Unlike all the weak "industry-approved" triggers that variously give the company that lost data the authority to decide whether it has reason to believe that there may be some or substantial or reasonable risk, Specter-Leahy requires notice by companies unless they can show "no risk." Also, Specter-Leahy gives consumers privacy rights against data brokers like ChoicePoint. Most bills skip this important step (see previous blog Cutting The Privacy Baby In Half). Here's our letter on S 1789 to the committee. Also, last week I testified (summary) before the state of Vermont on security breaches. Vermont is one of the leading state laboratories of privacy democracy.