Evan Schuman's StorefrontBacktalk

The chairman of the powerful U.S. Senate Judiciary Committee, Sen. Patrick Leahy, is trying—after two failed attempts—to get his data breach bill made into law. But even though his bill would answer the pleas of many retailers by creating one single national standard for handling major retail data breaches, the bill's details don't deliver the comprehensive relief promised. In short, the bill is trying to make it more difficult for major retail chains to hide large data breaches when, in fact, the wording will make it easier for them to hide such breaches.

The core of the bill is where things get a bit dicey. It requires retailers to notify consumers impacted by a breach "without unreasonable delay" but it doesn't say how much time retailers can take. Without that specific, it would seem difficult to enforce the law. Even worse, the exemptions for notification are so broad as to make it unlikely that any retailer would actually be impacted. For example, the bill provides a blanket exemption as long as a chain "provides a written certification to the U.S. Secret Service that providing such notice would impede a criminal investigation or damage national security." The Secret Service then has to perform a review to determine if it's a warranted claim. The problem is that the claim that something might impede a criminal investigation is so broad as to be meaningless.

This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.