I introduced a bill protecting the privacy 
rights of insurance claimants, which became part of HIPPA.
    Since last Congress, I have been working with my colleague, 
Congresswoman Mary Bono to protect consumers' privacy on the internet 
from Spyware. Our committee passed this bill last week and I am hopeful 
that we can send it to the President's desk before the end of this 
year.
    I look forward to hearing from our witnesses about what went wrong 
in these recent cases and how we can better protect consumers.
    Thank you Mr. Chairman. I yield back the balance of my time.

    Mr. Stearns. We want to welcome Ms. Barrett of Acxiom 
Corporation; also Mr. Steve Buege, Senior Vice President of 
Business Information, News and Public Records, North American 
Legal; Thomson West; Mr. Oliver Ireland, Partner, Financial 
Services Practice Group, Morrison and Foerster; on behalf of 
Visa U.S.A., Mr. Daniel Burton, Vice President of Government 
Affairs, Entrust, Incorporated, McLean, Virginia; and Mr. 
Daniel Solove, Associate Professor of Law at George Washington 
University Law School. I thank all of you for attending this 
morning. And, Ms. Barrett, we will start with you for your 
opening statement.

 STATEMENTS OF JENNIFER BARRETT, CHIEF PRIVACY OFFICER, ACXIOM 
   CORPORATION; STEVE BUEGE, SENIOR VICE PRESIDENT, BUSINESS 
  INFORMATION, NEWS AND PUBLIC RECORDS, NORTH AMERICAN LEGAL; 
OLIVER I. IRELAND, PARTNER, FINANCIAL SERVICES PRACTICE GROUP, 
   MORRISON AND FOERSTER, LLP, ON BEHALF OF VISA USA; DANIEL 
 BURTON, VICE PRESIDENT OF GOVERNMENT AFFAIRS, ENTRUST, INC.; 
   AND DANIEL J. SOLOVE, ASSOCIATE PROFESSOR OF LAW, GEORGE 
                WASHINGTON UNIVERSITY LAW SCHOOL

    Ms. Barrett. Thank you, Chairman Stearns, Ranking Member 
Schakowsky, Congressman Ross, and distinguished members of this 
committee. I thank you for the opportunity for Acxiom to 
participate in this hearing, and I ask for unanimous consent 
that my written statement be entered in the record.
    Mr. Stearns. By unanimous consent, so ordered.
    Ms. Barrett. Mr. Chairman, let me be blunt. The bad guys 
are smart and they are getting better organized in using their 
skills to intelligently but illegally and fraudulently access 
personal information. Acxiom must therefore remain more 
vigilant and innovative by constantly improving, auditing, and 
testing our systems, and yes, even learning from the security 
breaches in the marketplace.
    Information is an integral part of the American economy, 
and Acxiom recognizes its responsibility to safeguard the 
personal information it collects and brings to the market. As 
FTC Chairman Majoras recently stated in her testimony both 
before the Senate and the House, ``There is no such thing as 
perfect security.'' And breaches can happen even when a company 
has taken every reasonable precaution. Although we believe this 
to be true, no one has a greater interest than Acxiom in 
protecting its information because our very existence depends 
on it.
    Acxiom's U.S. business includes two distinct components: 
our customized computer services and a line of information 
products. Our computer services, which represent more than 80 
percent of the company's business, help businesses, not-for-
profit organizations, political parties, and government manage 
their own information. Less than 20 percent of our business 
comes from our four lines of products involving information--
our fraud management products, our background screening 
products, our directory products, and our marketing products. 
Our fraud management and background screening products are the 
only Acxiom products containing sensitive information, and they 
represent less than 10 percent of our business.
    Acxiom would like to take this opportunity to set the 
record straight in response to a couple of misunderstandings 
that have developed about the company. First, Acxiom does not 
maintain one big data base containing dossiers on anyone. 
Instead, we build and maintain discrete, segregated data bases 
for each and every product.
    Second, Acxiom does not co-mingle client information that 
comes from the services we provide to our clients with their 
information products, which we are responsible for. Such 
activity would constitute a violation of our contracts and 
consumer privacy.
    Third, Acxiom's fraud management products are sold only to 
a handful of large companies and government agencies who have a 
legitimate need for them. The information utilized in these 
products is covered under the safeguards and use rules of the 
Gramm-Leach-Bliley Act and both State and Federal driver 
privacy protection laws.
    Fourth, Acxiom's fraud management verification services 
only validate information already in our client's possession. 
Access to additional information is available only to law 
enforcement and the internal fraud departments of large 
financial institutions and insurance companies.
    Fifth, our background screening products are covered under 
the Fair Credit Reporting Act, and we do not pre-aggregate 
information provided in these services.
    Beyond these protections, the following additional 
safeguards exist: first, because public record information is 
blended with regulated information in both our fraud management 
and our background screening products, Acxiom voluntarily 
applies the more stringent security standards to all such 
blended data, even though not required to by law. Since 1997 
Acxiom has posted a privacy policy on our website describing 
both our online and all our offline practices, thus voluntarily 
subjecting the company to the FTC rules governing unfair or 
deceptive practices. Third, the company has imposed our own 
internal, more restrictive guidelines for use of sensitive 
information such as Social Security numbers. And fourth, all of 
Acxiom's information products and practices have been audited 
on an annual basis since 1997, and our security policies are 
regularly audited both by ourselves, as well as by many of our 
clients.
    Two years ago Acxiom experienced a security breach on one 
of the external file transfer servers used to transfer 
information back and forth between Acxiom and our clients. 
Fortunately, the vast majority of the information involved was 
of a non-sensitive nature, and law enforcement was able to 
apprehend the suspects and ascertain that none of the 
information was used to commit identity fraud. Since then, 
Acxiom has put in place even greater protections for the 
benefit of both consumers and our clients.
    In conclusion, I would like to say that ongoing privacy 
concerns indicate the adoption of additional legislation may be 
appropriate. Acxiom supports efforts to pass federally 
preemptive legislation requiring notice to consumers in the 
event of a security breach, which places the consumer at risk 
of identity fraud. Acxiom also supports the recent proposal 
from FTC Chairman Majoras for the extension of the GLBA 
Safeguards Rule.
    Mr. Chairman, on behalf of Acxiom I want to express our 
gratitude for the opportunity to participate, and we will be 
happy to answer any questions the committee may have.
    [The prepared statement of Jennifer Barrett follows:]
 Prepared Statement of Jennifer Barrett, Chief Privacy Officer, Acxiom 
                              Corporation
                              introduction
    Chairman Stearns, Ranking Member Schakowsky and distinguished 
Members of the Committee, thank you taking the time to hold this 
hearing on consumer data and options following security breaches. 
Acxiom appreciates the opportunity to participate in today's hearing.
    Acxiom has an inherent responsibility to safeguard the personal 
information we collect and bring to the market, and we have focused on 
assuring the appropriate use of these products and providing a safe 
environment for this information since 1991 when the company brought 
its first information products to market.
    It is important that we all recognize that information has become 
an ever growing and ever more integral part of the American economy. 
Information is the facilitator of convenience, competition and provides 
the tools that reduce fraud and terrorism. As such, we believe that it 
is Acxiom's obligation to provide effective safeguards to protect the 
information we bring to market regardless of the difficulties 
encountered in doing so.
    Let me be blunt. The bad guys are smart and getting more organized. 
They will use all of the skills available to them to try to find ways 
to obtain the information they need to commit fraud. Acxiom must 
therefore remain vigilant and innovative, and that is why we employ a 
world-class information security staff to help us fend off criminals 
who attempt to access Acxiom's data. Acxiom is constantly improving, 
auditing and testing its systems. Yes, Acxiom is even learning from 
security breaches when they occur, and we are certain that other 
responsible companies are doing so as well.
    As Chairman Deborah Majoras of the Federal Trade Commission 
recently stated in her testimony before the Senate, ``[T]here is no 
such thing as perfect security, and breaches can happen even when a 
company has taken every reasonable precaution.'' Even though we believe 
that this is true, no one has a greater interest than Acxiom in 
protecting information because the company's very existence depends on 
securing personal information pertaining to consumers.
    In order to enjoy the benefits provided by a robust information-
based economy and also to keep our citizens safe from fraudulent 
activity, there are no quick fixes or easy solutions. We believe that 
it is necessary that cooperation exists among policy makers, 
information service providers, Acxiom's clients, law enforcement and 
consumers. We applaud your interest in exploring these issues and we 
very much want to be a resource in helping you achieve the proper 
legislative balance we all seek.
                        about acxiom corporation
    Founded in 1969, Acxiom is headquartered in Little Rock, Arkansas, 
with operations throughout the United States, and with processing 
centers in Arkansas, Illinois, Arizona, Ohio and California. The 
company also has offices in nine other countries across Europe and 
Asia. From a small company in Arkansas, Acxiom Corporation has grown 
into a publicly traded corporation with more than 6,000 employees 
worldwide
    Acxiom's U.S. business includes two distinct components: customized 
computer services and a line of information products. Acxiom's computer 
services represent the vast majority of the company's business and they 
include a wide array of leading technologies and specialized computer 
services focused on helping clients manage their own customer 
information. These services are offered exclusively to large 
businesses, not-for-profit organizations, political parties and 
candidates, and government agencies. Acxiom's private sector computer 
services clients represent a ``who's who'' of America's leading 
companies. Acxiom helps these clients improve the loyalty of their 
customers and increase their market share, while reducing risk and 
assisting them with their compliance responsibilities under state and 
federal law. Finally, Acxiom helps government agencies improve the 
accuracy of the personal information they currently hold.
    The balance of Acxiom's business comes from information products 
that are comprised of four categories: fraud management products, 
background screening products, directory products and marketing 
products. These four product lines represent less than 20 percent of 
the company's total business and the fraud management and background 
screening products represent less than 10 percent. While each product 
plays a unique role, all of Acxiom's information products help fill an 
important gap in today's business-to-consumer relationship.
    To understand the critical role Acxiom plays in facilitating the 
nation's economy and safeguarding consumers, it is important to 
understand what the company does not do. Over the years, a number of 
myths have developed about Acxiom that require clarification. Please 
allow us to set the record straight:

 Acxiom does not maintain one big database that contains detailed 
        information about all individuals. Instead, the company 
        safeguards discrete databases developed and tailored to meet 
        the specific needs of Acxiom's clients--entities that are 
        appropriately screened and with whom Acxiom has legally 
        enforceable contractual commitments. I cannot call up from the 
        company's databases a detailed dossier on myself or any 
        individual.
 Acxiom does not provide information on particular individuals to the 
        public, with the exception of Acxiom's telephone directory 
        products. These products, which are available on several 
        Internet search engines, contain information already available 
        to the public. The other information Acxiom processes is 
        provided only to legitimate businesses for specific legitimate 
        business purposes.
 Acxiom's does not have any information in either its directory or 
        marketing products which could be used to commit identity 
        fraud. Acxiom also does not include detailed or specific 
        transaction-related information, such as what purchases an 
        individual made on the Internet or what websites they visited. 
        The company's directory products include only name, address and 
        telephone information. The company's marketing products include 
        only information that is general in nature and not specific to 
        an individual purchase or transaction.
 Acxiom does not commingle client information that the company 
        processes in its computer services business with any of our 
        information products. Such activity would constitute a 
        violation of the company's services contracts with those 
        clients and a violation of consumer privacy. A client for whom 
        the company performs services may have a different agreement 
        with us as a data contributor, but these two relationships are 
        kept entirely separate.
    Acxiom's fraud management products are sold exclusively to a 
handful of large companies and government agencies--they are not sold 
to individuals. The company's verification services only validate that 
the information our client has obtained from the consumer is correct. 
Only law enforcement, government agencies and the internal fraud 
departments of large financial institutions and insurance companies 
have access to additional information.
    Acxiom's background screening products provide employment and 
tenant screening services which utilize field researchers who do in-
person, real-time research against public records and make calls to 
past employers to verify the information provided by the consumer. 
Where permitted by law, a pre-employment credit report can also be 
obtained. Acxiom does not pre-aggregate information for these products.
    Acxiom's directory information products contain only contact 
information on consumers such as name, address and telephone number. 
They are collected so businesses and consumers can locate other 
businesses or consumers. They are compiled from the white and yellow 
pages of published U.S. and Canadian telephone directories and from 
information available from the various directory assistance services 
provided by the telephone companies.
    Acxiom's marketing information products provide demographic, 
lifestyle and interest information to companies to reach prospective 
new customers who are most likely to have an interest in their products 
and to better understand and serve the needs of existing customers. 
They are compiled from pubic records, surveys and summarized customer 
information primarily from publishers and catalogers.
              respecting and protecting consumers' privacy
    Acxiom has a longstanding tradition and engrained culture of 
protecting and respecting consumer interests in our business. The 
company is today, and always has been, a leader in developing self-
regulatory guidelines and in establishing security policies and privacy 
practices. There are, as explained below, numerous laws and regulations 
that govern our business. Ultimately, however, Acxiom's own 
comprehensive approach to information use and security goes far beyond 
what is required by either law or self-regulation.
Safeguards Applicable to Products Involving the Transfer of Sensitive 
        Information
    Only Acxiom's fraud management and background screening products 
involve the transfer of sensitive information. These products, 
therefore, are subject to law, regulations and our own company policies 
that help protect against identity fraud. These legal protections and 
additional safeguards are addressed below:

GLBA, DPPAs, and FTC: Our fraud management products utilize information 
        covered under the Gramm-Leach-Bliley Act (GLBA), and driver's 
        license information covered under both state and federal 
        driver's privacy protection acts (DPPAs). These obligations 
        include honoring GLBA and DPPA notice and choice related to 
        sharing and use of the information, the GLBA Safeguard Rules 
        and FTC Privacy Rule and Interagency Guidelines. Any uses of 
        data must fall within one of the permitted uses or exceptions 
        specified in these laws.
FCRA and FACTA: Our background screening products are covered by all of 
        the regulations and consumer protections established by the 
        Fair Credit Reporting Act (FCRA) and the Fair and Accurate 
        Credit Transactions Act (FACTA). These protections include: the 
        requirement that a consumer authorize the creation of 
        employment reports; notice of adverse actions taken based on 
        such report; and the right of consumers to obtain a copy of 
        such reports and to dispute inaccuracies. Finally, such 
        regulations require that re-verification or correction of 
        disputed information be performed in a timely manner.
    Safeguarding Public Record Information: Public records are used in 
both Acxiom's fraud management and background screening products. 
Although a heightened level of protection is not mandated for such 
public record information, by virtue of the fact that such public 
information is blended with regulated information, Acxiom voluntarily 
chooses to apply the more stringent standards of the above-mentioned 
regulations to the resulting products.
Safeguards Applicable to Other Products
    Although Acxiom's directory and marketing products do not contain 
any sensitive information that could put a consumer at risk for 
identity fraud, Acxiom is still subject to the following critical 
safeguards: various industry guidelines, compliance with all 
requirements in the original notice to consumers at the time the data 
was collected, and voluntary compliance with those laws to which our 
clients themselves are subject.

Telephone Directory Safeguards: Acxiom's directory products comply with 
        all applicable policies regarding unpublished and unlisted 
        telephone numbers and addresses. In addition, because Acxiom 
        recognizes that consumers may object to published listings 
        being available on the Internet, Acxiom itself offers an opt-
        out from such use. Further, Acxiom voluntarily suppresses all 
        telephone numbers found on the Federal Trade Commission's Do-
        Not-Call Registry and the eleven other state Do-Not-Call 
        registries, when providing phone numbers for targeted 
        telemarketing purposes.
Marketing Product Safeguards: Acxiom's marketing products comply with 
        all the self-regulatory guidelines issued by the Direct 
        Marketing Association. These requirements include notice and 
        the opportunity to opt-out. Consumers have the ability to opt-
        out from Acxiom's marketing products by calling the company's 
        toll-free Consumer Hotline, accessing its Website, or by 
        writing to the company. Since Acxiom does not have a customer 
        relationship with individual consumers, Acxiom coordinates with 
        its industry clients to research and resolve consumer 
        inquiries.
Additional Safeguards
    Acxiom takes seriously its responsibility to assure that all the 
information we bring to market is appropriate for the use to which it 
is intended and to provide adequate safeguards specifically aimed at 
protecting against unauthorized use.

Privacy Policy/FTC Jurisdiction: Since 1997, long before it was a 
        common practice, Acxiom has posted its privacy policy on the 
        company's website. The privacy policy describes both Acxiom's 
        online and offline consumer information products. The policy 
        further describes: what data Acxiom collects for these 
        products; how such data is used; the types of clients to which 
        such data is licensed; as well as the choices available to 
        consumers as to how such data is used. By making these 
        extensive disclosures, Acxiom has voluntarily subjected itself 
        to Section 5 of the Federal Trade Commission Act, which 
        prohibits unfair or deceptive conduct in the course of trade or 
        commerce, as well as various state statutes governing unfair 
        and deceptive acts and practices.
Consumer Care Department/Consumer Hotline: Acxiom maintains a Consumer 
        Care Department led by a Consumer Advocate whose team 
        interacted with more than 50,000 consumers in the past 12 
        months by way of answering questions, resolving issues, 
        processing opt-outs, and handling requests for access to 
        Acxiom's fraud management, background screening, directory and 
        marketing products. Acxiom provides consumers who contact the 
        company (through the company website, or by calling a toll-free 
        Consumer Hotline or by writing to the company) the options of: 
        opting-out of all of Acxiom's marketing products; receiving an 
        information report from the company's fraud management and 
        directory products; or receiving a consumer report as specified 
        in the FCRA from the company's background screening products. 
        Acxiom encourages consumers to notify the company if the 
        information in any of these reports is inaccurate and it is the 
        company's policy either to correct the information, to delete 
        it or to refer the consumer to the appropriate source to obtain 
        the requested correction, such as a county or state agency.
Certification and Compliance with Federal and State Law: Acxiom's 
        privacy policy is designed to adhere to all Federal, State, and 
        local laws and regulations on the use of personal information. 
        The company is also certified under the Department of 
        Commerce's European Union Safe Harbor and the Better Business 
        Bureau's Online Seal.
Consumer Education:  Acxiom believes that consumers should be educated 
        about how businesses use information. To that end, Acxiom 
        publishes a booklet, entitled ``Protecting Your Privacy in the 
        Information Age--What Every Consumer Should Know About the Use 
        of Individual Information,'' which is available for free both 
        on the company's website and upon written or telephone request.
Voluntary Acxiom Policies: Above and beyond the industry-accepted 
        guidelines with which Acxiom complies, Acxiom also has 
        established its own internal guidelines, which are more 
        restrictive than industry standards. For example, Acxiom only 
        collects the specific information required to meet its clients' 
        information needs, and the company properly disposes of the 
        remaining data, when information is compiled from public 
        records. Acxiom has also implemented specific guidelines 
        regarding the use and protection of information that could be 
        involved in identity fraud, such as Social Security numbers.
Information Practice and Security Audits: Acxiom has had a longstanding 
        focus on the appropriate use of information in developing and 
        delivering its information products. While the creation of 
        strong information use policies is a business imperative, 
        assuring these policies are followed is equally important. To 
        this end, all of Acxiom's information products and practices 
        have been internally and externally audited on an annual basis 
        since 1997.
      Since many of Acxiom's computer service clients are financial 
        institutions and insurance agencies, Acxiom has been regularly 
        audited for many years by these clients. Furthermore, Acxiom 
        must honor the safeguards and security policies of the 
        company's clients. Since Acxiom's security program is 
        enterprise-wide, it is the company's policy to institute these 
        high levels of protection across all lines of business. These 
        client audits, along with Acxiom's own internal security 
        audits, provide Acxiom with regular and valuable feedback on 
        ways to stay ahead of hackers and fraudsters who may attempt to 
        gain unauthorized access to Acxiom's systems.
Lessons Learned
    Two years ago, Acxiom experienced a security breach on one of the 
company's external file transfer servers. The hackers were employees of 
an Acxiom client and a client's contractor. As users with legitimate 
access to the server, the hackers had received authority to transfer 
and receive their own files. The hackers did not penetrate the 
firewalls to Acxiom's main system. They did, however, exceed their 
authority when they accessed an encrypted password file on the server 
and successfully unencrypted about 10 percent of the passwords, which 
allowed them to gain access to other client files on the server. 
Fortunately, the vast majority of the information involved in this 
incident was of a non-sensitive nature.
    Upon learning of the initial breach from law enforcement, Acxiom 
immediately notified all affected clients and, upon further forensic 
investigation, the company informed law enforcement regarding a second 
suspected security incident. Fortunately, in both instances, law 
enforcement was able to apprehend the suspects, recover the affected 
information and ascertain that none of the information was used to 
commit identity fraud. One of the hackers pled guilty and was recently 
sentenced to 48 months in federal prison. The other is currently 
awaiting trial.
    As a result of the breach, Acxiom cooperated with audits conducted 
by dozens of its clients, and both the Federal Trade Commission and the 
Office of the Comptroller of the Currency examined Acxiom's processes 
to ensure that the company was in compliance with all applicable laws 
and its own stated policies.
    This experience taught Acxiom additional valuable lessons regarding 
the protection of information. For example, Acxiom now requires the use 
of more secure passwords on the affected server. The process for 
transferring files has been changed, specifically by keeping 
information on the server for much shorter periods of time. And while 
it was always a recommended internal policy, Acxiom now requires that 
all sensitive information passed across such servers be encrypted. In 
addition, while Acxiom has had in place a Security Oversight Committee 
for many years, the company has also now appointed a Chief Security 
Officer with more than 20 years of IT experience. In short, Acxiom's 
systems are more secure today as a result of the company's experience 
and dedication to the privacy of consumers.
The Need For Additional Legislative Safeguards
    There has been much discussion, especially in recent weeks, about 
whether existing federal law sufficiently protects consumers from harm. 
In this regard, Acxiom does believe that additional, appropriately 
tailored legislation would assist Acxiom, the rest of the information 
services industry and businesses in general in ensuring that consumers 
are protected from fraud and identity theft. But, as FTC Chairman 
Majoras has said, even the best security systems imaginable and the 
strongest laws possible can nonetheless be circumvented by inventive 
criminals' intent on committing fraud.

Breach Notification: Acxiom supports efforts to pass federal preemptive 
        legislation requiring notice to consumers in the event of a 
        security breach, where such breach places consumers at risk of 
        identity theft or fraud. California implemented similar 
        legislation several years ago, and over thirty other states are 
        involved in passing similar laws. The bottom line is that 
        consumers deserve a nationwide mandate that requires that they 
        be notified when they are at risk of identity theft, so they 
        can take appropriate steps to protect themselves.
Extension of the GLBA Safeguards Rule: Currently, Acxiom voluntarily 
        subjects itself to the GLBA Safeguards Rule with respect to the 
        company's computer services and information products. Acxiom 
        also complies with the California safeguards law (AB 1950). FTC 
        Chairman Majoras recently has proposed an extension of the GLBA 
        Safeguards Rule to the information services industry as a 
        whole. Acxiom supports her recommendation.
    Mr. Chairman, Acxiom appreciates the opportunity to participate in 
this hearing and to assist Congress in identifying how best to 
safeguard the nation's information and data. Acxiom is available to 
provide any additional information the Committee may request.

    Mr. Stearns. I thank you. Our next witness is Mr. Buege. 
Welcome.

                    STATEMENT OF STEVEN BUEGE

    Mr. Buege. Chairman Stearns, Congresswoman Schakowsky, 
members of this distinguished committee, thank you for allowing 
West to present testimony before this hearing of the 
Subcommittee on Commerce, Trade, and Consumer Protection. I 
commend you for continuing its tradition of ardent and 
principled investigation and legislative oversight of so many 
of the issues that touch each of us every day.
    My name is Steve Buege. I am senior vice president of 
Business Information, News, and Public Records for West. I 
oversee this content on Westlaw. I have worked for West nearly 
20 years, most recently as head of operations, and prior to 
that as chief technology officer. I am proud to be associated 
with West and of West's record in the data privacy arena.
    West has served the same niche customer base, legal and 
government professionals, for over 125 years and throughout our 
transformation from being a traditional law book publisher to a 
leader in information technology. In 1975 West introduced its 
first online legal research service, Westlaw, and we have been 
a pioneer in e-commerce ever since.
    According to our research, the total U.S. public records 
market represents about $7 billion annually. Of that, $1 
billion is focused on the crime, law enforcement, prosecution 
area. About $160 million of that is in the legal market. For 
our business, data bases with full SSNs account for only a 
fraction of 1 percent of our revenue.
    West's customers work in law firms, courts, government, and 
corporate legal departments. Much of the information they need 
to do their jobs is, by its very nature, sensitive. We are 
acutely aware of this and consider ourselves stewards of data 
privacy.
    Given the attention this issue has recently received in 
Washington and in the media, we have carefully reviewed and 
further tightened our policies. Throughout this process, our 
ultimate test was to do the right thing. Our record proves that 
we are on the right track.
    Since February, West has removed access to full SSNs from 
about 85 percent of the accounts that had it, and blocked this 
access entirely to all non-government accounts. Today, the only 
customers who can access full SSNs are government agencies 
involved in crime prevention, prosecution, and homeland 
security. Primarily, the Federal courts, Department of Justice, 
and IRS. We also have some smaller government accounts all in 
the areas of law enforcement and homeland security as well with 
access to full SSNs. All of these accounts are carefully 
vetted. It is important to note that we have never granted ad 
hoc access to full SSNs and that West serves a specialized B to 
B market of legal and government professionals, not a consumer-
oriented market.
    West's policies go well beyond what is required under 
various privacy laws, yet we recognize the need for more 
clarity and regulatory guidance. We welcome the opportunity to 
work with you on a variety of approaches, including 
establishing a uniform notification system to inform citizens 
whose data may have been compromised, charging a government 
agency with regulatory oversight of public data providers 
similar to the FTC's role with financial institutions, 
requiring senior management in data companies that deal with 
SSNs to sign off on their companies' security and privacy 
arrangements, and legislation that would establish a consistent 
method for masking SSNs--for example, always obscuring the last 
four digits.
    Thank you for your interest and your hard work and for 
allowing West to be part of this discussion. I look forward to 
continuing to work with you on this important matter.
    [The prepared statement of Steve Buege follows:]
  Prepared Statement of Steve Buege, Senior Vice President, Business 
         Information News and Public Records, on Behalf of West
                              introduction
    Chairman Stearns, Congresswoman Schakowsky, Members of this 
distinguished Committee: Thank you very much for allowing West the 
opportunity to present testimony before this hearing of the Energy and 
Commerce Committee's Subcommittee on Commerce, Trade, and Consumer 
Protection. I commend you for continuing the Committee's tradition of 
ardent and principled investigation and legislative oversight of so 
many of the issues that touch each of us every day.
    My name is Steve Buege. I'm senior vice president of Business 
Information News and Public Records. In that role for West, I oversee 
our news, business information and public records content on Westlaw, 
and together with the president and CEO of West, I oversee the policies 
governing procurement of and access to that information.
    Prior to this, I was vice president of Operations for West, where 
Customer Experience, Technology and Content Operations reported into 
me. Prior to that, I was Chief Technology Officer for four years. In my 
work with the company, spanning now some 20 years, I've participated in 
some of its most important transformations. I have intimate knowledge 
of its technology, its business and its values. And I am proud of my 
association with the business.
                      about west and our customers
    West has been serving the same niche customer base--exclusively 
legal and government professionals--for more than 125 years. Our 
company founder, John B. West, started West Publishing in 1872 as a 
regional book and office supply seller for attorneys in the Midwest. 
Eventually, West covered judicial opinions from every state, circuit 
and appellate court and the U.S. Supreme Court.
    Our core market has remained legal and government customers for 
more than a century. West maintained this focus on the B2B market while 
transitioning from a traditional legal book publisher to a leader in 
the information technology revolution. In 1975, West introduced its 
first online legal research service, Westlaw. We've been a pioneer in 
e-commerce ever since. We embraced the Internet, and electronic 
publishing is at the heart of our business today.
    The West name--from West Publishing to Westlaw--has long been known 
as an authoritative, trustworthy source for the U.S. bench and bar. 
This market recognizes Westlaw as the premier online legal research 
service; it offers the world's largest databases of legal research 
materials, statutes, case law, legal treatises and business 
information.
    West has been acutely focused on security and privacy issues, 
especially in the last 10 years as access to electronic information has 
increased significantly. We consider ourselves stewards of data 
privacy. West was a founding member of the Individual Reference 
Services Group (IRSG). The 1997 IRSG Principles defined a balance 
between personal privacy and the important societal benefits of 
reference services. West used these principles to establish procedures 
for qualifying its users, with only government agencies and a very 
small number of professional users receiving qualified access to full 
Social Security numbers.
    Today, West still refers to the IRSG Principles for guidance about 
our collection and distribution of information. For example, although 
the Gramm-Leach-Bliley Act's privacy rule permits distribution of 
information--including full Social Security numbers--to any entity that 
fits within the exception to the rule, West limits distribution of full 
Social Security numbers to specific government agencies--going beyond 
the requirements of GLBA.
                 overview of the public records market
    According to our research, the U.S. public records market 
represents about $7 billion dollars annually. Within this space, $1 
billion is focused on the crime/law enforcement/prosecution area; 
approximately $160 million of that space is focused on usage within the 
legal market. Of this $160 million, only a fraction relates to records 
with full Social Security numbers. For our legal businesses, databases 
with full Social Security numbers only account for a fraction of 1 
percent of our revenues.
    It's important to note that only vetted government customers who 
deal with law enforcement, investigatory or homeland security issues 
have access to full Social Security numbers. None of our corporate 
clients have this access.
                          our privacy policies
    West's customers work in law firms, the courts, government and 
corporate legal departments. Much of the information our customers need 
to do their jobs and serve our legal justice system is, by its very 
nature, sensitive.
    West has always been a good steward of this sensitive information, 
and we are deeply committed to ensuring that we achieve the proper 
balance between making information available for legitimate business 
and governmental purposes and respecting people's expectations of 
privacy.
    Given the attention this issue has received in Washington and in 
the media during the past few months, we have carefully reviewed our 
policies and made significant changes concerning access. Throughout 
this process, our ultimate test was to do the right thing. Our record 
proves that we're on the right track.
    Since February, West has reviewed the very small number of 
customers who had access to full Social Security numbers and further 
restricted which customers are allowed such access. We removed access 
to full Social Security numbers for about 85 percent of the accounts 
who had it, and blocked this type of access to all non-government 
accounts. Today, most customers who can access full Social Security 
numbers are government agencies involved in crime prevention, 
prosecution and homeland security--primarily the Federal Courts, the 
Department of Justice and the IRS. We also have some smaller accounts--
all in the areas of law enforcement and homeland security as well--with 
access to full Social Security numbers. All these accounts are 
carefully vetted. It's important to note that we have never granted ad 
hoc access to full Social Security numbers and that West serves a 
specialized market of legal and government professionals--not a 
consumer-oriented market.
Opt-in policy
    In the past few months, West has worked with our government 
customers to fully institute an opt-in policy; that is, a policy that 
assumes a government account will not have full access to Social 
Security numbers. Under this new policy, accounts that need access to 
full Social Security numbers will be granted access only to specified 
and qualified individuals. Moving forward, all new contracts West 
enters with government agencies will be opt-in only.
Enhanced usage tracking and Westlaw reminders
    West also has introduced new procedures to monitor databases that 
contain Social Security numbers for unusual use patterns, and on a go-
forward basis, customers permitted to view full Social Security numbers 
on Westlaw will see a special notification message--any time--they--
access--these databases.--This message will remind the user that he or 
she is among a--limited--number of people given privileged access to 
this information, and that it must be used only for appropriate 
purposes and in compliance with the law and the privacy terms West 
imposes. This will ensure that individual users are aware of their 
responsibility in accessing Social Security numbers as well as their 
unique privilege to use this information.
    West's policy goes well beyond what's required under--various 
privacy--laws. We are committed to working with this Committee to fully 
explore this complex issue. We also hope to work with you, federal 
agencies and the industry to ensure that the public is protected from 
fraud and that those committed to fighting and prosecuting these crimes 
will have the information they need to do their important work.
                   privacy guidelines and regulations
    And that is why I'm here today. West recognizes the need for 
guidelines, and we would welcome the opportunity to work with you to 
advance a variety of approaches. From our business perspective, here 
are some areas where we welcome clarity and guidance:

 Establishing a uniform notification system that informs customers 
        whose data may have been compromised
 Allowing a government agency to have an appropriate regulatory role 
        over public data providers, similar to the regulatory role the 
        Federal Trade Commission currently has regarding data matters 
        in financial institutions
 Requiring senior management in data companies that deal with Social 
        Security numbers to sign off on a business's security and 
        privacy arrangements
    Also, you may want to consider the following ideas that haven't 
been as widely discussed:

 Legislation that would establish a universally applied method for 
        masking Social Security numbers. (Now there are several common 
        ways that entities mask Social Security numbers. Some mask the 
        first five digits and others truncate the last four. This might 
        allow someone to determine a full Social Security number by 
        using two differently masked numbers.)
 Encouraging each business in this space to find an alternative 
        technology solution--instead of Social Security numbers--to 
        create a unique locator that distinguishes one individual with 
        the same name from another. This approach would be specific to 
        each business; it wouldn't be uniform across the industry.
                               conclusion
    Thank you for your interest, your hard work and allowing West to be 
part of your discussion. I look forward to continuing to work with you 
on this important matter as we balance individuals' rights to privacy 
with the national concern for justice and homeland security.

    Mr. Stearns. I thank the gentleman. Mr. Ireland, well, 
welcome.

                 STATEMENT OF OLIVER I. IRELAND

    Mr. Ireland. Good morning, Chairman Stearns----
    Mr. Stearns. I just need you to----
    Mr. Ireland. [continuing] Ranking Member Schakowsky, and 
members of the subcommittee. My name is Oliver Ireland. I am a 
partner in the Washington, DC office of Morrison and Foerster, 
and I am pleased to be here today on behalf of Visa U.S.A. to 
address the issue of consumer information security.
    Visa has long recognized the importance of protecting 
cardholder information. The Visa system provides for zero 
liability for cardholders for unauthorized transactions. 
Therefore, Visa members, card issuers incur the costs of 
fraudulent transactions that may result from unauthorized 
access to cardholder information and have a strong interest in 
protecting that information.
    Further, existing Federal law obligates financial 
institutions to protect their customers' information. Under 
Section 501(b) of the Gramm-Leach-Bliley Act, the Federal 
banking agencies and the Federal Trade Commission have 
established information security standards for the financial 
institution subject to their jurisdiction. But many holders of 
sensitive personal information, including, for example, 
employers and retail merchants, are not financial institutions 
subject to the 501(b) rule. In part, to address this gap, Visa 
is implementing a comprehensive Cardholder Information Security 
Plan or CISP. CISP requires all holders of cardholder 
information, including merchants, to comply with the ``Visa 
Digital Dozen,'' 12 basic requirements for safeguarding 
customer information.
    Visa also uses sophisticated neural networks to detect and 
block transactions where fraud is suspected. These networks, 
coupled with CISP and Visa's zero liability policy provide a 
high degree of protection from fraudulent credit card 
transactions to cardholders. Nevertheless, Visa believes that 
all businesses that maintain sensitive personal information 
should be subject to uniform national requirements to protect 
that sensitive information.
    Closely related to the issue of information security is the 
question of what to do if a security breach occurs. Visa 
believes that where the breach creates a substantial risk of 
harm to consumers, that the consumers can take action to 
prevent, the consumers should be notified so that they can take 
the appropriate action. Both Federal and California law already 
address this issue. For example, the California law currently 
requires notice to individuals of a breach of security 
involving their computerized personal information. Other States 
have enacted or are considering security breach notification 
laws. However, the details of these laws differ.
    The Federal banking agencies have also issued guidance that 
requires banking institutions that experience a breach of 
security involving sensitive customer information to notify 
customers where misuse of the information has occurred or is 
reasonably possible.
    The fact that States are not addressing notification in a 
uniform way creates a critical need for a single, national 
standard for notification. A single standard will avoid 
confusion among consumers as to the meaning of notices that 
they receive and among holders of consumer information as to 
their notification responsibilities.
    Further, any legislation on security breach notification 
should recognize compliance with the banking agency guidance 
that is already in place as compliance with any Federal 
notification requirement. Further, such notification 
requirements should be risk-based to avoid inundating consumers 
with notices where no action by consumers is required. As FTC 
Chair Majoras has testified, notices should be sent only if 
there is a significant risk of harm.
    Thank you again for the opportunity to be here today. I 
would be happy to answer any questions from the members of this 
committee.
    [The prepared statement of Oliver I. Ireland follows:]
 Prepared Statement of Oliver I. Ireland on Behalf of Visa U.S.A. Inc.
    Good morning Chairman Stearns, Ranking Member Schakowsky, and 
Members of the Subcommittee. I am a partner in the law firm of Morrison 
& Foerster LLP, and practice in the firm's Washington, D.C. office. I 
am pleased to appear before the Subcommittee on behalf of the Visa, 
U.S.A. Inc., to discuss the important issue of consumer information 
security.
    The Visa Payment System, of which Visa U.S.A. is a part, is the 
largest consumer payment system, and the leading consumer e-commerce 
payment system, in the world, with more volume than all other major 
payment cards combined. Visa plays a pivotal role in advancing new 
payment products and technologies, including technology initiatives for 
protecting personal information and preventing identity theft and other 
fraud.
    Visa commends the Subcommittee for focusing on the important issue 
of information security. As the leading consumer electronic commerce 
payment system in the world, Visa considers it a top priority to remain 
a leader in developing and implementing technology, products, and 
services that protect consumers from the effects of information 
security breaches. As a result, Visa has long recognized the importance 
of strict internal procedures to protect Visa's members' cardholder 
information, thereby to protect the integrity of the Visa system.
    Visa has substantial incentives to maintain strong security 
measures to protect cardholder information. The Visa system provides 
for zero liability to cardholders for unauthorized transactions. 
Cardholders are not responsible for unauthorized use of their cards. 
The Visa Zero Liability policy guarantees maximum protection for Visa 
cardholders against fraud due to information security breaches. Because 
the financial institutions that are Visa members do not impose the 
losses for fraudulent transactions on their cardholder customers, these 
institutions incur costs from fraudulent transactions. These costs are 
in the form of direct dollar losses from credit that will not be 
repaid, and also can be in the form of indirect costs attributable to 
the harm and inconvenience that might be felt by cardholders or 
merchants. Accordingly, Visa aggressively protects the cardholder 
information of its members.
        existing federal laws and rules for information security
    Existing federal laws and regulations also obligate financial 
institutions to protect the personal information of their customers. 
Rules adopted under section 501(b) of the Gramm-Leach-Bliley Act of 
1999 by the federal banking agencies and the Federal Trade Commission 
(``FTC'') (``GLBA 501(b) Rules'') establish information security 
standards for the financial institutions subject to the jurisdiction of 
these agencies. Under the GLBA 501(b) Rules, financial institutions 
must establish and maintain comprehensive information security programs 
to identify and assess the risks to customer information and then 
control these potential risks by adopting appropriate security 
measures.
    Each financial institution's program for information security must 
be risk-based. Every institution must tailor its program to the 
specific characteristics of its business, customer information and 
information systems, and must continuously assess the threats to its 
customer information and systems. As those threats change, the 
institution must appropriately adjust and upgrade its security measures 
to respond to those threats.
    However, the scope of the GLBA 501(b) Rules is limited. Many 
holders of sensitive personal information are not financial 
institutions covered by the GLBA 501(b) Rules. For example, employers 
and most retail merchants are not covered by the GLBA 501(b) Rules, 
even though they may possess sensitive information about consumers.
              visa's cardholder information security plan
    Because of its concerns about the adequacy of the security of 
information about Visa cardholders, Visa has developed and is 
implementing a comprehensive and aggressive customer information 
security program known as the Cardholder Information Security Plan 
(``CISP''). CISP applies to all entities, including merchants, that 
store, process, transmit, or hold Visa cardholder data, and covers 
enterprises operating through brick-and-mortar stores, mail and 
telephone order centers, or the Internet. CISP was developed to ensure 
that the cardholder information of Visa's members is kept protected and 
confidential. CISP includes not only data security standards but also 
provisions for monitoring compliance with CISP and sanctions for 
failure to comply.
    As a part of CISP, Visa requires all participating entities to 
comply with the ``Visa Digital Dozen''--twelve basic requirements for 
safeguarding accounts. These include: (1) install and maintain a 
working network firewall to protect data; (2) do not use vendor-
supplied defaults for system passwords and security parameters; (3) 
protect stored data; (4) encrypt data sent across public networks; (5) 
use and regularly update anti-virus software; (6) develop and maintain 
secure systems and applications; (7) restrict access to data on a 
``need-to-know'' basis; (8) assign a unique ID to each person with 
computer access; (9) restrict physical access to data; (10) track all 
access to network resources and data; (11) regularly test security 
systems and processes; and (12) implement and maintain an overall 
information security policy.
              payment card industry data security standard
    Visa is not the only credit card organization that has developed 
security standards. In order to avoid the potential for imposing 
conflicting requirements on merchants and others, in December of 2004, 
Visa, MasterCard, American Express, Discover, and Diners Club 
collaborated to align their respective data security requirements for 
merchants and third parties. Visa found that the differences between 
these security programs were more procedural than substantive. 
Therefore, Visa has been able to integrate CISP into a common set of 
data security requirements without diluting the substantive measures 
for information security already developed in CISP. Visa supports this 
new, common set of data security requirements, which is known as the 
Payment Card Industry Data Security Standard (``PCI Standard'').
  neural networks to detect fraud and block potentially unauthorized 
                              transactions
    In addition to the CISP program, which helps to prevent the use of 
cardholder information for fraudulent purposes, Visa uses sophisticated 
neural networks that flag unusual spending patterns for fraud and block 
the authorization of transactions where fraud is suspected. When 
cardholder information is compromised, Visa notifies the issuing 
financial institution and puts the affected card numbers on a special 
monitoring status. If Visa detects any unusual activity in that group 
of cards, Visa again notifies the issuing institutions, which begin a 
process of investigation and card re-issuance. These networks, coupled 
with CISP and Visa's Zero Liability, provide a high degree of 
protection from fraudulent credit card transactions to cardholders.
                   expansion of existing requirements
    Current protections notwithstanding, Visa believes that an 
obligation to protect sensitive personal information, similar to the 
GLBA 501(b) Rules, should apply broadly so that all businesses that 
maintain sensitive personal information will establish information 
security programs. Because consumer information knows no boundaries, it 
is critical that this obligation be uniform across all institutions in 
all jurisdictions.
                      security breach notification
    Closely related to the issue of information security is the 
question of what to do if a breach of that security occurs. Visa 
believes that where the breach creates a substantial risk of harm to 
consumers that the consumers can take action to prevent, the consumers 
should be notified about the breach so that they can take appropriate 
action to protect themselves. Both federal and California law already 
address this issue. California law currently requires notice to 
individuals of a breach of security involving their computerized 
personal information. The California law focuses on discrete types of 
information that are deemed to be sensitive personal information. The 
statute defines sensitive personal information as an individual's name 
plus any of the following: Social Security Number, driver's license 
number, California identification card number, or a financial account 
number, credit or debit card account number, in combination with any 
code that would permit access to the account. The California law 
includes an exception to the notification requirement when this 
personal information has been encrypted. The California law only 
requires notice to be provided when personal information is ``acquired 
by an unauthorized person.'' Other states recently have enacted or are 
considering security breach notification laws; however, the details of 
some of the laws differ.
    In March, the federal banking agencies issued final interagency 
guidance on response programs for unauthorized access to customer 
information and customer notice (``Guidance''). The Guidance applies to 
all financial institutions that are subject to banking agency GLBA 
501(b) Rules and requires every covered institution that experiences a 
breach of security involving sensitive customer information to: (1) 
notify the institution's primary federal regulator; (2) notify 
appropriate law enforcement authorities consistent with existing 
suspicious activity report rules; and (3) notify its affected customers 
where misuse of the information has occurred or is reasonably possible.
    The keen interest that states have shown to legislate on the issue 
of security breach notification emphasizes the need for a single 
national standard for security breach notification in order to avoid 
confusion among consumers as to the significance of notices that they 
receive and among holders of information about consumers as to their 
notification responsibilities. In addition, any legislation on security 
breach notification should recognize compliance with the Guidance as 
compliance with any notification requirements.
    Visa believes that a workable notification law that would require 
entities that maintain computerized sensitive personal information to 
notify individuals upon discovering a significant breach of security of 
that data should be risk-based to avoid inundating consumers with 
notices where no action by consumers is required. As FTC Chairwoman 
Majoras recently testified to Congress, notices should be sent only if 
there is a ``significant risk of harm,'' because notices sent when 
there is not a significant risk of harm actually can cause individuals 
to overlook those notices that really are important.
    Thank you, again, for the opportunity to present this testimony 
today. I would be happy to answer any questions.

    Mr. Stearns. I thank the gentleman. Mr. Burton, welcome.

                   STATEMENT OF DANIEL BURTON

    Mr. Burton. Thank you, Chairman Stearns, Ranking Member 
Schakowsky, distinguished members of the subcommittee. I 
appreciate your holding this hearing and giving me the 
opportunity to testify. My name is Daniel Burton. I am vice 
president of government affairs for Entrust, Inc.
    Entrust is a world leader in securing digital identities 
and information. As a security software company, we are in the 
business of protecting our customers, and by extension, your 
constituents, with proven technology solutions. Over 1,200 
enterprises and government agencies in more than 50 countries 
rely on Entrust software, including the U.S. Department of 
Treasury, the Department of Justice, and several nuclear 
laboratories. So we have a lot of experience in this field.
    I would first like to note with great appreciate this 
subcommittee's longstanding interest in online privacy. You 
have followed this issue closely for several years and built up 
considerable expertise. As a result, this committee is very 
well-positioned to play a leadership role in this debate.
    The privacy issues we are facing today are very different 
than they were a few years ago. Then, much of the debate 
revolved around limited opt-in and opt-out provisions. Today, 
with the rampant theft of confidential personal information, 
the Internet privacy debate is focused squarely on security.
    This shift in emphasis represents a sea of change for 
public policy. For years we have enjoyed the productivity 
improvements that network computing afforded and tolerated the 
nuisances that came with it. Today, these nuisances are 
overshadowed by a much more sinister problem, organized crime.
    Just like companies and governments, criminals have 
realized that the Internet is a powerful business tool. For 
criminals, gaining access to computerized credit card 
information, Social Security numbers, and other identifiers is 
a gateway to ready cash. Computer hackers no longer fit the 
profile of pimply faced teenagers who lose interest as soon as 
they get a girlfriend. Increasingly, they are skilled criminals 
who have a sophisticated business plan, mount wholesale 
attacks, move quickly around the world, and cover their tracks.
    Identify theft is not limited to data brokers. The breaches 
at ChoicePoint and Lexis-Nexis may have sparked public outrage, 
but the problem goes much deeper. Discount Shoe Warehouse, the 
San Jose Medical Group, George Mason University, SAIC, Time 
Warner, none of these are data brokers, yet all have suffered 
breaches of highly sensitive personal information.
    Focusing remedies exclusively on data brokers is like 
protecting your home from burglars by locking your doors but 
leaving your windows wide open. It may make you feel better, 
but it won't prevent a robbery. Similarly, passing a law that 
requires only data brokers to issue notifications when their 
systems are breached will do nothing to safeguard the reams of 
personal information that are held by other organizations.
    It is for this reason that the recent State breach 
notification laws cover anyone that owns or licenses 
computerized data that includes personal information. As you 
know, several States have already passed such bills, and many 
more are considering them. There is a very real possibility 
that by this summer we could see over a dozen competing State 
breach notification laws in effect.
    Given the reality of cyber crime, breaches, and State 
legislation, Congress needs to act. Entrust believes the 
Federal legislation could help and recommends the following 
measures for consideration: No. 1, establish a uniform national 
breach notification policy for unauthorized access to 
unencrypted personal information. If personal data is 
appropriately encrypted, notification should not be required. 
That is because even if the data is stolen, it will show up as 
random characters that won't make any sense to thieves unless 
they have the proper access codes. Since not all encryption is 
reliable, however, Congress should insist that it meets 
standards developed by the National Institute of Standards and 
Technology.
    No. 2, require second factor authentication for access to 
sensitive personal information. The FDIC said it best in its 
report ``Putting an End to Account-Hijacking Identify Theft.'' 
Its lead recommendation, upgrading existing password-based, 
single factor customer authentication systems to two factor 
authentication. Simple user name and passwords are too easily 
breached. They must be backed up with physical tokens 
containing secret access codes the legitimate users keep in 
their possession.
    No. 3, encourage enterprises that hold sensitive personal 
information to use technological and other means to assure 
compliance with their privacy policies. Since the majority of 
breaches come from insiders, organizations can significantly 
improve data security by deploying automated tools that screen 
email for privacy violations.
    The fourth recommendation is to extend security 
requirements similar to the Gramm-Leach-Bliley Act safeguards 
to all entities that retain sensitive personal information.
    In conclusion, this subcommittee has a vital role to play 
in the effort to security computerized personal information. 
Entrust is doing its best to help organizations implement 
strong technology safeguards and looks forward to working with 
you to see that they are complemented with effective public 
policy.
    [The prepared statement of Daniel Burton follows:]
   Prepared Statement of Daniel Burton, Vice President of Government 
                         Affairs, Entrust, Inc.
    Good Morning. Chairman Stearns and distinguished Members of the 
Subcommittee, thank you for holding this hearing and giving me the 
opportunity to provide testimony on this important subject. My name is 
Daniel Burton, and I am Vice President of Government Affairs for 
Entrust, Inc. In my testimony today, I will discuss the impact of 
security breaches and what we can do about them.
    Entrust is a world leader in securing digital identities and 
information. As a security software company, we are in the business of 
protecting our customers--and by extension your constituents--with 
proven technology solutions that secure digital information. Over 1,200 
enterprises and government agencies in more than 50 countries, 
including the US Department of Treasury, the Department of Justice and 
numerous nuclear laboratories, rely on Entrust software, so we have a 
lot of experience in this field. Entrust provides software solutions 
that protect your digital identity through authentication, enforce 
policy through advanced content scanning, and protect your information 
assets through encryption. Our mission is to work with customers to put 
in place the technologies, policies, and procedures necessary to 
protect digital identities and information.
    I would like to note with appreciation this committee's 
longstanding interest in on-line privacy. As a company that is on the 
front lines of the daily battle to protect sensitive information, 
Entrust applauds your activities and encourages your continued 
leadership in this area. You have followed this issue closely for 
several years and built up considerable expertise. As a result, you are 
well positioned to play a critical role in protecting the privacy of 
individuals, companies and governments.
    The privacy issues we are facing today are very different than they 
were a few years ago. Then, much of the debate revolved around limited 
``opt-in'' and ``opt-out'' provisions that determined what kind of 
consent was necessary to share personal information for marketing 
purposes. Today, with rampant theft of confidential personal 
information a reality, the Internet privacy debate is focused on 
squarely on security.
                            crime on the net
    This shift in emphasis--from nuisance to outright crime--represents 
a sea change for public policy. For years we have enjoyed the 
productivity improvements that networked computing afforded and learned 
to live with the nuisances that came with it. We may have been 
concerned about hacking for ``honor'' and other pranks, but like early 
version of spam, viruses and unsolicited marketing campaigns, we 
tolerated them as a small price to pay for the extraordinary dividends 
the Internet provided. Today, these nuisances are overshadowed by a 
much more sinister problem--organized crime.
    Just like companies and governments, criminals have come to realize 
that the Internet is a powerful business tool. As mountains of 
sensitive personal, corporate and government information have moved 
onto the net, crime has too. For criminals, gaining access to names, 
addresses, credit card information, social security numbers and other 
identifiers is a gateway to ready cash. As a result, computer hackers 
no longer fit the profile of pimply faced teenagers who lose interest 
as soon as they get a girlfriend. Increasingly, they are skilled 
criminals who have a sophisticated business plan, mount wholesale 
attacks, move quickly around the globe and cover their tracks. Our 
understanding of these crimes and the role of law enforcement is still 
evolving, but the stakes are high. If Internet crime causes American 
consumers to retreat from online transactions, U.S. business and 
government will suffer huge productivity reversals that could cripple 
not only e-commerce, but also the economy at large.
    The statistics are staggering. The Federal Trade Commission 
estimates that 9-10 million Americans are victims of identity theft per 
year. Total cost to business and consumers is approaching $50 billion. 
Almost 2 million US adult Internet users had their identities stolen in 
2004. Almost 12% of the fraud is online.
    As a result, the public temperature is rising. A January 2005 IDC 
Survey showed that close to 60% of US consumers are concerned about 
identity theft, and almost 6% have taken the remarkable step of 
switching banks as a result. A survey that Entrust conducted reaffirmed 
this concern. It found that 80% of individuals are worried about 
someone stealing their on-line identity and using it to access their 
on-line bank accounts.
    The underlying question of this hearing is whether we are doing 
enough to protect confidential information. The answer, unfortunately, 
is that as a nation we are not prepared to deal with the reality of 
cybercrime. The necessary legal framework to safeguard consumers and 
companies is still incomplete; enforcement efforts and resources are 
inadequate; and much of the private sector is still in denial.
             bigger than banks, hospitals and data brokers
    The identity theft crisis extends well beyond regulated industries 
like banking and healthcare that many people view as guardians of their 
sensitive information. It's even bigger than data brokers, despite all 
the attention they have received lately. The breaches at Bank of 
America, Choicepoint and Lexis-Nexis may have sparked public outrage 
about identity theft, but you only have to look at the kinds of 
organizations that have announced breaches in recent months to 
understand that the problem goes much deeper. Discount Shoe Warehouse, 
Paymaxx, the San Jose Medical Group, the University of California at 
Berkeley, George Mason University, SAIC, Time Warner--none of these are 
data brokers, yet they all suffered breaches of highly sensitive 
personal information. The scope of these breaches demonstrates that the 
universe of organizations holding sensitive personal information is 
quite large. Focusing remedies exclusively on data brokers is like 
protecting your home from burglars by locking the front door and 
leaving all the windows wide open. It may make you feel better, but it 
won't do much to prevent a robbery. Similarly, passing a law that 
requires only data brokers to issue notifications when their systems 
are breached will do nothing to safeguard the mountains of personal 
information that are held by other organizations. True success lies in 
a much broader approach.
    It is for this reason that the recent state breach notification 
laws we see around the country are not limited to banks, healthcare 
providers and data brokers. It may interest you to know that many of 
the most proactive states in this arena are represented by members of 
this Committee. For example, California was the first state to pass 
such a bill (H.B. 1386). It took effect on July 1, 2003 and requires a 
state agency, person or business that conducts business in California, 
and that owns or licenses computerized data that includes personal 
information to disclose breaches of unencrypted personal information to 
California residents. Arkansas has also passed a disclosure law (Senate 
Bill 1167) that covers ``individuals, businesses and state agencies 
that acquire, own or license personal information about the citizens of 
the State of Arkansas . . .'' Florida has a bill (H.B. 481) awaiting 
the Governor's signature that covers ``Any person who conducts business 
in this state and maintains computerized data in a system that includes 
personal information . . .'' In all, over twenty states have introduced 
such legislation, and there is a possibility that we could have over a 
dozen competing and conflicting state breach notification laws in 
effect by this summer.
    Given this backdrop of crime, systematic breaches and proliferating 
state legislation, Congress needs to act.
                      technology and public policy
    In trying to determine what role Congress should play, it is 
important to understand some of the key technologies underlying 
information security. I will focus on two: confidentiality and 
authentication. Confidentiality means assuring that information is not 
disclosed to unauthorized persons. E oding or scrambling of information 
so that it can only be decoded and read by someone with the correct 
decoding key--is the technology often associated with confidentiality. 
Encryption comes in different strengths. Many of the state breach 
notification bills make specific reference to it.
    Data in transit, such as e-mail, presents different encryption 
challenges than stored data. And since stored data is held in a variety 
of repositories, from mainframes to laptops, and in different ways, 
such as data bases and directories, it presents unique encryption 
challenges of its own. Software applications and data bases are 
typically built for speed, not security, so the issue is not just 
whether to encrypt them, but how and where to apply it. Not all data 
must be encrypted, but there is an increasing demand to encrypt 
sensitive personal data, even if it affects performance.
    Authentication means corroborating that a user is who they claim to 
be. It is often linked closely with authorization, which means that you 
have the right to access the information in question. Authentication 
technologies include user name and password (referred to as first 
factor since they relate to something you know) and physical tokens 
with secret codes (referred to as second factor since they are 
something you have). An even stronger form of authentication technology 
is the digital certificate, which is an electronic identifier that 
establishes your credentials. Digital certificates are issued by a 
certification authority. They contain your name, a serial number, 
expiration dates, a copy of the certificate holder's public key (used 
for encrypting messages and digital signatures), and the digital 
signature of the certificate-issuing authority so that a recipient can 
verify that the certificate is real. Using public key cryptography and 
digital certificates, the sender can assure that only the intended 
recipient can--open the message, and the recipient knows that only the 
authorized sender could have sent the message.
    Much of the public policy debate about identity theft has focused 
on the need to authenticate consumer identities. Just as important, 
however, is the need to authenticate employer and supplier identities 
at both ends of a transaction. Since many breaches are internal, proper 
authentication of the employees, customers and partners who have 
privileged access to information is critical to preventing identity 
theft.
             the need for additional legislative safeguards
    There has been a lot of discussion about whether existing law is 
sufficient to prevent identity theft. Although industry at large has 
traditionally opposed federal legislation in this area, rampant 
identity theft, the proliferation of security breaches, and the passage 
of state breach notification laws have caused many companies to change 
their view. Entrust believes that additional Federal legislation could 
assist holders of sensitive personal information in their efforts to 
prevent consumer fraud and identity theft. Specifically, we believe 
that the following measures deserve consideration.
1. Establish a uniform national breach notification policy for 
        unauthorized access to unencrypted personal information.
    Breach notification laws are necessary to inform consumers when 
their sensitive personal information has been compromised so that they 
can guard themselves against identity crimes. As mentioned above, 
several states have passed breach notification laws and many more have 
introduced this legislation. A uniform national notification standard 
is needed to preempt conflicting state laws and establish consistent 
requirements. In weighing such a provision, Congress should keep in 
mind two important criteria that are enshrined in state law.
    First, the notification requirement should apply to all entities 
that hold sensitive personal information. Confidential information is 
held by a wide variety of institutions, including employers, retailers, 
lawyers and government agencies. If the Federal notification 
requirement is limited to data brokers and regulated industries like 
banking and health-care, none of these other organizations will be 
covered. If this were the case, organizations like SAIC, Time Warner, 
George Mason University and Discount Shoe Warehouse--all of whom have 
suffered breaches and sent out notifications in recent months--would 
not be required by Federal law to notify those people whose identities 
had been compromised.
    Second, and just as important, if the personal information is 
appropriately encrypted, notification should not be required. The 
reason for this provision is that unauthorized access to encrypted data 
reveals only scrambled code that is meaningless. For example, if the 
personal information of the 600,000 current and former employees of 
Time Warner had been encrypted on the tapes that were lost, there would 
have been very little risk of identity theft because the information 
would have been unintelligible to anyone without the proper access.
    There are several different kinds of encryption, however, not all 
of which are reliable. To insure that the encryption is adequate, 
Congress should insist on the encryption standards developed by the 
National Institute of Standards and Technology. Organizations that 
suffer breaches should not have to issue notifications if their data, 
whether in storage or in transit, is encrypted with a NIST approved 
encryption algorithm, uses NIST approved key management techniques and 
has cryptographic operations performed within a FIPS 140 validated 
cryptographic module.
2. Require second factor authentication for access to sensitive 
        personal information.
    The Federal Deposit Insurance Corporation (FDIC) issued a thorough 
study of identity theft in its December 2004 report, Putting an End to 
Account-Hijacking Identity Theft. The FDIC's lead recommendation is 
``Upgrading existing password-based single-factor customer 
authentication systems to two-factor authentication.'' Industry 
analysts have confirmed this view. Jonathan Penn, an analyst at 
Forrester, has written that ``In response to consumers' rising concerns 
about fraud and identity theft, many organizations are evaluating 
strong authentication solutions . . .'' And John Pescatore, an analyst 
with Gartner, has written ``When you get to the core issue of most 
identity theft attacks, it really falls back to needing stronger 
authentication . . .''
    The problem with two-factor authentication is that, until recently, 
it was difficult to administer and prohibitively expensive to implement 
on a large scale. Fortunately, new technology breakthroughs by Entrust 
and others have substantially reduced the cost and complexity 
associated with two factor authentication. These breakthroughs should 
facilitate the broader use of this technology to organizations that 
must safeguard large quantities of digital identities.
3. Encourage enterprises that hold sensitive personal information to 
        use technological and other means to assure compliance with 
        their privacy policies.
    Since the majority of breaches come from insiders, one way to limit 
them is for organizations to screen communications for privacy 
violations. The FDIC has already highlighted this imperative in its 
safeguards guidance to financial institutions, recommending that they 
establish controls to prevent employees from providing customer 
information to unauthorized individuals. Since banks are not the only 
ones holding sensitive personal information, these controls should be 
extended to non-financial institutions as well.
    Because the majority of electronic data is at some point associated 
with e-mail, controls that assure outgoing e-mail communications and 
attachments comply with privacy policies can help reduce identity 
theft. To the extent that organizations monitor e-mail traffic at all, 
however, many rely on a manual review of only a small sample of e-mail 
traffic. Fortunately, technology now exists that has automated 
compliance controls capable of blocking, archiving, redirecting or 
securing e-mail communications in real-time. Enterprises that are in 
the business of holding sensitive personal information should be 
encouraged to consider adopting it.
4. Extend security requirements similar to the Gramm-Leach-Bliley Act 
        safeguards for financial institutions to all entities that 
        retain sensitive personal information.
    This Subcommittee should consider extending the risk management, 
reporting and accountability requirements documented in FDIC and FTC 
safeguards guidance to all enterprises that hold sensitive personal 
information. Title V of the Gramm-Leach-Bliley Act (GLBA) states that 
financial institutions must establish safeguards for customer records 
and information. In her testimony before this Subcommittee on March 15, 
2005, the Chair of the Federal Trade Commission, Deborah Majoras, noted 
that to the extent that data brokers fall within the GLBA definition of 
financial institutions they must abide by these safeguards. As 
discussed earlier, however, limiting the extension of the GLBA 
safeguards only to data brokers would overlook the vast numbers of 
other organizations that hold sensitive personal information and do 
little to stem the tide of identity theft.
    Since any discussion of security safeguards raises questions about 
technology mandates, it is important to emphasize that the regulatory 
guidance for implementing the GLBA safeguards addresses such issues as 
the need to develop a written security plan, to designate appropriate 
personnel to oversee it, and to conduct a risk assessment. None of 
these is a technology requirement. Instead, they relate to sound 
management practices. The National Cyber Security Summit Task Force on 
Information Security Governance that Entrust CEO Bill Conner co-chaired 
took a similar approach. In its April 2004 report, Information Security 
Governance: A Call to Action, it concluded that ``The best way to 
strengthen US information security is to treat it as a corporate 
governance issue that requires the attention of Boards and CEOs.'' It 
recommended that CEOs have an annual information security evaluation 
conducted, review the evaluation results with staff, and report on 
performance to their board of directors. In addition, it emphasized the 
need for organizations to establish a security management structure to 
assign explicit individual roles, responsibility, authority and 
accountability.
                               conclusion
    This Subcommittee has an important role to play in the effort to 
secure personal data. The goal is clear. We should do everything we can 
to encourage holders of sensitive information to secure it from 
unauthorized access and, in the event of a breach, to notify 
individuals so that they can protect themselves. The reality of rampant 
identity theft is proof that we have no time to waste. The fact that 
sensitive personal information is held by a wide variety of 
organizations demonstrates that a narrow solution will be insufficient.
    Information security is not only a technical issue, but also a 
governance challenge. Technology solutions, like encryption, strong 
authentication and automated e-mail compliance with privacy policies, 
can do a lot to prevent unauthorized access to personal information. 
But they must be grounded in the risk management, reporting and 
accountability that can only be implemented with the active engagement 
of executive management.

    Mr. Stearns. I thank the gentleman. We are on a vote, but I 
think we--Mr. Solove, I think we can get your opening 
statement, and then we will recess and come right back. So go 
ahead. Welcome.

                  STATEMENT OF DANIEL J. SOLOVE

    Mr. Solove. Mr. Chairman, Congresswoman Schakowsky, members 
of the committee, thank you for inviting me to appear before 
you and provide testimony. My name is Daniel Solove, and I am 
an associate professor of law at George Washington University 
Law School. I have published over a dozen articles as well as 
two books about information privacy. My most recent book, ``The 
Digital Person,'' discusses the issues at this hearing in 
depth. It was published in December 2004.
    The litany of data leaks and improper access to personal 
data are the symptoms of a significant problem that Congress 
must address. It is important to understand the nature of the 
problem, and I think this extends beyond just a security issue.
    We are increasingly living with digital dossiers about our 
lives. These repositories of personal data can affect whether 
we get a loan, a license, or a job. The central problem that we 
face today, the central problem is that it is caused by a lack 
of individual participation and empowerment when it comes to 
the collection and use of personal data and a lack of 
accountability among the companies that handle that data.
    Today, people lack much participation in how their data is 
used and disseminated. Identify theft is difficult for victims 
to detect because they have little knowledge about the 
information being circulated about them. Therefore, solutions 
to the problem must provide individuals with greater knowledge 
and control about how their data is used. People must be 
provided meaningful remedies when their data is leaked and 
misused. Without meaningful remedies, mere notice of a leak is 
akin to a company saying we just had a toxic spill in your 
backyard. It might cause you harm, so you might want to have 
periodic medical checkups.
    Because people have so little participation and power over 
their information, it is very hard for them to clean up their 
records in the event of an identity theft. Congress should 
ensure that victims of identity theft have appropriate tools to 
repair the damage quickly.
    The harm to victims in an identity theft is facilitated by 
Social Security numbers, birth dates, and other pieces of 
personal data being used by companies as passwords to obtain 
access to accounts or to sign up for a credit card. If the 
practice of using Social Security numbers as passwords were 
halted, the leakage of Social Security numbers would not be so 
dangerous and damaging to individuals.
    The Gramm-Leach-Bliley Act requires security safeguards for 
personal data maintained by financial institutions. Despite 
these safeguards, many financial institutions continue to use 
Social Security numbers as passwords. Why doesn't the FTC 
enforce these security standards to halt this practice? Well, I 
can postulate a number of reasons, and I think one of the 
primary reasons is that these security standards are incredibly 
vague and they haven't provided adequate guidance. I think to 
be effective in crafting security standards, they must apply 
widely and they must be specific without being overly 
constraining.
    Beyond identity theft, people lack the ability to easily 
locate and fix errors in their records that may cause them 
harm. People's dossiers are often riddled with inaccuracies. 
The Fair Credit Reporting Act requires consumer reporting 
agencies to maintain procedures to ensure maximum possible 
accuracy. However, many data brokers have data bases they claim 
fall outside of the Fair Credit Reporting Act. And little is 
done more systemically to ensure the accuracy of records 
systems used for background checks and other decisions about 
people's lives.
    I believe that the security breaches that we are facing 
today are part of a larger problem, one involving information 
privacy. Information today is protected in a piecemeal fashion 
based on who holds it. The same piece of data might be 
protected if it is held by a video rental store but completely 
unprotected in the hands of data brokers like ChoicePoint.
    The current regulation of information has tremendous gaps 
and loopholes. We have a system that does not provide adequate 
accountability among the users of personal information. We have 
a system that, to a large extent, leaves people out in the cold 
who are victimized by identity theft or harmed by an erroneous 
report.
    Congress must put individuals back in control of their data 
and ensure that companies are accountable for the way that they 
handle and use that data. Thank you very much.
    [The prepared statement of Daniel J. Solove follows:]
  Prepared Statement of Daniel J. Solove, Associate Professor of Law, 
                George Washington University Law School
                            i. introduction
    Mr. Chairman, members of the Committee, thank you for inviting me 
to appear before you and provide testimony. My name is Daniel Solove 
and I am an associate professor of law at the George Washington 
University Law School. I write extensively about information privacy 
law issues and have published well over a dozen law review articles as 
well as two books, The Digital Person: Technology and Privacy in the 
Information Age (NYU Press December 2004) and Information Privacy Law 
(Aspen 2003) (with Marc Rotenberg).
    The announcement of recent data breaches at a variety of companies 
and institutions have affected millions of people. As one article 
notes:
          In breaches reported publicly since February, more than 2.5 
        million records may have been exposed to thieves at data broker 
        ChoicePoint, retailer DSW, news and information broker 
        LexisNexis, the University of California at Berkeley and 
        elsewhere.1
---------------------------------------------------------------------------
    \1\ Jon Swartz, Time Warner's Personal Data on 600,000 Missing, USA 
Today (May 3, 2005).
---------------------------------------------------------------------------
    I will not discuss the series of data breaches that have lead to 
this hearing, as I am sure that you are all familiar with them. 
Instead, I will focus my comments on what can be done to address the 
problems and how we can better protect information privacy. My remarks 
will focus on two points.
    First, I will explain why the problem is larger than just a 
security problem. Security is one dimension of a larger set of issues 
involving information privacy. Beyond securing data, the law must 
ensure that when there is a leak or improper access, the harmful 
effects are minimized. Doing this requires empowering individuals with 
tools to better manage their data. Moreover, making companies more 
accountable for their activities will promote better security, as well 
as better accuracy, in record systems.
    Second, I will discuss why the innovative role of the states should 
be preserved. Federal legislation must allow room for states to 
experiment with new approaches and solutions to the problem. Many 
current federal protections, as well as many of the ideas currently 
proposed to address the problem, are drawn from state laws.
    There are many more specific measures that can be taken to address 
the problems we are encountering today. Chris Hoofnagle of the 
Electronic Privacy Information Center and I have written a short essay 
called A Model Regime of Privacy Protection, where we set forward 
succinctly a series of sixteen legislative proposals. We explain why 
these proposals are necessary and respond directly to the criticisms of 
our proposals by a wide array of individuals (some from the industries 
we propose regulating). The paper is currently available for free at: 
Daniel J. Solove & Christopher Hoofnagle, A Model Regime of Privacy 
Protection http://papers.ssrn.com/sol3/papers.cfm?abstract_id=699701
    I will avoid repeating the content of this paper, but I recommend 
that you read it as it may be helpful in crafting specific legislative 
solutions.
           ii. beyond security: a problem of many dimensions
    The litany of data leaks and improper access to personal data are 
the symptoms of a significant problem that Congress should address. It 
is important to understand the nature of the problem, as it extends far 
beyond just a security issue. In my recent book, The Digital Person: 
Technology and Privacy in the Information Age (NYU Press, December 
2004), I observed that the central problem we face is caused by a lack 
of individual participation and empowerment when it comes to the 
collection and use of personal information as well as a lack of 
accountability among the companies that handle the data. In my book, I 
argued:
          We are increasingly living with digital dossiers about our 
        lives, and these dossiers are not controlled by us but by 
        various entities, such as private-sector companies and the 
        government. These dossiers play a profound role in our 
        existence in modern society.2
---------------------------------------------------------------------------
    \2\ Daniel J. Solove, The Digital Person; Technology and Privacy in 
the Information Age 115 (2004).
---------------------------------------------------------------------------
    These repositories of personal information are used in ways that 
affect key aspects of our lives: whether we get a loan, a license, or a 
job. However, despite these high stakes:
          At present, the collectors and users of our data are often 
        not accountable to us. A company can collect a person's data 
        without ever contacting that person, without that person ever 
        finding out about it. The relationship is akin to the 
        relationship between strangers--with one very important 
        difference: One of the strangers knows a lot about the other 
        and often has the power to use this information to affect the 
        other's life.3
---------------------------------------------------------------------------
    \3\ Id. at 102.
---------------------------------------------------------------------------
    The problem is not that companies dealing with personal information 
are a bunch of evil-doers bent on harming people. The collection and 
use of personal information can have many benefits, and the goal of an 
effective protection of privacy is not to stop information flow, but to 
empower individuals with greater control over their data and to make 
companies more accountable for their uses of personal data.
A. Individual Participation
    People lack much participation in how their data is used or 
disseminated. Personal data is readily collected and disseminated 
without people's knowledge and consent, thus increasing people's 
vulnerability to identity theft, stalking, and other crimes.
    Identity theft is rising at an staggering rate. In an identity 
theft, the thief uses a victim's personal information to improperly 
access accounts, obtain credit in the victim's name, or impersonate the 
victim for other purposes. In 2003, the FTC estimated that ``almost 10 
million Americans have discovered that they were the victim of some 
form of ID Theft within the past year.'' 4
---------------------------------------------------------------------------
    \4\ Federal Trade Commission, Identity Theft Survey Report 4, 6 
(Sept. 2003). For an excellent account of the rise of identity theft, 
see Bob Sullivan, Your Evil Twin: Behind the Identity Theft Epidemic 
(2004).
---------------------------------------------------------------------------
    The law has attempted to deal with identity theft by enhancing 
criminal penalties, but this alone has been a dismal failure. The 
problem is that identity thieves are hard to catch. Gartner, Inc. 
estimates that only 1 in 700 thieves is successfully 
prosecuted.5 A report by the U.S. General Accounting Office 
describes in great detail the difficulties with criminal investigation 
and prosecution of identity theft cases.6
---------------------------------------------------------------------------
    \5\ Stephen Mihm, Dumpster Diving for Your Identity, N.Y. Times 
Magazine, Dec. 21, 2003.
    \6\ U.S. General Accounting Office, Report to the Honorable Sam 
Johnson, House of Representatives, Identity Theft: Greater Awareness 
and Use of Existing Data Are Needed 17-18 (June 2002).
---------------------------------------------------------------------------
    In contrast, I noted in my book that:
          The identity thief's ability to so easily access and use our 
        personal data stems from an architecture that does not provide 
        adequate security to our personal information and that does not 
        afford us with a sufficient degree of participation in its 
        collection, dissemination, and use. Consequently, it is 
        difficult for the victim to figure out what is going on and how 
        to remedy the situation.7
---------------------------------------------------------------------------
    \7\ Daniel J. Solove, The Digital Person; Technology and Privacy in 
the Information Age 115 (2004).
---------------------------------------------------------------------------
    The problem is that the law does not afford people sufficient 
participation in the way that their information is managed. Identity 
theft is difficult for victims to detect because they have little 
knowledge about the information being circulated about them or how that 
data is being used. The victim's lack of awareness is exploited by the 
identity thief, who can go on a spree of fraud in the victim's name 
without the victim finding out about it. Therefore, solutions to the 
problem must provide individuals with greater knowledge and control 
about how their data is used.
B. Remedies for Harmed Individuals
    People must be provided meaningful remedies when their data is 
leaked or misused. Without meaningful remedies, mere notice of a leak 
would be akin to a company saying: ``We just had a toxic spill in your 
backyard. It might cause you harm, and so you might want to have 
periodic medical checkups.'' The letter from ChoicePoint to the victims 
of its data breach began:
          I'm writing to inform you of a recent crime committed against 
        ChoicePoint that MAY have resulted in your name, address, and 
        Social Security number being viewed by businesses that are not 
        allowed to access such information. We have reason to believe 
        that your personal information may have been obtained by 
        unauthorized third parties, and we deeply regret any 
        inconvenience this event may cause you.8
---------------------------------------------------------------------------
    \8\ Letter from ChoicePoint to Californians Regarding the Data 
Breach (Feb. 9, 2005).
---------------------------------------------------------------------------
    The letter recommended that people review their credit reports, and 
continue to check them for unusual activity. In other words, ``we've 
had a spill, now you go and protect yourself.''
    Certainly, requiring disclosure of security leaks is a good first 
step, but merely sending people a scary letter without providing them 
with sufficient rights and abilities to address the problems will not 
suffice.
    Identity theft, according to estimates, results in victims spending 
on average 200 hours and thousands of dollars fixing the 
damage.9 Becoming victimized by identity theft is akin to 
contracting a chronic protracted disease. Because people have so little 
participation and power over their information, it is very hard for 
them to cure themselves and clean up their records. Identity theft can 
be financially and emotionally crippling, and the law does little to 
help people who have been victimized. States, such as California, have 
adopted some effective measures to assist victims in dealing with 
identity theft.10 I believe that Congress should look to 
California's measures as it crafts a federal law addressing these 
issues.
---------------------------------------------------------------------------
    \9\ Janine Benner, Beth Givens, & Ed Mierzwinski, Nowhere To Turn: 
Victims Speak Out on Identity Theft: A CALPRIG/Privacy Rights 
Clearinghouse Report (May 2000), at http://privacyrights.org/ar/
idtheft2000.htm.
    \10\ The California Office of Privacy Protection maintains a 
comprehensive summary of California's privacy statutes: http://
www.privacy.ca.gov/lawenforcement/laws.htm.
---------------------------------------------------------------------------
C. Deactivating Dangerous Data
    The data leaks that have occurred recently are made more harmful 
because of another type of security issue. SSNs, birth dates, and other 
pieces of personal data are used by other companies as passwords to 
obtain access to accounts or to sign up for a credit card. It would 
take great imagination to design a poorer security mechanism than the 
use of SSNs. This is akin to using a password that anyone can readily 
obtain in an instant. Companies routinely sell people's SSNs, as it is 
not illegal to do so. SSNs are also available in many public 
records.11 This ``password'' can then unlock virtually any 
account or be used to sign up for credit cards. And it is very 
difficult to change it. As I argued in my book ``the SSN functions as a 
magic key that can unlock vast stores of records as well as financial 
accounts, making it the identity thief's best tool. . . . [T]he 
government has created an identification number without affording 
adequate precautions against its misuse.'' 12
---------------------------------------------------------------------------
    \11\ Solove, Digital Person, supra, at 115-17.
    \12\ Solove, Digital Person, supra, at 116.
---------------------------------------------------------------------------
    If the practice of using SSNs as passwords were halted, the leakage 
of SSNs would not be as dangerous and damaging to individuals. In our 
paper, A Model Regime of Privacy Protection, Chris Hoofnagle and I 
propose:
          Companies shall develop methods of identification which (1) 
        are not based on publicly available personal information or 
        data that can readily be purchased from a data broker; and (2) 
        can be easily changed if they fall into the wrong hands. 
        Whereas Social Security Numbers cannot be changed without 
        significant hassle, and dates of birth and mother's maiden 
        names cannot be changed, identifiers such as passwords can be 
        changed with ease. Furthermore, they are not universal, and 
        thus a thief with a password cannot access all of a victim's 
        accounts--only those with that password. Biometric identifiers 
        present problems because they are impossible to change, and if 
        they fall into the wrong hands could prove devastating for 
        victims as well as present ongoing risks to national security. 
        Therefore, passwords are a cheap and effective way to limit 
        much identity theft and minimize the problems victims face in 
        clearing up the damage caused by identity theft.13
---------------------------------------------------------------------------
    \13\ Daniel J. Solove & Christopher Hoofnagle, A Model Regime of 
Privacy Protection, at http://papers.ssrn.com/sol3/
papers.cfm?abstract_id=699701
---------------------------------------------------------------------------
    If businesses and other private sector organization were restricted 
from using SSNs as passwords, improper access to people's SSNs would 
not put people in such peril of identity theft and fraud.
    The Gramm-Leach-Bliley (GLB) Act of 1999 requires agencies that 
regulate financial institutions to promulgate ``administrative, 
technical, and physical safeguards for personal information.'' 
14 Despite the fact that FTC regulations under the Gramm-
Leach-Bliley Act establish security standards for financial 
institutions to ``[p]rotect against unauthorized access to or use of 
such information that could result in substantial harm or inconvenience 
to any customer,'' 15 many financial institutions continue 
to allow easy access to records by using SSNs as passwords. In an 
article entitled, Identity Theft, Privacy, and the Architecture of 
Vulnerability,16 I argued:
---------------------------------------------------------------------------
    \14\ 15 U.S.C.  6801(b) (requiring agencies to promulgate 
``administrative, technical, and physical safeguards for personal 
information.'').
    \15\ 16 C.F.R.  314.3(b) (2002).
    \16\ Daniel J. Solove, Identity Theft, Privacy, and the 
Architecture of Vulnerability, 54 Hastings L.J. 1227 (2003).
---------------------------------------------------------------------------
          The GLB Act requires a number of agencies that regulate 
        financial institutions to promulgate ``administrative, 
        technical, and physical safeguards for personal information.'' 
        On February 1, 2001, several agencies including the Office of 
        the Comptroller of the Currency, the Board of Governors of the 
        Federal Reserve System, the Federal Deposit Insurance 
        Corporation, and the Office of Thrift Supervision issued 
        standards for safeguarding customer information. On May 23, 
        2002, the FTC issued similar security standards. Pursuant to 
        the FTC regulations, financial institutions ``shall develop, 
        implement, and maintain a comprehensive information security 
        program'' that is appropriate to the ``size and complexity'' of 
        the institution, the ``nature and scope'' of the institution's 
        activities, and the ``sensitivity of any customer information 
        at issue.'' An information security program consists of ``the 
        administrative, technical, or physical safeguards 
        [institutions] use to access, collect, distribute, process, 
        store, use, transmit, dispose of, or otherwise handle customer 
        information.'' The regulations set forth three objectives that 
        a security program should achieve:
      (1) Insure the security and confidentiality of customer 
            information;
      (2) Protect against any anticipated threats or hazards to the 
            security or integrity of such information; and
      (3) Protect against unauthorized access to or use of such 
            information that could result in substantial harm or 
            inconvenience to any customer.
          The GLB Act is on the right track in its focus on information 
        security . . . However, the regulations under the GLB Act 
        remain rather vague as to the specific level of security that 
        is required or what types of measures should be taken. The 
        regulations require institutions to designate personnel to 
        ``coordinate'' the information security program; and to 
        ``[i]dentify reasonably foreseeable internal and external risks 
        to the security, confidentiality, and integrity of customer 
        information.'' These regulations establish rather broad obvious 
        guidelines; they virtually ignore specifics. Of course, a rule 
        that is too detailed in the standards it required could end up 
        being ineffective as well . . . [S]uch regulations, if too 
        specific, can quickly become obsolete, discourage innovation, 
        and be costly and inefficient. However, rules that are too 
        open-ended and vague can end up being toothless. Although 
        security standards must not be overly specific, they must 
        contain meaningful minimum requirements.
          Ultimately, the strength of the GLB Act's security 
        protections will depend upon how they are enforced. . . .
          Despite these new security provisions, companies continue to 
        maintain lax security procedures for the access of financial 
        accounts and other personal data. Thus far, the FTC's efforts 
        have been somewhat anemic. With vigorous enforcement, security 
        practices can change. But it remains uncertain whether the FTC 
        and other agencies will undertake such a vigorous enforcement 
        effort.17
---------------------------------------------------------------------------
    \17\ Id. at 45-46. The article is available online at: http://
papers.ssrn.com/sol3/papers.cfm?abstract_id=416740
---------------------------------------------------------------------------
    The FTC has not used the GLB Act to crack down on security, as the 
spate of security breaches in the news these days have occurred in 
spite of these regulations. The FTC could have concluded, for example, 
that the use of SSNs as passwords by so many financial institutions was 
an insufficient security procedure under the GLB standards. But it did 
not. Why hasn't the FTC vigorously enforced these security standards?
    I can postulate two reasons. First, the security standards only 
apply to financial institutions rather than all the entities that 
process significant amounts of personal data. Second, they are rather 
vague, and as a result, they have not provided adequate guidance. To be 
effective, security standards must apply widely, not in a piecemeal 
fashion, and they must be more specific in nature (without being overly 
constraining).
D. Accuracy
    Beyond identity theft, people lack the ability to easily locate and 
fix errors in their records that can cause them harm. Decisions are 
being made based on people's dossiers which are often riddled with 
inaccuracies. Although a recent Wall St. Journal article noted that 
ChoicePoint says that only .0008% of its 7.3 million background checks 
in 2004 had incorrect data, the authors had no difficulty finding a 
number of instances of people harmed by errors in ChoicePoint 
databases.18 In one study, 90% of ChoicePoint's reports 
obtained had at least one error.19 And there are numerous 
anecdotal stories reported in the media of significant errors in 
people's reports.20
---------------------------------------------------------------------------
    \18\ Evan Perez & Rick Brooks, File Sharing: For Big Vendor of 
Personal Data, A Theft Lays Bare the Downside, Wall St. J., May 3, 
2005, at A1.
    \19\ After the Breach: How Secure and Accurate is Consumer 
Information Held by ChoicePoint and Other Data Aggregators?, Before the 
California Senate Banking Committee, Mar. 30, 2005 (testimony of Pam 
Dixon, Executive Director, World Privacy Forum).
    \20\ Id. (testimony of Elizabeth Rosen, Registered Nurse) (noting 
that the report wrongly reported that she owned a deli store); Bob 
Sullivan, ChoicePoint Files Found Riddled With Errors, MSNBC, Mar 8, 
2005, available at http://www.msnbc.msn.com/id/7118767/ (noting that 
Deborah Pierce's ChoicePoint report wrongly indicated a ``possible 
Texas criminal history'').
---------------------------------------------------------------------------
    The issue of accuracy demonstrates a central problem--the companies 
maintaining personal data are often not accountable to the people to 
whom the data pertains. Because of this lack of accountability, there 
are insufficient incentives for data brokers to maintain their records 
accurately. The Fair Credit Reporting Act (FCRA) requires consumer 
reporting agencies to maintain procedures to ensure ``maximum possible 
accuracy.'' 21 However, many data brokers have databases 
that they claim fall outside of FCRA. And they gather data from various 
public record systems, which themselves might have errors. An error can 
infect various databases because of the fluidity by which personal 
information is transferred. Moreover, because people are so out of the 
loop when it comes to the way their data is collected and used, they 
might not even discover the error. Little is done more systemically to 
ensure the accuracy of record systems used for background checks and 
other decisions about people's lives.
---------------------------------------------------------------------------
    \21\ 15 U.S.C.  1681e(b).
---------------------------------------------------------------------------
E. Closing the Gaps
    The security breaches we are facing today are part of a larger 
problem, one involving information privacy. This is not a problem that 
can be solved with what I call the ``little more care and little more 
notice'' approach. Certainly setting minimum security standards and 
providing notice to consumers of security breaches are two important 
steps. But the larger problem is one of information privacy. In some 
contexts, personal information is widely collected, used, and 
disseminated without much control or limitation. Information today is 
protected in a piecemeal fashion based on who holds it. The same piece 
of data might be protected if held by a video rental store but 
completely unprotected in the hands of data brokers such as ChoicePoint 
or LexisNexis.22 The current state of regulation of 
information is very porous, with tremendous gaps and loopholes. The 
result is that we have, in many respects, lost control over the way 
personal information is collected, managed, and used. We have a system 
that does not promote accountability among the users of personal 
information. We have a system that to a large extent leaves people out 
in the cold if victimized by identity theft or if harmed by an 
erroneous report. We have a system that thrusts on consumers the 
tremendous responsibility of guarding their digital dossiers, a 
difficult task when so many companies maintain data about them and when 
people have little knowledge that this is going on. Congress must put 
individuals back in control of their data and ensure that companies are 
accountable for the way they handle and use that data.
---------------------------------------------------------------------------
    \22\ Video Privacy Protection Act of 1998, Pub. L. No. 100-618, 18 
U.S.C. 2710-11.
---------------------------------------------------------------------------
                    iii. the problem with preemption
    In any solution that Congress takes, the innovative role of the 
states must be preserved. Thus, Congress should avoid preempting state 
laws when crafting federal legislation.
    Many of the ideas for reforming the information system in this 
country emerge from state laws. Justice Brandeis said it well: ``It is 
one of the happy incidents of the federal system that a single 
courageous State may, if its citizens choose, serve as a laboratory; 
and try novel social and economic experiments without risk to the rest 
of the country.'' 23 This is especially important in such a 
rapidly changing field such as information privacy. Not all approaches 
work, and we need a way to test innovative solutions. Indeed, the law 
that required ChoicePoint to disclose its security breach was a 
California law. What if there were federal preemption and such a law 
never existed? Would we ever have found about the security breach?
---------------------------------------------------------------------------
    \23\ New State Ice Co. v. Liebmann, 285 U.S. 262, 311 (1932) 
(Brandeis, J., dissenting).
---------------------------------------------------------------------------
    Federal legislation that preempts state law will not only shut down 
the real engines of innovation in the field, but it will have very 
detrimental long-term effects on federal legislation as well. The grist 
for federal legislation in privacy is often state regulatory ideas that 
have worked. The majority of privacy legislation has been enacted at 
the state level.24 Many of the federal laws addressing 
privacy have adopted measures tried-and-tested in the states. The 
states first tried out the idea of telemarketing do-not-call lists. 
Many of the reforms in the 2003 federal Fair and Accurate Credit 
Transactions Act were based on prior state laws.25 If 
Congress were to shut down this tremendous source of ideas, federal 
legislation will lose one of its primary developmental tools. Federal 
legislation in the future would suffer severely as a result.
---------------------------------------------------------------------------
    \24\ Robert Ellis Smith, Compilation of State and Federal Privacy 
Laws (Privacy Journal 2002).
    \25\ Edmund Mierzwinski, Preemption of State Consumer Laws: Federal 
Interference Is A Market Failure, Government, Law and Policy Journal of 
the New York State Bar Association, Spring 2004 (Vol. 6, No. 1, pgs. 6-
12).
---------------------------------------------------------------------------
    I have often heard companies say that it is too onerous complying 
with so many differing laws in all 50 states. Yet if the federal 
legislation sets a strong floor of protection, there will be little 
incentive for the states to do more. In other words, if the federal 
legislation solves the problems, then there will not be a need for the 
states to act. Additionally, historically, stronger protections have 
only been enacted by a handful of states, not all 50. So the reality is 
not 50 different standards, but a floor of protection for 90% of the 
states with the remaining 10% adopting a slightly more protective 
standards. Moreover, other industries have long dealt with differing 
state protections, such as the auto industry and the insurance 
industry. Why are the burdens on data brokers any greater? What strikes 
me as most remarkable is that companies that manage billions of records 
of data and claim to be able to do so with remarkable depth, precision, 
and detail say that they cannot comply with a handful of states that 
have stronger protections.
    Most federal privacy laws have not preempted stronger state 
protections: the Electronic Communications Privacy Act, the Right to 
Financial Privacy Act, the Cable Communications Privacy Act, the Video 
Privacy Protection Act, the Employee Polygraph Protection Act, the 
Telephone Consumer Protection Act, the Driver's Privacy Protection Act, 
and the Gramm-Leach-Bliley Act.26 In all these instances, 
companies have been able to comply with state laws.
---------------------------------------------------------------------------
    \26\ Respectively at 18 U.S.C.  2510 et. seq., 12 U.S.C  3401, 47 
USC  551(g), 18 USC  2710(f), 29 USC  2009, 47 USC  227(e), 18 
U.S.C.  2721, and Pub. L. No. 106-102, 507, 524 (1999).
---------------------------------------------------------------------------
                             iv. conclusion
    I am very encouraged that so many in Congress are interested in 
addressing the problems of data security and information privacy. My 
recommendations today are: (1) to focus on the larger problem by 
empowering individuals and making the users of data more accountable; 
and (2) to avoid preempting the states, as this will retard the 
development of privacy law for years to come.

    Mr. Stearns. I thank the gentleman. We are going to take a 
recess. We will quickly vote and we will be right back with the 
questions from the Members of Congress. So thank you for your 
patience.
    [Brief recess.]
    Chairman Barton. The Chair would recognize himself for 5 
minutes. I want to apologize for calling you back from your 
break, but I have got three meetings going on right now and so 
this would be my only chance to ask questions.
    This is not a Visa card; it is a MasterCard card, but I 
have got--it says Joe Barton, Campaign, Joe Barton. There is 
only one of these cards. I hardly ever use it. Five, six times 
a year maybe, once a month. I got a phone call Monday; somebody 
in Orlando, Florida had charged $3,500 at two different Wal-
Marts on this card. Now, I have been in Wal-Mart; I have been 
in Orlando to Disneyworld back in January, but I never went to 
a Wal-Mart. And the people that use--they actually had a card, 
not just the number, they had the card. And they went in on two 
different occasions, charged around $3,500. So I got a phone 
call, and the lady on the phone said had I been to Orlando, 
Florida? I said yes. She said were you there over the weekend? 
And I said no. And so we determined that somebody else had used 
this card.
    Now, the gentleman from--I think Mr. Ireland is 
representing Visa. According to your testimony, there is a very 
sophisticated system to detect misappropriation or misuse of 
these cards, so I would assume that that is what happened with 
me, that it kicked in because it was two large transactions and 
in an area that I showed almost no use, no geographic use. Is 
that correct?
    Mr. Ireland. That is correct. The financial institution--
bank that issued that card and probably in combination with 
MasterCard has a system to track authorizations on the card to 
see whether they fit your pattern and to see whether they fit 
known fraud patterns. And so they spotted a transaction that 
they didn't think was you----
    Chairman Barton. Now, who ends up paying for those charges? 
Does Wal-Mart pay for them? Does the institution that issued 
this card pay for them?
    Mr. Ireland. Typically, in a card-present transaction, the 
institution that issued the card will pay for it.
    Chairman Barton. Now what, if anything, will they do to try 
to actually track down the person who used this card 
fraudulently?
    Mr. Ireland. Well, typically, the card issuers will work 
with law enforcement based on the information they get to see 
if there is any way they can do it. We are talking in this case 
about the creation of counterfeit cards, which----
    Chairman Barton. They actually had a card. It wasn't just 
the number.
    Mr. Ireland. Exactly. Which has been a problem in the past 
and the credit card issuers have worked to develop security 
features in the card and other ways to combat card 
counterfeiting. But they have regular programs that are 
designed to prevent those kinds of fraud and to try to track 
them down----
    Chairman Barton. Well, how would whoever got a fraudulent 
card--because I just almost never use this card. How would they 
have actually gotten the information, obtained the information 
to create the fraudulent card?
    Mr. Ireland. I obviously can't answer that in this specific 
case. But it is possible to create fraudulent cards based on 
information that may be collected at the point of sale. I 
believe the Visa rules discourage or prevent the collection of 
that information, but sometimes enough information is collected 
at point of sale to create a fraudulent card, No. 1. No. 2, 
plain old theft may be involved. Somebody may have been able to 
get a hold of the card, steal it for a period of time and 
replace it.
    Chairman Barton. I--now what?
    [Brief recess.]
    Mr. Stearns. If members are here, we are going to continue 
to go on. We have another full committee markup that we have to 
do in this room, and I think we have three out of the five, and 
we have the chairman here who is in the middle of his 
questions. So if the witnesses will please take their seats, 
and we shall continue. And with that, I recognize the chairman 
of the full committee, Mr. Barton.
    Chairman Barton. And, Mr. Chairman, I had about 2 minutes 
left on my clock, so if you want to----
    Mr. Stearns. Well----
    Chairman Barton. [continuing] reset the clock----
    Mr. Stearns. [continuing] we will give you whatever you 
want, sir.
    Chairman Barton. Well, we just want to be fair. I was 
asking a series of questions based on my personal campaign 
credit card being stolen over--the number stolen and used down 
in Florida, what the safeguards are about that. But I want to 
go to the next line of questions. I want to ask Mrs. Barrett, I 
would like to outlaw the use of Social Security numbers for any 
purpose except governmental purposes. What is your reaction to 
that?
    Ms. Barrett. Well, I think that the Social Security number 
has become an identifier in many, many aspects of our lives. 
From a standpoint of Acxiom's business, we limit its use to a 
very, very small number of instances. So the direct impact on 
something like--back to us would not be significant. But I am 
aware of instances where it would create huge problems for 
either our clients or other businesses. And I----
    Chairman Barton. Well, just this calendar year, we have had 
I think three instances of people breaking into data systems 
and stealing hundreds of thousands of records that had Social 
Security numbers attached to them with quite a bit of personal 
privacy information. You know, I understand how ubiquitous the 
Social Security number is, and it is one of the few things that 
almost every American citizen has and even some non-citizens if 
they are working in the country. But wouldn't it be possible to 
create each data base its own identifier so we don't have to 
use the Social Security number?
    Ms. Barrett. In many cases Acxiom does help our clients, 
who have the records on these consumers, create their unique 
customer identifiers. Social Security number, however, has 
become a key element in identifying someone's identity when you 
are trying to establish who that person is up front so that----
    Chairman Barton. But you could do it without it. We have 
had banks a lot longer than we have had the Social Security 
system.
    Ms. Barrett. You could. I think we need to look carefully 
at whether it is government uses or other specific uses should 
be carved out and preserved because of the importance of it----
    Chairman Barton. Mr. Burton----
    Ms. Barrett. [continuing] restricting general uses.
    Chairman Barton. Mr. Burton, do you have a comment on that?
    Mr. Burton. No, I don't. I think our view is if you are 
keeping any sort of data, Social Security numbers, any 
sensitive data, it should be encrypted so that even if it is 
pilfered, it doesn't mean anything to the thieves.
    Chairman Barton. Okay. What about the gentleman, Mr. 
MacCarthy, who is representing Visa now.
    Mr. MacCarthy. Our sense is that the Social Security number 
is a key identifier in a lot of the data bases that are 
important for people who are issuing credit cards, when they 
are trying to determine whether someone who is applying for 
credit has a good history. The Social Security number is, in 
the current systems, a very important way of identifying that 
person and seeing whether that person has a good credit 
history. It is not impossible over time to move to a new 
system, but the legacy systems, the ones that exist now, the 
ones that help us fight identity theft and fraud all make heavy 
use of the Social Security number. And a government rule that 
said you simply can't use that starting tomorrow would create 
havoc with those systems. So we would ask you to look carefully 
at the idea of restricting Social Security numbers to just 
government use. We think right now they are----
    Chairman Barton. Well, I know that you----
    Mr. MacCarthy. [continuing] legitimate commercial uses.
    Chairman Barton. I know that you are not trying to be 
argumentative and that you had a legitimate business point, but 
at what point do we say an individual's privacy trumps that? Do 
we just say it is okay for these Social Security numbers to be 
stolen and used for all kinds of purposes for which they are 
not intended because of these legacy systems and all of the 
valid, legitimate business reasons why it would be inconvenient 
to do something differently?
    Mr. MacCarthy. Two things: one is very often a way to fight 
identity theft and fraud, which hurts consumers, is through the 
effective use of Social Security numbers. So if you take that 
weapon away from us, it might actually hurt in protecting 
people against identity theft and fraud.
    The second is there are some uses of Social Security that 
probably should be restricted. You know, the idea that a Social 
Security number can be simply published on the Internet or made 
available for non-business uses, we think that that is the kind 
of thing that Congress may want to look upon and restrict.
    In terms of business practices, it is the current practice 
and maybe it should begin to be phased out--it is the current 
practice for Social Security numbers to be used as access 
numbers to gain access to accounts and other--and that may be 
something that should, over time, go away as well. The fact 
that that number is so readily available makes it very, very 
risky to use as an access device.
    Chairman Barton. And my time is about to expire, but as we 
get more and more information and more and more centralized, we 
have to do something. I mean we just have to. You cannot have 
an individual or a family that their whole financial records, 
their medical records, all kinds of consumer data is just out 
there without their permission. And the Social Security number 
ties that all together and it is so easy for the criminal 
elements--we have had testimony that organized crime is moving 
in to identity theft. And so I know there are legitimate 
business reasons why it is done, but I think the time has come 
to tip the balance in the favor of the individual privacy and 
find another way to help businesses determine the identity of 
people they want to give credit to. With that, Mr. Chairman, I 
yield back. I thank the witnesses for the inconvenience.
    Mr. Stearns. Just following up with what the chairman said, 
there is some talk about a second factor ID authentication, and 
they gave me this card, Mr. Chairman, where, instead of putting 
your Social Security number, what you would do is put your name 
and then they would ask you, based upon the permutations in 
this card, you would give them a number off a card. And rather 
than--I think that is what you talked about a little bit, Mr. 
Burton. You might tell the chairman here just before he goes 
what this second factor ID authentication would do which 
possibly could replace Social Security.
    Mr. Burton. Yes, well, second factor authentication is an 
access card and a way to identify a user. I think what it would 
not do is identify a user in a data base, which I think is what 
a lot of Social Security numbers do. But what a lot of security 
experts are saying, we have got to have, for everyone holding 
sensitive information, says the FDIC recommendation, is to use 
second factor authentication. And that means not only something 
that you know, which are passwords which you give you access to 
an account, but something that you physically have. So even if 
your password is compromised, the thieves still can't get 
access. The problem with this technology to date is that it is 
quite expensive. It can run $40, $50 per year per user. And so 
for mass applications, it is simply not feasible.
    And the solution that Chairman Stearns and I were 
discussing is called Identity Guard. Entrust just released it 
about 4 months ago. And what you do is you enter your user name 
and password in your account; you then have a card with a 
unique scrambled set of numbers and letters unique to you, and 
much like bingo, you are prompted to say, well, what is in 
column A-1, B-3, C-4, and then you fill in the numbers from 
this unique card and get access to your account.
    What is interesting about this is that that prompt changes 
every time you log in. So it is not that there is one pin 
number, there is one password that someone has to steal to get 
access to your account. Very inexpensive, very easy to deploy, 
mass market application, and I think these are the kinds of 
technologies that the private sector is starting to come up 
with to address questions of access to sensitive information.
    Mr. Stearns. Thank you. You know, listening to your opening 
statements I sort of put together I think about seven different 
things that would possibly be in a bill. And I am not sure we 
would all agree upon these factors. But I thought I would take 
each one and ask you if you agree or disagree. The first I 
heard was uniform national notification standards for consumers 
in the event of a breach. Does anybody not agree with that 
being part of the bill? Okay. So----
    Mr. Burton. Just a----
    Mr. Stearns. Yes.
    Mr. Burton. [continuing] point of clarification for breach 
of unencrypted personal information. I think that is how most 
of the State laws read----
    Mr. Stearns. Okay----
    Mr. Burton. [continuing] so that if there is a breach and 
the data is encrypted, no one can read it, and so there 
shouldn't be a notification requirement.
    Mr. Stearns. Okay.
    Mr. MacCarthy. Mr. Chairman----
    Mr. Stearns. Yes, sir.
    Mr. MacCarthy. The one thing we would add to that is 
compliance with the guidelines that have been put in place by 
the Federal banking regulators should count as compliance with 
the national standard that is put in place in the legislation.
    Mr. Stearns. Okay. Good point. The second is Federal 
preemption with all the States. Anybody disagree with that? 
Okay. The third is establish an official agency role over 
public data providers. This was mentioned. Sort of a government 
agency having broad powers, something like the SEC, dealing 
with privacy. Does anybody disagree with that or not? It is a 
little more controversial. And, Ms. Barrett, I think you sort 
of might have some objection to that.
    Ms. Barrett. Well, I don't know that I have objection. I 
think that information providers have a responsibility to 
safeguard the information and use it for responsible purposes. 
And if there are enough bad actors out there that are using 
information irresponsibly, we want those out of the 
marketplace. And if it takes a regulating agency to do it, then 
we will support that.
    Mr. Stearns. Okay, so that is--yes. This is pretty 
important now. What you are saying is a government regulating 
agency should be put in place to help and control, and, you 
know, you have got to be careful what you ask for here.
    Mr. MacCarthy. The only point I would ask is that the 
committee recognize the important role that the Federal banking 
regulators already play in that area----
    Mr. Stearns. Okay.
    Mr. MacCarthy. [continuing] their privacy requirements and 
their security requirements, notification requirements that are 
already administered by the banking agencies and by the Federal 
Trade Commission. And I don't think it would be a good idea to 
move enforcement from those agencies to a new agency.
    Mr. Stearns. Okay. So maybe the existing Federal Trade 
Commission or the existing whatever----
    Mr. MacCarthy. Yes.
    Mr. Stearns. [continuing] Gramm-Leach-Bliley where----
    Mr. MacCarthy. Yes, that would work.
    Mr. Stearns. Yes. Opportunity for consumers to inspect and 
correct any information that is in their data base. Yes?
    Ms. Barrett. Today, we offer the consumer the right to do 
that. I think that it is--when it comes to correction, it is a 
complicated environment, so we need to explore how a correction 
takes place very carefully. But the concept that the 
information needs to be accurate, and when it is inaccurate, we 
need to figure out ways to deal with it is one we support.
    Mr. Stearns. The idea is for your consumer credit you can 
get access to see if it is correct. And so the theory is then 
why can't you inspect incorrect data that has been collected to 
see if it is correct too?
    Ms. Barrett. We actually offer the same inspection----
    Mr. Stearns. Okay.
    Ms. Barrett. [continuing] of information in our fraud 
management systems.
    Mr. Stearns. I am not sure----
    Ms. Barrett. And our----
    Mr. Stearns. [continuing] everybody does though.
    Ms. Barrett. No. I don't believe----
    Mr. Stearns. And so the question, should the Federal 
Government step in and mandate that all data collection 
agencies have to provide access to consumers so they can see if 
the information is correct? That is a little sensitive because 
there is a lot there that deals with marketing and deals with--
--
    Ms. Barrett. I was just about to say there are different 
categories of data.
    Mr. Stearns. Right, different categories.
    Ms. Barrett. And so I think it is important to understand 
that when we want to put a standard of accuracy in and 
correction in and access in, that we need to do it in a way 
where the accuracy of the information is important to the 
decisionmaking process. We offer access today to all of our 
what we call reference products where decisions are being made, 
identities are being verified with that information.
    We actually do not today offer access to our marketing 
products. We offer an opportunity to see what kind of data we 
might have about you and then the chance to opt out of that. 
But since you can't opt out of identity systems like you can't 
opt out of your credit report----
    Mr. Stearns. Yes.
    Ms. Barrett. [continuing] the inspection process becomes 
more important.
    Mr. Stearns. Yes, it is a little more nuanced. Someone 
mentioned to possibly have the security officer sign to 
corroborate the security at the agency that collects this 
information. Does anybody disagree with that? It is a little 
bit like Tosarbi and Zoshley in which the CEO has to sign the 
accounting--the P and L statement. So it sounds like you might 
accept that.
    The other idea is standard credentialing practices for 
customers desiring sensitive consumer data. Anybody object to 
that?
    Ms. Barrett. Let me just comment on that----
    Mr. Stearns. Yes.
    Ms. Barrett. [continuing] I think that credentialing is 
extremely important. I would caution the committee in terms of 
how it defines credentialing because the tools we have for 
credentialing today will not be the same tools that we have in 
5 or 10 years----
    Mr. Stearns. Yes.
    Ms. Barrett. [continuing] and so if we do it in a way that 
allows the evolution of technology and other aspects to be 
accommodated within the requirement, it may be a good 
requirement. For instance, I think the Gramm-Leach-Bliley 
safeguards rule really actually has an implication on 
credentialing because it says you must have physical, 
procedural, system, and so on, processes in place to keep the 
data protected from unauthorized use. And to me credentialing 
becomes a part of that. So I would just urge that the committee 
not consider too prescriptive an approach to accommodate 
wherever we go with technology in the future.
    Mr. Stearns. My time is up. I think the last one I had was 
to encourage, perhaps through legislation, a technical solution 
for--well, let me--you know, instead of using your Social 
Security ID, to try and encourage some other way, work out so 
that you could access the information without using your Social 
Security ID. And that is sort of what we talked about in the 
Chairman Barton talk. So my time has expired. And with that, I 
recognize the ranking member.
    Ms. Schakowsky. Thank you, Mr. Chairman. Mr. Ireland, you, 
in your testimony, talked about significant risk of harm, and 
you went back to FTC chairwoman saying notices should be sent 
only if there is a significant risk of harm. How are we going 
to define significant risk of harm?
    Mr. Ireland. Well, I think there is obviously a drafting 
issue here as to precisely the verbiage you use in how you 
ensure that it doesn't essentially gut the requirement. But 
there are numerous circumstances where identification 
information that could otherwise be used for identity theft, 
upon investigation you find out that it is clearly not going to 
be used for that purpose.
    One thing we have seen is what might be called competitive 
espionage where one company manages to get a hold of the other 
company's customer list, and it includes identification 
information that might be used to open an account. But you know 
they have no intention of doing that. What they want to do is 
solicit the company's customers. And a notice in those 
circumstances to the customer might serve some privacy 
interest, but there is no real reason for the customer to go 
put a fraud alert on their account, for example----
    Ms. Schakowsky. Well, who says that it is not of interest 
to the consumer in that even being solicited might, in their 
view--harm may not be the correct word, but you heard my 
colleague, Ms. Cubin, talk about being notified about some 
breaches which, she said, thankfully are not going to result, 
she believes, in any illegitimate use. But she, it seems to me, 
is glad to know that this information has been shared at the 
very least. And I can't quote you exactly the source, but at 
one of the many hearings on privacy, apparently a data broker 
has testified that the unauthorized access of information by a 
former employee does not constitute a significant risk. I am 
just a little concerned that the owners of this information are 
deciding for me what I might consider to be significant harm 
and then choosing to not provide the information to me, that 
there has been a breach.
    Mr. Ireland. Well, I would agree with you. I think there is 
a terminology and a drafting challenge there because you don't 
want the owners to have unlimited discretion to make that 
decision. Currently, under the banking agency guidance, for 
example, banks are required to notify the banking agency about 
the breach, regardless of risk. And then they are supposed to 
notify based on risk standard, and that is going to be worked 
out between the banks and the banking agencies.
    There are issues where information is disclosed that have 
implications for privacy. There are issues where information is 
disclosed that have implication for credit card fraud. And 
there are issues where information is disclosed that have 
implications for identity theft in the form of opening accounts 
in somebody's name that are fraudulent. And the actions that a 
consumer would want to take on the basis of those different 
classes of breaches are different. If you find that you are 
giving notices to consumers in all of those classes, you may 
find that the one where they really need to take action by 
putting a fraud alert, for example, on their file at a consumer 
reporting agency under the Fact Act, as passed by Congress in 
2003, gets lost among other notices that are simply addressing 
potential privacy issues. So I think the----
    Ms. Schakowsky. You know, I mean----
    Mr. Ireland. [continuing] judgment needs to made----
    Ms. Schakowsky. [continuing] let us not get too----
    Mr. Ireland. [continuing] here----
    Ms. Schakowsky. [continuing] patronizing though about what 
consumers can really handle. I mean, we may want to deal with 
how we communicate that and prioritize a sense of urgency. But 
isn't it also true that financial institutions regulatory 
guidance doesn't cover breaches of data about business 
customers, even small business customers who have business 
accounts? Mr. MacCarthy said in your absence that we should 
import that standard. And, you know, we are not covering all--I 
guess the guidance doesn't cover all consumers but only 
customers.
    You know, we just need to make sure that--I think that we--
privacy is a huge deal to people. And I think it varies in its 
implications, but people don't even like the idea of people 
just picking through it.
    And with that, I just want to ask the question--I realize I 
am running out of time. How do I determine which data brokers 
have my information? I mean, does your company have information 
about me? How do we even know? We know about credit reports, we 
know how to check them, we can even get them free once a year 
now. But who has my information? How do I know if I want to 
know? Maybe each of you could quickly tell me how I know if you 
have got info on me?
    Ms. Barrett. Well, there are a couple ways if Acxiom had 
info on you that you might know about it. If you have a 
question about a client or about a business relationship and 
you ask them where did that information come from? They might 
well refer you to Acxiom if we provided the information for 
whatever that process----
    Ms. Schakowsky. But they might not.
    Ms. Barrett. Well, we actually encourage our clients to do 
that. And so that is one avenue.
    Ms. Schakowsky. They don't have to.
    Ms. Barrett. It becomes a customer service issue I think 
for them to----
    Ms. Schakowsky. Okay.
    Ms. Barrett. [continuing] deal with--in terms of you--your 
relationship with them since they are the business that you 
have a relationship with.
    Ms. Schakowsky. Okay.
    Ms. Barrett. On our website you can request, as I was 
talking earlier, a copy of the report of the information that 
we have since we do allow consumers to have access. Our web 
address is fairly well-known. While I don't think all consumers 
know it, many, many do, and you can easily get to it from 
privacy websites and a number of other places. Those would be 
the two most common ways.
    Ms. Schakowsky. If we knew about Acxiom we could do that, 
but, you know, most consumers haven't got a clue of who is even 
controlling their information. Do you know what I am saying? Is 
there a website I could go to to say well, here is a whole list 
of data brokers? Here is a whole list of people--I mean, I know 
who my credit card companies are, so I can go there. But these 
other businesses that may have my information and are in the 
business of information are really not very well-known to 
people.
    Ms. Barrett. I think that is accurate. And we have actually 
talked about whether or not there should be a directory if you 
will or a website where consumers could go and learn who we 
are. We are certainly not trying to stay in the dark.
    Ms. Schakowsky. Thank you.
    Mr. Buege. In our case at West we really don't originate 
any of this information. We obtain it from the credit bureaus 
and other aggregators. So in our case if you were to ask us 
what we have, we would certainly happily and do happily share 
that with consumers even though, again, we don't serve consumer 
markets directly. And the answer is it all comes from upstream, 
so what we end up doing is referring you to the source of the 
data to have it corrected, removed, whatever.
    Mr. Ireland. The only information we would have would be 
derivative of the Visa card that you have with your bank. And 
we act as a servicer to your bank in processing some of that 
information, as do other servicers. And the place to start to 
know where that information is is with your bank if it gave you 
the Visa card.
    Mr. Burton. Entrust is a security software company so we 
are not a data broker, and we help banks and data brokers 
protect information, but we don't hold any ourselves.
    Ms. Schakowsky. Thank you all.
    Mr. Stearns. I thank the gentlelady. The gentlelady from 
Tennessee. Okay. Okay. I think what we are going to do is a 
second round here. We appreciate having this expertise here.
    Mr. Ireland, your testimony states that Visa believes that 
all holders of sensitive information about consumers should be 
subject to the same rules. Why shouldn't different types of 
information be treated differently? Should data security laws 
differentiate between companies that maintain customer data and 
those that handle non-customer data?
    Mr. Ireland. Well, the current banking rules, for example, 
differentiate--well, depending on whether or not you are the 
customer or the bank. But Visa adopted the CISP program, for 
example, because it saw gaps in the banking agency 501(b) and 
the FTC 501(b) guidance and standards like that. There was some 
discussion earlier about whether the banking agency standard or 
the FTC standard is precisely the right standard. And there is 
no standard that can't be improved in my mind.
    But standards like that ought to apply, we believe, to 
classes of information that would be considered sensitive. And 
obviously other classes, more sophisticated information systems 
such as credit reporting agencies are already subject to the 
Fair Credit Reporting Act. But a basic security standard in our 
view ought to be adopted for a level of information. And it is 
characterized in my testimony as sensitive, and you have to 
sort out what that is.
    One of the problems with current State legislation is that 
different States are defining sensitive information 
differently. And what you consider sensitive information 
depends in part on the dialog I had with Ms. Schakowsky about 
what you are trying to protect. If you are trying to protect 
against identity theft, the information is the type of 
information that would enable somebody to open an account with 
a financial institution, which is information specified in 
rules under Section 326 of the U.S.A. Patriot Act for example.
    If you were talking about credit card account information, 
that is a somewhat different set of information. If you are 
talking about privacy interests, you are covering a still 
broader set of information, but you are still not probably 
covering information that is not personally identifiable. So as 
you go about that task I think yes, you have to differentiate 
between classes of information. But for the same class of 
information, the same rules ought to apply, regardless of who 
has that information I would think.
    Mr. Stearns. If you could waive a wand, do you think Gramm-
Leach-Bliley needs to be changed at all?
    Mr. Ireland. I think Gramm-Leach-Bliley has done a very 
good job of doing what it set out to do, which was to have 
financial institutions get control of their uses of personal 
information and give consumers an opportunity to opt out of 
certain uses of that information. And that has happened. And I 
think you have a very high level of compliance with that 
statute. But obviously there is personal information that is 
outside the scope of that statute, and the unauthorized use and 
access to that information creates risks to consumers and we 
think ought to be addressed by security standards.
    Mr. Burton. Mr. Chairman----
    Mr. Stearns. Yes----
    Mr. Burton. [continuing] if I could just comment----
    Mr. Stearns. Go ahead. Sure, Mr. Burton.
    Mr. Burton. [continuing] on Gramm-Leach-Bliley, because I 
think actually the security safeguards in Gramm-Leach-Bliley 
are extremely interesting, and I think that we may need to do 
more. But if you look at what they talk about in terms of what 
organizations should do to protect security, they don't talk 
about technology, they don't talk about mandates. They really 
talk about sound business practices like having a risk 
assessment for your personal data, making sure there is a 
security officer in charge of it, making sure that there is 
regular audits. And I think these kinds of activities are 
ultimately what is going to drive greater security.
    And in the work that Entrust has done, including a 
Department of Homeland Security Committee we co-chaired, we 
focused really on information security as a corporate 
governance issue. And so to the extent that you get CEOs and 
Boards of Directors focused on this and with regular ports 
going to them about the state of the security in their 
organizations, suddenly you will see big progress in the way 
that data is protected and secured.
    Mr. Stearns. Mr. Buege, we haven't talked about in the 
event that there are violations and penalties. And do you think 
monetary penalties are appropriate for entities that disregard 
basic data base security due to, you know, lack of preparation, 
due diligence, not following good industry practices? And if so 
when should a data broker be sanctioned with a fine?
    Mr. Buege. I think I would say yes, that if a data broker 
is not exercising appropriate diligence in terms of 
safeguarding the information, in terms of securing access to it 
appropriately, that sanctions would be an appropriate remedy. I 
am not sure I can speculate on, you know, what sorts of 
sanctions or the magnitude of those but----
    Mr. Stearns. Do you think it should be monetary or----
    Mr. Buege. Why not? I mean, I wouldn't object to some 
measures like that in place. I mean, I think if that is what it 
takes to motivate companies to properly protect this 
information and to act responsibly in terms of access and 
systems integrity, I would have no objection to it.
    Mr. Stearns. Anybody else--I mean, that is another area we 
haven't talked about in the event that we do find somebody who 
is negligent. What kind of penalty should be enforced or is 
there, you know, a warning or what? I mean, depending upon 
obviously the offense, but if you have any feel on that, 
anybody else?
    Ms. Barrett. I would agree.
    Mr. Stearns. Okay, all right. Well, my time has expired on 
that, so the gentlelady from Tennessee.
    Ms. Blackburn. Thank you, Mr. Chairman. And I want to thank 
each of you for your indulgence. I had just arrived when we had 
to depart. So I thank you for this. And I think it does, Mr. 
Chairman, point out the importance of testimony being submitted 
early because it does allow us to read through that and to 
prepare and to be ready to come into the hearings.
    Ms. Barrett, I think want to begin with you if I may, 
please, ma'am. And I want to thank all of you for what you are 
doing and being with us here today. I represent an area in 
Tennessee that goes from Memphis to Nashville, and we have a 
lot of individuals that live in this district that are 
concerned with piracy, intellectual property theft, and, of 
course, a component of that is identity theft. And so we are 
pretty focused on this. The banking interests, the insurance 
interests that are in my district, the healthcare interests 
that are there, the identity theft comes up repeatedly. So we 
thank you for this.
    And, Ms. Barrett, in your testimony you explained an 
occurrence of a client illegally obtaining information from 
your server and how you went about handling that. And my 
question for you is based on--it was a July 1904 article that 
was in ``U.S.A. Today'' that referenced an occurrence of 
hacking into your server by an individual who ran 
snipermail.com. So was Snipermail the client that you were 
referring to?
    Ms. Barrett. Yes, it is.
    Ms. Blackburn. It is, okay. All right. So they were a 
client and not just an outside intruder. And so would you 
explain the vetting process that you went through before 
agreeing to do business with Snipermail?
    Ms. Barrett. Yes, and let me clarify--let me describe the 
situation. That----
    Ms. Blackburn. Okay.
    Ms. Barrett. [continuing] might answer this plus other 
questions. We have a file transfer server that our clients use 
when they want to send us a file of data to be processed. They 
would send that file to this server, and then we would reach 
outside of our main system, pick it up, and bring it inside our 
firewall. It was used----
    Ms. Blackburn. Hold on just one moment. So that transfer 
server is outside your normal firewall system?
    Ms. Barrett. Yes, it----
    Ms. Blackburn. Okay.
    Ms. Barrett. [continuing] was password-protected with 
passwords that each client was assigned. Sometimes the files 
were coming to us for processing, and then when we finished 
with that, sometimes we would put the file back on that server 
to be sent back to the client. In many cases the downstream use 
of that file was actually by a vender of our clients. And in 
the case of Snipermail, there were actually two different 
breaches--or two different individuals that breached the server 
in the same way in 2003. One of them was from a client 
operation. The other one was from a vendor of a client. And we 
posted files on that server, and the client actually gave the 
vendor access to the server to come and pick up the files for 
subsequent processing.
    Ms. Blackburn. If I may follow up with you on that, then. 
So in your vetting process with your clients, are you including 
or requiring some type of vetting process for their vendors 
with which they plan to share that information?
    Ms. Barrett. We have talked about it since that incident. 
Since the client--this is client data, not Acxiom data, not 
part of our information products. We actually rely on our 
client to do the vetting of their own vendors.
    Ms. Blackburn. And what is your accountability process with 
your clients regarding those vendor clients of theirs--the 
vendors of theirs? Because in essence the client is acting on 
the behalf of the vendor if you will. So therefore, you still 
have a contingent liability in that issue.
    Ms. Barrett. And what we have done since that incident is 
change rather dramatically the processes we use to distribute 
files to both clients and their vendors, tighten that process 
up. There are much stricter passwords that are required for 
that server. It is not a two-way server. There is a server for 
distribution and a server for receipt. The passwords are 
changed and verified far more frequently than they were before. 
And we expect a credentialing process if you will to go on 
between our client and their vendor.
    Ms. Blackburn. Okay. Have you sold information on American 
consumers to foreign companies or foreign governments?
    Ms. Barrett. No.
    Ms. Blackburn. You have not. Okay, great. All right. I 
think my time is about out. Mr. Chairman, thank you.
    Mr. Stearns. I thank you. I thank you for coming. We are 
through with our questions so we are going to adjourn the 
subcommittee, but I want to thank you for the patience you had 
during the evacuation here. It is very unusual, but we 
appreciate you taking the time to come back. We lost the GWU 
law professor, but we are going to submit questions to him to 
fulfill everything. But I think you have given us a good idea 
of what we should do. So your coming here today has helped sort 
of firm up some of the ideas we had on this bill, and we are 
hoping, I think, in due time here to get a bill. And so any 
other things that you might suggest--I have given you the 
outline, probably 7 or 8 of the things we are thinking about, 
some of them not as forcibly as the others, but you never know 
what can happen once you move out of the subcommittee to the 
full committee. But I am hoping we can mark this up in perhaps 
the next 30 days. So thank you very much for coming, and the 
subcommittee is adjourned.
    [Whereupon, at 1:37 p.m., the subcommittee was adjourned.]
    [Additional material submitted for the record follows:]
                Prepared Statement of ARMA International
                        about arma international
    Established in 1956, ARMA International (ARMA) is the non-profit 
membership organization for the records and information management 
profession. The 10,000 members of ARMA include records and information 
managers, imaging specialists, archivists, technologists, legal 
administrators, librarians, and educators. Our mission includes 
providing education, research, and networking opportunities to 
information management professionals, as well as serving as a resource 
to public policy makers on matters related to the integrity and 
importance of records and information.
    ARMA also serves as a recognized standards developer for the 
American National Standards Institute (ANSI), participating and 
contributing toward the development of standards for records and 
information management.1 ARMA is also a charter member of 
the information and documentation subcommittee of the International 
Organization for Standardization (ISO), aiding in the development of 
its records management standard.2
---------------------------------------------------------------------------
    \1\ ``Managing Recorded Information Assets and Resources: Retention 
and Disposition Program'' may be viewed at http://www.arma.org/
standards/public/document_review.cfm?DocID=22.
    \2\ ``Information and documentation--Records management--Part 1: 
General'' (ISO 15489-1:2001) (hereafter ``ISO 15489-1''). ARMA fully 
supports ISO 15489-1. ARMA is currently developing additional records 
management standards beyond ISO 15489.
---------------------------------------------------------------------------
    Because of the essential role of effective and appropriate 
information management in today's economy, ARMA International has a 
strong interest in issues pertaining to safeguarding consumer 
information and other personally identifiable information possessed by 
business and government.
    Records and information management plays an important role in the 
private sector. In this new century, the most valuable commodity of 
business is information, often in the form of data bases of essential 
information required by the service sectors of our economy. The 
greatest responsibility for organizations will be managing and 
maintaining the integrity of an ever-growing flow of information, 
including the establishment of appropriate safeguards for sensitive 
information and in establishing retention schedules complaint with 
regulatory and statutory requirements. Issues such as what information 
has intrinsic value and what information will be shared and with whom 
are critical to the future success of 21st century organizations. These 
challenges call for increased recognition of the role of managing 
critical information and providing appropriate protections for 
personally identifiable information.
    Organizations that embrace information management as being 
strategic and mission critical will ensure their competitive advantage 
and remain appropriate stewards of information that contains personal 
and private records.
  data security initiatives need to be sensitive to a wide variety of 
                                factors
    Americans demand security and privacy of their personally 
identifiable information. Identity theft complaints continue to 
rise.3 The establishment of new systems that allow easy 
access and transference of personally identifiable data between parties 
should to be sensitive to personal privacy and grant assurance to 
Americans that their data will not be misused or end up in the wrong 
hands. ARMA believes that these systems must incorporate the best 
practices of records and information management.
---------------------------------------------------------------------------
    \3\ The Federal Trade Commission reported over 400,000 complaints 
of identity theft logged into its ID Theft Clearinghouse as of December 
2003. See prepared statement of the Federal Trade Commission on 
Identity Theft: Prevention and Victim Assistance, presented by Betsy 
Broder, Assistant Director, Division of Planning and Information, 
Bureau of Consumer Protection, before the Subcommittee on Oversight and 
Investigations of the House Committee on Energy and Commerce (December 
15, 2003). http://www.ftc.gov/os/2003/12/031215idthefttestimony.pdf.
---------------------------------------------------------------------------
    Concerns have also begun to emerge with health care providers, 
financial institutions, and other users of consumer information sending 
personally identifiable information overseas for processing. This 
practice, known as ``information offshoring'' is becoming more and more 
common as organizations seek to curb costs by sending data to countries 
such as India, Pakistan, and Bangladesh for processing. Unfortunately, 
these nations lack any statutory controls for the protection personally 
identifiable information and it remains unclear whether existing U.S. 
laws, such as HIPAA, apply.4
---------------------------------------------------------------------------
    \4\ In a response to a letter from Representative Edward J. Markey 
asking whether HIPAA covers personally identifiable information sent 
overseas for processing, Health and Human Services Secretary Tommy 
Thompson indicated it did not. See letter from Secretary Thompson to 
Representative Markey dated June 14, 2004 at http://www.house.gov/
markey/Issues/iss_
health_resp040614.pdf.
---------------------------------------------------------------------------
    Of primary importance from a records and information management 
perspective is ensuring the privacy and security of the information. 
Whatever information management systems are in place must ensure 
protection of the records and information in these two critical areas. 
Public sector agencies and private sector entities should not have 
access to personally identifiable information unless the information is 
essential to the organization's work. It is important that public and 
private sector entities identify what information is actually mission 
critical, who within their organizations should have access to the 
information, and then ensuring that the information cannot be accessed 
by unauthorized parties.
    Established records and information management policies that follow 
best practices concerning retention, disposition, categorization, 
maintenance, or disposal may apply to aggregated data just as they 
apply to records in other formats.5 The requirements for 
protecting records during their use cannot simply be ``added on'' at 
the end of a technology implementation. These requirements are integral 
to the functioning of any system which stores, retrieves and protects 
information, and therefore must be considered during each phase from 
design to final implementation and system maintenance.
---------------------------------------------------------------------------
    \5\ See ``Managing Electronic Messages as Records (formerly: 
Guideline for Managing E-mail)'' (ANSI/ARMA-9-200x).
---------------------------------------------------------------------------
 why records retention and destruction policies are important for data 
                                security
    Information is among the most valuable commodities of any 
organization. In the case of organizations that possess, process, and 
use sensitive consumer information, this information is a part of the 
organization's strategic business model. As such, these organizations 
have a significant responsibility to manage and maintain the integrity 
and security of this information, including the implementation of 
appropriate safeguards against unauthorized use and the proper disposal 
of the information.
    ARMA notes that a significant risk of identity theft occurs at a 
point when a given record should be destroyed--and the best practices 
of records and information management and a record's retention schedule 
would require not only appropriate measures to ensure destruction, but 
also the documentation of the destruction or final disposition action.
    Within the context of managing the life cycle of any information, 
assuring that records and information are destroyed appropriately--at 
the time and in the manner anticipated by the organization's retention 
and disposition program, and in compliance with any applicable law or 
regulation--is as important and deserves the same level of attention 
and stewardship as assuring that the information is properly 
maintained--both for the use of an organization in pursuit of its 
business purposes as well as for safeguarding the information from 
improper use during the useful life of the information. The appropriate 
destruction of a record at the end of its life cycle will assist with 
efforts to curb identity theft, such as the growing problem of 
``dumpster diving.'' The same best practices will safeguard the 
misappropriation of records stored in electronic format.
    Safeguards and proper disposal are essential elements of an 
organization's information retention and disposition program. ARMA 
believes that any safeguard regime for personally identifiable 
information must include the formal endorsement by senior management of 
a written records and information management program. This would 
include the appropriate investment in personnel, training and 
organization-wide communications. It would also ensure that third party 
relationships endorse the same safeguards with appropriate means of 
ensuring compliance.
    In today's distributed work environments, a wide variety of 
individuals create records and must therefore take responsibility to 
ensure those records are captured, identified and preserved. It is no 
longer enough to train administrative staff and assume they will make 
sure the records end up in the records management program. All members 
of management, employees, contractors, volunteers and other individuals 
share the responsibility for capturing records so they can be properly 
managed throughout the length of their required retention period.
    ARMA's comments are informed by recognized practices of documenting 
the disposal of information and records. ISO 15489-1 Clause 8.3.7, 
``Retention and disposition 6'' provides: ``Records systems 
should be capable of facilitating and implementing decisions on the 
retention and disposition of records. It should be possible for these 
decisions to be made at any time in the existence of records, including 
during the design stage of records systems. It should also be possible, 
where appropriate, for disposition to be activated automatically. 
Systems should provide audit trails or other methods to track completed 
disposition actions.''
---------------------------------------------------------------------------
    \6\  ISO 15489-1 Clause 3.9 defines ``disposition'' to mean ``range 
of processes associated with implementing records retention, 
destruction or transfer decisions which are documented in disposition 
authorities or other instruments''. ISO 15489-1 Clause 3.8 defines 
``destruction'' to mean ``process of eliminating or deleting records, 
beyond any possible reconstruction''. Similarly, Draft Standard, 
Section 3, ``Definitions,'' defines ``disposition'' to mean ``a range 
of processes associated with implementing records retention, 
destruction, or transfer decisions that are documented in the records 
retention and disposition schedule or other authorities. Draft 
Standard, Section 3 defines ``destruction'' to mean ``the process of 
eliminating or deleting records beyond any possible reconstruction.''
---------------------------------------------------------------------------
    ISO 15489-1 Clause 9.9, ``Implementing disposition'' provides in 
part: ``The following principles should govern the physical destruction 
of records--
1) Destruction should always be authorized.
2) Records pertaining to pending or actual litigation or investigation 
        should not be destroyed.
3) Records destruction should be carried out in a way that preserves 
        the confidentiality of any information they contain.
4) All copies of records that are authorized for destruction, including 
        security copies, preservation copies and backup copies, should 
        be destroyed.''
    The Fair and Accurate Credit Transactions Act of 2003 (FACT Act), 
approved by this Committee, contains a provision requiring the Federal 
Trade Commission and the various banking regulators to develop a 
disposal rule for sensitive customer information. This rule may provide 
a model for businesses in other industry sectors for the appropriate 
disposal of personally identifiable information. In its comments to the 
disposal rules proposed by the Commission and the various banking 
regulators, ARMA strongly recommended that an orgnization's safeguards 
include a formal, written records and information management program, 
consistent with ISO 15489.
                               conclusion
    ARMA International applauds the leadership of Chairman Stearns and 
Ranking Member Schakowsky for examining the data security issue. ARMA 
recommends to the Subcommittee the best practices of records and 
information management as an effective element for any data security or 
safeguards initiatives or policies.
                                 ______
                                 
Prepared Statement of Gail Hillebrand, Senior Attorney, Consumers Union
                                summary
    Consumers Union,1 the non-profit, independent publisher 
of Consumer Reports, believes that the recent announcements by 
ChoicePoint, Lexis-Nexis, and many others about the lack of security of 
our most personal information underscores the need for Congress and the 
states to act to protect consumers from identity theft.
---------------------------------------------------------------------------
    \1\ Consumers Union is a non-profit membership organization 
chartered in 1936 under the laws of the state of New York to provide 
consumers with information, education and counsel about goods, 
services, health and personal finance, and to initiate and cooperate 
with individual and group efforts to maintain and enhance the quality 
of life for consumers. Consumers Union's income is solely derived from 
the sale of Consumer Reports, its other publications and from 
noncommercial contributions, grants and fees. In addition to reports on 
Consumers Union's own product testing, Consumer Reports with more than 
four million paid circulation, regularly, carries articles on health, 
product safety, marketplace economics and legislative, judicial and 
regulatory actions which affect consumer welfare. Consumers Union's 
publications carry no advertising and receive no commercial support.
---------------------------------------------------------------------------
    Identity theft is a serious crime that has become more common in 
recent years as we have delved further into the ``information age.'' 
According to the Federal Trade commission, 27.3 million Americans have 
been victims of identity theft in the past five years, costing 
businesses and financial institutions $48 billion and consumers $5 
billion. Victims pay an average of $1,400 (not including attorney fees) 
and spend an average of 600 hours to clear their credit reports. The 
personal costs can also be devastating; identity theft can create 
unimaginable family stress when victims are turned down for mortgages, 
student loans, and even jobs.
    And as ongoing scandals involving ChoicePoint, Lexis-Nexis, and 
others point to, American consumers cannot fully protect themselves 
against identity theft on their own. Even consumers who do ``everything 
right,'' such as paying their bills on time and holding tight to 
personal information such as Social Security numbers and dates of 
birth, can become victim through no fault of their own because the 
companies who profit from this information have lax security standards.
    Therefore, Congress and the states must enact new obligations 
grounded in Fair Information Practices 2 on those who hold, 
use, sell, or profit from private information about consumers. In this 
context, Fair Information Practices would reduce the collection of 
unnecessary information, restrict the use of information to the purpose 
for which it was initially provided, require that information be kept 
secure, require rigorous screening of the purposes asserted by persons 
attempting to gain access to that information, and provide for full 
access to and correction of information held.
---------------------------------------------------------------------------
    \2\ The Code of Fair Information Practices was developed by the 
Health, Education, and Welfare Advisory Committee on Automated Data 
Systems, in a report released two decades ago. The Electronic Privacy 
Information Center has described the Code as based on these five 
principles:
    1. There must be no personal data record-keeping systems whose very 
existence is secret.
    2. There must be a way for a person to find out what information 
about the person is in a record and how it is used.
    3. There must be a way for a person to prevent information about 
the person that was obtained for one purpose from being used or made 
available for other purposes without the person's consent.
    4. There must be a way for a person to correct or amend a record of 
identifiable information about the person.
    5. Any organization creating, maintaining, using, or disseminating 
records of identifiable personal data must assure the reliability of 
the data for their intended use and must take precautions to prevent 
misuses of the data.
    Electronic Privacy Information Center, http://www.epic.org/privacy/
consumer/code_fair_
info.html.
---------------------------------------------------------------------------
    Consumers Union recommends that lawmakers do the following:

 Require notice of all security breaches: Impose requirements on 
        businesses, nonprofits, and government entities to notify 
        consumers when an unauthorized person has gained access to 
        sensitive information pertaining to them. Consumers Union 
        supports S. 751, by Senator Dianne Feinstein, which would put 
        these requirements in place. We also believe that S. 768, 
        introduced by Senator Charles Schumer and Senator Bill Nelson, 
        will make an excellent notice of breach law.
 Require and monitor security: Impose strong requirements on 
        information brokers to protect the information they hold and to 
        screen and monitor the persons to whom they make that 
        information available. S. 768, as well as S. 500 and H.R. 1080, 
        introduced by Senator Bill Nelson and Representative Ed Markey, 
        respectively, would direct the Federal Trade Commission to 
        develop such standards and oversee compliance with them.
 Give consumers access to and a right to correct information: Give 
        individuals rights to see, dispute, and correct information 
        held by information brokers. This is also addressed in the 
        Schumer/Nelson and Nelson/Markey bills.
 Protect SSNs: Restrict the sale, collection, use, sharing, posting, 
        display, and secondary use of Social Security numbers.
 Require more care from creditors: Require creditors to take 
        additional steps to verify the identity of an applicant when 
        there is an indicator of possible ID theft.
 Grant individuals control over their sensitive information: Give 
        individuals rights to control who collects--and who sees--
        sensitive information about them.
 Restrict secondary use of sensitive information: Restrict the use of 
        sensitive personal information for purposes other than the 
        purposes for which it was collected or other uses to which the 
        consumer affirmatively consents.
 Fix FACTA: A consumer should be able to access more of his or her 
        Fair and Accurate Credit Transactions Act (FACTA) rights, such 
        as the extended fraud alert, before becoming an ID theft 
        victim. Further, one of the key FACTA rights is tied to a 
        police report, which victims still report difficulty in getting 
        and using.
 Create strong and broadly-based enforcement: Authorize federal, 
        state, local, and private enforcement of all of these 
        obligations.
 Recognize the role of states: States have pioneered responses to new 
        forms of identity crime and risks to personal privacy. Congress 
        should not inhibit states from putting in place additional 
        identity theft and privacy safeguards.
 Provide resources and tools for law enforcement: Provide funding for 
        law enforcement to pursue multi-jurisdictional crimes promptly 
        and effectively. Law enforcement also may need new tools to 
        promote prompt cooperation from the Social Security 
        Administration and private creditors in connection with 
        identity theft investigations.
    After a very brief discussion of the problem of identity theft, 
each recommendation is discussed.
The problem of identity theft is large and growing
    Current law simply has not protected consumers from identity theft. 
The numbers tell part of the story:

 According to the Federal Trade Commission, 27.3 million Americans 
        have been victims of identity theft in the last five years, 
        costing businesses and financial institutions $48 billion, plus 
        another $5 billion in costs to consumers.
 Commentator Bob Sullivan has estimated that information concerning 
        two million consumers is involved in the security breaches 
        announced over just the six weeks ending April 6, 2005. Is Your 
        Personal Data Next?: Rash of Data Heists Points to Fundamental 
        ID Theft Problem, http://msnbc.msn.com/id/7358558
 Based on a report to the FTC in 2003 which concluded that there were 
        nearly 10 million identity theft victims each year, Consumers 
        Union estimates that every minute 19 more Americans become 
        victims of ID theft.
    These numbers can't begin to describe the stress, financial 
uncertainty, lost work-time productivity and lost family time identity 
theft victims experience. Even financially responsible people who 
routinely pay their bills on time can find themselves in a land of debt 
collector calls, ruined credit and lost opportunities for jobs, 
apartments, and prime credit. With more and more scandals coming out 
every week, the time has come for Congress to act to protect the 
security of our personal information.
Recommendations
Notification:
    Notice of security breaches of information, whether held in 
computerized or paper form, are the beginning, not the end, of a series 
of steps needed to begin to resolve the fundamental conundrum of the 
U.S. information U.S. society: collecting information generates 
revenues or efficiencies for the holder of the information but can pose 
a risk of harm to the persons whose economic and personal lives are 
described by that information.
    The first principle of Fair Information Practices is that there be 
no collection of data about individuals whose very existence is a 
secret from those individuals. A corollary of this must be that when 
the security of a collection of data containing sensitive information 
about an individual is breached, that breach cannot be kept secret from 
the individual. Recognizing the breadth of the information that 
business, government, and others hold about individuals, Consumers 
Union recommends a notice of breach requirement that is strong yet 
covers only ``sensitive'' personal information, including account 
numbers, numbers commonly used as identifiers for credit and similar 
purposes, biometric information, and similar information. This 
sensitive information could open the door to future identity theft, so 
it is vital that people know when this information has been breached.
    Consumers Union supports a notice-of-breach law which does the 
following:

 Covers paper and computerized data
 Covers government and privately-held information
 Does not except encrypted data
 Does not except regulated entities
 Has no loopholes, sometimes called ``safe harbors''
 Is triggered by the acquisition of information by an unauthorized 
        person
 Requires that any law enforcement waiting period must be requested in 
        writing and be based on a serious impediment to the 
        investigation
 Gives consumers who receive a notice of breach access to the federal 
        right to place an extended fraud alert.
    Consumers Union supports S. 751, which contains these elements. S. 
768 contains most, but not all, of these elements and in certain other 
respects provides additional protections.
    Three of these elements are of special importance: covering all 
breaches without exceptions or special weaker rules for particular 
industries, covering data contained on paper as well as on computer, 
and covering data whether or not it is encrypted. First, a ``one rule 
for all breaches'' is the only way to ensure that the notice is 
sufficiently timely to be useful by the consumer for prevention of 
harm. ``One rule for all'' is also the only rule that can avoid a 
factual morass which could make it impossible to determine if a breach 
notice should have been given. By contrast, a weak notice 
recommendation such as the one contained in the guidance issued by the 
bank regulatory agencies 3 cannot create a strong 
marketplace incentive to invest the time, money, and top-level 
executive attention to reduce or eliminate, future breaches.
---------------------------------------------------------------------------
    \3\ That weak recommendation allows a financial institution to 
decide whether or not its customers need to know about a breach, and 
the explanatory material even states that it can reach a conclusion 
that notice is unnecessary without making a full investigation. 
Interagency Guidance on Response Programs for Unauthorized Access to 
Customer Information and Customer Notice, 12 CFR Part 30, 12 CFR Parts 
208 and 225, 12 CFR Part 364, 12 CFR Parts 568 and 570. Other reasons 
why those guidelines are insufficient to substitute for a statutory 
requirement to give notice include that they do not apply to non-
customers about whom the financial institution has sensitive data, that 
there is no direct or express penalty for violation of the guideline, 
and that their case-by-case approach will make it extremely hard to 
determine in which circumstances the guidance actually recommends 
notice to consumers, complicating the process of showing that an 
obligation was unmet.
---------------------------------------------------------------------------
    Second, unauthorized access to paper records, such as hospital 
charts or employee personnel files, are just as likely to expose an 
individual to a risk of identity theft as theft of computer files. 
Third, encryption doesn't protect information from insider theft, and 
the forms of encryption vary widely in their effectiveness. Further, 
even the most effective form of encryption can quickly become worthless 
if it is not adapted to keep up with changes in technology and with new 
tools developed by criminals.
    A requirement to give notice of a security breach elevates the 
issue of information security inside a company. A requirement for 
swift, no-exemption notice of security breaches should create 
reputational and other marketplace incentives for those who hold 
sensitive consumer information to improve their internal security 
practices. For example, California's security breach law has led to 
improved data security in at least two cases. According to news 
reports, after giving its third notice of security breach in fifteen 
months, Wells Fargo Bank ordered a comprehensive review of all its 
information handling practices. The column quoted a memo from Wells 
Fargo's CEO stating in part: ``The results have been enlightening and 
demonstrate a need for additional study, remediation and oversight . . 
. Approximately 70 percent of our remote data has some measure of 
security exposure as stored and managed today.'' 4
---------------------------------------------------------------------------
    \4\ D. Lazarus, ``Wells Boss Frets Over Security,'' S.F. Chronicle, 
Feb. 23, 2005. http://sfgate.com/cgi-bin/article.cgi?file=/c/a/2005/02/
23/BUGBHBFCR11.DTL
---------------------------------------------------------------------------
    In another example, UC Berkeley Chancellor Robert Bigeneau 
announced plans to hire an outside auditor to examine data gathering, 
retention, and security, telling employees: ``I insist that we 
safeguard the personal information we are given as if it were our 
own.'' 5 This announcement followed the second announced 
breach of the security of data held by the University in six months, 
this one involving 100,000 people.6
---------------------------------------------------------------------------
    \5\ ``Cal Laptop Security Put Under Microscope,'' April 6, 2005, 
Inside Bay Area, http://www.insidebayarea.com/searchresults/ci_2642564.
    \6\ Opinion Page, Oakland Tribune, April 5, 2005.
---------------------------------------------------------------------------
    In the Sarbanes-Oxley Act, Congress recognized the importance of 
the ``tone at the top,'' and for that reason took steps to require the 
corporate boards and CEOs work to improve the quality and accuracy of 
audited financial statements. A strong, clear notice of security breach 
law, without exceptions, could similarly focus the attention of top 
management on information security--creating an incentive for a ``tone 
at the top'' to take steps to minimize or eliminate security breaches.
Security:
    Consumers Union supports S. 500 and H.R. 1080, introduced by 
Senator Bill Nelson and Representative Ed Markey, respectively. These 
measures would direct the Federal Trade Commission (FTC)to promulgate 
strong standards for information security and a strong obligation to 
screen customers, both initially and with respect to how those 
customers further protect the information from unauthorized use. They 
also provide for ongoing compliance monitoring by the FTC. S. 768, the 
Schumer/Nelson bill, contains similar provisions.
    If Congress wanted to take even stronger steps with respect to 
information brokers, it could require information brokers to undergo 
annual audits, paid for by the broker and performed by an independent 
auditor retained by the FTC, with specific authority in the FTC to 
require corrective action for security and customer screening 
weaknesses identified in the audit, as well as allowing the FTC to 
specify particular aspects of information security that should be 
included in each such audit.
    Any federal information broker law must require strong protections 
in specific aspects of information security, as well as imposing a 
broad requirement that security in fact be effective and be monitored 
for ongoing effectiveness. Congress must determine the balance between 
the public interest in the protection of data and the business interest 
in the business of information brokering. Security breaches and the 
effects on consumers of the ongoing maintenance of files on most 
Americans by information brokers are issues too important to be 
delegated in full to any regulatory agency.
Access and Correction:
    Two of the basic Fair Information Practices are the right to see 
and the right to correct information held about the consumer. S. 768, 
S. 500, and H.R. 1080 all address these issues. While the Fair Credit 
Reporting Act (FCRA) allows consumers to see and correct their credit 
reports, as defined by FCRA, consumers currently have no legal right to 
see the whole file held on them by an information broker such as 
ChoicePoint and Lexis-Nexis, even though the information in that file 
may have a profound effect on the consumer. There is also lack of 
clarity about what a consumer will be able to see even under the FCRA 
if the information broker has not yet made a report to a potential 
employer or landlord about that consumer.7
---------------------------------------------------------------------------
    \7\ Testimony of Evan Hendricks, Editor/Publisher, Privacy Times 
before the Senate Banking Committee, March 15, 2005, http://
banking.senate.gov/files/hendricks.pdf.
---------------------------------------------------------------------------
    Because the uses of information held by data brokers continue to 
grow and change, affecting consumers in myriad ways, consumers must be 
given the legal right to see all of the information data brokers hold 
on them, and to seek and win prompt correction of that information if 
it is in error.
Protection for SSNs:
    The Social Security number (SSN) has become a de facto national 
identifier in a number of U.S. industries dealing with consumers. Some 
proposals for reform have emphasized consent to the use, sale, sharing 
or posting of Social Security numbers. Consumers Union believes that a 
consent approach will be less effective than a set of rules designed to 
reduce the collection and use of sensitive consumer information.
    Take, for example, an analogy from the recycling mantra: ``Reduce, 
reuse, recycle.'' Just as public policy to promote recycling first 
starts with ``reducing'' the use of materials that could end up in a 
landfill, so protection of sensitive personal information should begin 
with reduction in the collection and use of such information. 
Restrictions on the use of the Social Security number must begin with 
restricting the initial collection of this number to only those 
transactions where the Social Security number is not only necessary, 
but also essential to facilitating the transaction requested by the 
consumer. The same is true for other identifying numbers or information 
that may be called upon as Social Security numbers are relied upon 
less.
    Consumers Union endorses these basic principles for an approach to 
Social Security numbers:

 Ban collection and use of SSNs by private entities or by government 
        except where necessary to a transaction and there is no 
        alternative identifier which will suffice.
 Ban sale, posting, or display of SSNs, including no sale of credit 
        header information containing SSNs. There is no legitimate 
        reason to post or display individuals' Social Security numbers 
        to the public.
 Ban sharing of SSNs, including between affiliates.
 Ban secondary use of SSNs, including within the company which 
        collected them.
 Out of the envelope: ban printing or encoding of SSNs on government 
        and private checks, statements, and the like
 Out of the wallet: ban use of the SSN for government or private 
        identifier, except for Social Security purposes. This includes 
        banning the use of the SSN, or a variation or part of it, for 
        government and private programs such as Medicare, health 
        insurance, driver's licenses or driver's records, and military, 
        student, or employee identification. Any provision banning the 
        printing of SSNs on identifying cards should also prohibit 
        encoding the same information on the card.
 Public records containing SSNs must be redacted before posting.
 There should be no exceptions for regulated entities.
 There should be No exception for business-to-business use of SSNs.
    Congress should also consider whether to impose the same type of 
``responsibility requirements'' on the collection, sale, use, sharing, 
display and posting of other information that could easily evolve into 
a substitute ``national identifier,'' including drivers license number, 
state non-driver information number, biometric information and cell 
phone numbers.
Creditor identity theft prevention obligations:
    Information is stolen because it is valuable. A key part of that 
value is the ability to use the information to gain credit in someone 
else's name. That value exists only because credit granting 
institutions do not check the identity of applicants carefully enough 
to discover identity thieves before credit is granted.
    Financial institutions and other users of consumer credit reports 
and credit scores should be obligated to take affirmative steps to 
establish contact with the consumer before giving credit or allowing 
access to an account when there is an indicator of possible false 
application, account takeover or unauthorized use. The news reports of 
the credit card issued to Clifford J. Dawg, while humorous, illustrate 
a real problem--creditor eagerness to issue credit spurs inadequate 
review of the identity of the applicant.8 When the applicant 
is a dog, this might seem funny, but when the applicant is a thief, 
there are serious consequences for the integrity of the credit 
reporting system and for the consumer whose good name is being ruined.
---------------------------------------------------------------------------
    \8\ Both the news stories about Clifford J. Dawg and a thoughtful 
analysis of the larger problem of too lax identification standards 
applied by creditors is found in C. Hoofnagle, Putting Identity Theft 
on Ice: Freezing Credit Reports to Prevent Lending to Impostors, in 
Securing Privacy in the Information Age (forthcoming from Stanford 
University Press), http://papers.ssrn.com/sol3/
papers.cfm?abstract_id=650162.
---------------------------------------------------------------------------
    As new identifiers evolve, criminals will seek to gain access to 
and use those new identifiers. Thus, any approach to attacking identity 
theft must also impose obligations on those who make that theft 
possible--those who grant credit, goods, or services to imposters 
without taking careful steps to determine with whom they are dealing.
    At minimum, creditors should be required to actually contact the 
applicant to verify that he or she is the true source of an application 
for credit when certain triggering events occur. The triggering events 
should include any of the following circumstances:

 Incomplete match on Social Security number
 Address mismatch between application and credit file
 Erroneous or missing date of birth in application
 Misspellings of name or other material information in application
 Other indicators as practices change
    Under FACTA, the FTC and the federal financial institution 
regulators are charged with developing a set of red flag ``guidelines'' 
to ``identify possible risks'' to customers or to the financial 
institution. However, FACTA stops with the identification of risks. It 
does not require that financial institutions do anything to address 
those risks once identified through the not-yet-released guidelines. 
The presence of a factor identified in the guidelines does not trigger 
a statutory obligation to take more care in determining the true 
identity of the applicant before granting credit. Congress should 
impose a plain, enforceable obligation for creditors to contact the 
consumer to verify that he or she has in fact sought credit when 
certain indicators of potential identity theft are present.
Control for consumers over affiliate-sharing, use of information, use 
        of credit reports and credit scores:
    Consumers are caught between the growth in the collection and 
secondary use of information about them on the one hand and the 
increasing sophistication of criminals in exploiting weaknesses in how 
that information is stored, transported, sold by brokers, shared 
between affiliates, and used to access credit files and credit scores.
    Identity theft has been fueled in part by information-sharing 
between and within companies, the existence of databases that consumers 
don't know about and can't stop their information from being part of, 
the secondary use of information, and the granting of credit based on a 
check of the consumer credit file or credit score without efforts to 
verify the identity of the applicant.9 Consumers Union has 
consistently supported federal and state efforts to give consumers the 
legal right to stop the sharing of their sensitive personal information 
among affiliates. Finally, it is essential to stopping the spread of 
numbers that serve as consumer identifiers that Congress and the states 
impose strong restrictions on the use of sensitive personal information 
for purposes other than the purpose for which the consumer originally 
provided that information.
---------------------------------------------------------------------------
    \9\ Secondary use is use for a purpose other than the purpose for 
which the consumer gave the information.
---------------------------------------------------------------------------
Fix FACTA:
    FACTA has made some things more difficult for identity theft 
victims, according to information provided to Consumers Union by 
nonprofits and professionals who assist identity theft victims. 
Moreover, FACTA gives only limited rights to those who have not yet 
become victims of identity theft, and FACTA fails to offer a pure 
prevention tool for all consumers. A consumer who asserts in good faith 
that he or she is about to become a victim of identity theft gets one 
right under FACTA--the right to place, or renew, a 90 day fraud alert. 
However, this type of alert places lower obligations on the potential 
creditor than the extended alert, which is restricted only to identity 
theft victims.
    A consumer should be able to access more of his or her FACTA 
rights, such as the extended fraud alert, before becoming an identity 
theft victim. One key FACTA right is tied to a police report, which 
victims still report difficulty in getting and using.
    Here are some key ways to make FACTA work for victims:

 Initial fraud alert should be one year, not 90 days
 Extended alert and other victims' rights, other than blocking of 
        information, should be available to all identity theft victims 
        who fill out the FTC ID theft affidavit under penalty of 
        perjury
 Business records should be available to any consumer who fills out 
        the FTC ID theft affidavit under penalty of perjury
 Consumers who receive a notice of security breach should be entitled 
        to place an extended fraud alert
 Consumers who place a fraud alert have the right under FACTA to a 
        free credit report, but this should be made automatic.
    There is also work to do outside of FACTA, including work to 
develop a police report that could be given to victims that is 
sufficiently similar, if not uniform, across jurisdictions, so that the 
victim does not find creditors or businesses in another jurisdiction 
refusing to accept a police report from the victim's home jurisdiction.

Congress must encourage the states to continue to pioneer prompt 
        responses to identity crime:

    Virtually every idea on the table today in the national debate 
about stemming identity theft and protecting consumer privacy comes 
from legislation already enacted by a state. Congress must not cut off 
this source of progress and innovation. Instead, any identity theft and 
consumer privacy legislation in Congress should expressly permit states 
to continue to enact new rights, obligations, and remedies in 
connection with identity theft and consumer privacy to the full extent 
that the state requirements are not inconsistent with the specific 
requirements of federal law.
    Criminals will always be more fast-acting, and fast-adapting, than 
the federal government. An important response to this reality is to 
permit, and indeed encourage, state legislatures to continue to act in 
the areas of identity theft and consumer privacy. Fast-acting states 
can respond to emerging practices that can harm consumers while those 
practices are still regional, before they spread nationwide. For 
example, California enacted its notice of security breach law and other 
significant identity theft protections because identity theft was a 
significant problem in California well before it became, or at least 
was recognized as, a national crime wave.
    Identity theft illustrates how much quicker states act on consumer 
issues than Congress. According to numbers released by the FTC, there 
were 9.9 million annual U.S. victims of identity theft in the year 
before Congress adopted the relatively modest rights for identity theft 
victims found in FACTA. The identity theft provisions adopted by 
Congress in FACTA were modeled on laws already enacted in states such 
as California, Connecticut, Louisiana, Texas, and 
Virginia.10
---------------------------------------------------------------------------
    \10\ See California Civil Code 1785.11.1, 1785.11.2, 1785,16.1; 
Conn. SB 688  9(d), (e), Conn. Gen. Stats.  36a-699; IL Re. Stat. Ch. 
505  2MM; LA Rev. Stat. 9:3568B.1, 9:3568C, 9:3568D, 9:3571.1 (H)-
(L); Tex. Bus. & Comm. Code 20.01(7), 20.031, 20.034-039, 20.04; VA 
Code 18.2-186.31:E.
    The role of the states has also been important in financial issues 
unrelated to identity theft. Here are two examples. In 1986, California 
required that specific information be included in credit card 
solicitations with enactment of the then-titled Areias-Robbins Credit 
Card Full Disclosure Act of 1986. That statute required that every 
credit card solicitation to contain a chart showing the interest rate, 
grace period, and annual fee. 1986 Cal. Stats., Ch. 1397, codified at 
California Civil Code  1748.11. Two years later, Congress chose to 
adopt the same concept in the Federal Fair Credit and Charge Card 
Disclosure Act (FCCCDA), setting standards for credit card 
solicitations, applications and renewals. P. L. 100-583, 102 Stat. 2960 
(Nov. 1, 1988), codified in part at 15 U.S.C. 1637(c) and 1610(e). 
The implementing changes to federal Regulation Z included a model form 
for the federal disclosure box which is quite similar to the form 
required under the pioneering California statute. 54 Fed. Reg. 13855, 
Appendix G.

---------------------------------------------------------------------------
Strong and broadly-based enforcement:

    Consumers need effective enforcement of those obligations and 
restrictions Congress imposes in response to the increasing threats to 
consumer privacy, and of the growth of identity theft. A diversity of 
approaches strengthens enforcement. Each statutory obligation imposed 
by Congress should be enforceable by federal agencies, the federal law 
enforcement structure with the Attorney General and U.S. Attorneys, and 
State Attorneys General. Where a state is structured so that part of 
the job of protecting the public devolves to a local entity, such as a 
District Attorney or City Attorney, those local entities also should be 
empowered to enforce anti-identity theft and privacy measures in local 
civil or, where appropriate, criminal courts.
    There is also a role for a private right of action. It is an 
unfortunate reality in identity theft is that law enforcement resources 
are slim relative to the size of the problem. This makes it 
particularly important that individuals be given a private right of 
action to enforce the obligations owed to them by others who hold their 
information. A private right of action is an important part of any 
enforcement matrix.

Money and tools for law enforcement:

    Even if all the recommended steps are taken, U.S. consumers will 
still need vigorous, well-funded law enforcement. At a meeting convened 
by Senator Feinstein which included some twenty representatives of law 
enforcement, including police departments, sheriffs, and District 
Attorneys, law enforcement uniformly proposed that they be given tools 
to more effectively investigate identity theft. Law enforcement costs 
money, and the law enforcers noted that the multi-jurisdictional nature 
of identify theft increases the costs and time, it takes to investigate 
these crimes.
    Law enforcers in California and Oregon have noted a strong link 
between identity theft crime and methamphetamine. The Riverside County 
Sheriff noted at a March 29, 2005 event that when drug officers close a 
methamphetamine lab, they often find boxes of fake identification ready 
for use in identity theft. The drug team has closed the lab; without 
funding for training and ongoing officer time, there may be no 
investigation of those boxes of identities.
    To prove a charge of attempted identity theft, a prosecutor may 
need to prove that the real person holding a particular driver's 
license number, credit or debit card number, or Social Security number 
is different from the holder of the fake ID. Doing this may require the 
cooperation of a state Department of Motor Vehicles, a financial 
institution, or the Social Security Administration. The public meetings 
of the California High Tech Crimes Advisory Committee have including 
discussion of the difficulties and time delays law enforcement 
investigators encounter in trying to obtain this cooperation. Congress 
should work with law enforcement and groups representing interest in 
civil liberties to craft a solution to verifying victim identity that 
will facilitate investigation of identity theft without infringing on 
the individual privacy of identity theft victims and other individuals.
    Law enforcement may have more specific proposals to enhance their 
effectiveness in fighting identity theft. Consumers Union generally 
supports:

 Funding for regional identity theft law enforcement task forces in 
        highest areas of concentration of victims, and of identity 
        thieves

 Funding for investigation and prosecution

 An obligation on creditors, financial institutions, and the Social 
        Security Administration to provide information about suspected 
        theft-related accounts or numbers to local, state, and federal 
        law enforcement after a simple, well designed, request process
    Consumers Union believes that the time has come for both Congress 
and state legislatures to act to stem identity theft through strong and 
meaningful requirements to tell consumers of security breaches; strong 
and detailed security standards and oversight for information brokers, 
reining in the use of Social Security numbers, increased control for 
consumers over the uses of their information, and obligations on 
creditors to end their role in facilitating identity theft through lack 
of care in credit granting. This should be done without infringing on 
the role of the states, with attention to the need to fund law 
enforcement to fight identity theft, and with attention to the need for 
private enforcement by consumers. We look forward to working with the 
Chair and members of the Committee, and others in Congress, to 
accomplish these changes for U.S. consumers. These recommendations by 
Consumers Union have been informed by the work of victim assistance 
groups, privacy advocates, and others.11
------------
    11 Many law enforcers, victim assistance workers, and 
consumer and privacy advocates were engaged in the issue of identity 
theft prevention long before the most recent ChoicePoint security 
breach came to light. Consumers Union has worked closely for many years 
on efforts to fight identity theft and protect consumer financial 
privacy with other national groups, and with consumer privacy and anti-
identity theft advocates and victim assistance groups based in 
California. Our views and recommendations are strongly informed by the 
experiences of consumers reported to us by the nonprofit Privacy Rights 
Clearinghouse, the nonprofit Identity Theft Resource Center, and others 
who work directly with identity theft victims. These groups have worked 
to develop the state laws that are the basis for many of the proposals 
now being introduced in Congress. Consumers Union is grateful for the 
leadership of the Privacy Rights Clearinghouse in consumer privacy 
policy work, the work of the state PIRGs and U.S.PIRG on consumer 
identity theft rights which includes the preparation of a model state 
identity theft statute in cooperation with Consumers Union, for the 
work for consumers on the accuracy of consumer credit reporting issues 
done over the past decade by the Consumer Federation of America and 
U.S. PIRG, and for the contributions to the policy debate of 
organizations such as the Electronic Privacy Information Center, 
Privacy Times, and others too numerous to mention.

                                 

```