U.S. PIRG Consumer Blog: Big Security Breach--Next Steps Sound Bad

Now that 50 million Americans or more have had their data lost, stolen or sold to thieves by sloppy corporations, you'd think Congress would be gearing up to protect consumers. You'd be wrong. With some exceptions, most of the latest bill drafts seem to be about weakening once-worthwhile proposals and preempting the visionary states where the landmark security breach and security freeze laws have been engineered over the last several years.

Most of the draft bills flying around Capitol Hill look like they've been written with industry interests, not consumer protection, in mind. We're shocked, but not surprised. Just like water wants to flow downhill, Congress wants to legislate, even if it must rationalize passing a bill that makes us worse off than we were before. Don't forget, we're pretty well off now, since many companies are complying nationwide with California's strong disclosure law. Congress could act, but it doesn't need to.

This week, bank, credit card company and other special interests are scurrying around the hill seeking to convince Senators on the powerful Judiciary Committee that any breach legislation must include loopholes and must also eviscerate state authority to enact stronger state laws, else they will oppose it. The same companies that offer us 50 different credit cards (or more) can't deal with 50 state laws? It isn't that they cannot, as they certainly can and can do so easily.

Their goal is more strategic. They are using their whining about patchwork quilts and balkanization for two purposes: first, to enact a lowest-common-denominator (weak) federal bill and second to convince Congress to destroy our federal system by eliminating the ability of state legislatures to participate in the marketplace of public policy ideas. The best part of the federal system is that it is competitive-- there are many ideas to choose from. A system where Congress (along with a few uninspired, mostly captive and certainly unelected federal bureaucrats) comes up with all the ideas is not a good system of government to strive for. States have also demonstrated an ability to respond more quickly to new consumer problems.

Even if balkanization mattered, and it doesn't, the only law the companies that lost our data would really need to deal with is the strongest one-- if they complied with that one, they'd have structural compliance with the rest. What the industry lobbyists are really trying to do is take the states out of the privacy policy and all other policy debates, completely. Such efforts should be opposed, and opposed strongly, by all members who value privacy, clean air, and fair, non-discriminatory lending, among other things.