Rep. Yvette Clarke, the Brooklyn, N.Y., Democrat who chairs the House Homeland Security Subcommittee on Emerging Threats, Cybersecurity and Science and Technology, says she hopes to hold hearings on what she calls the National Data Breach Law either later this year or in early 2010.
Clarke envisions legislation allowing the federal government to regulate how the private sector retrieves, transmits, intercepts and stores data to battle the increasing problem of data breaches. In 2005, the Identity Theft Resource Center reported 157 breaches with 66.85 million records exposed. In 2009, through last Tuesday, the center reported 407 breaches and nearly 220.6 million records exposed.
Clarke wants the private sector involved in crafting the regulation of data, and envisions her panel holding a series of hearings to solicit the views of government officials, business leaders and academics. Clarke is sensitive to not hampering innovation, but creating regulations to protect data and systems from criminals and adversaries.
First, Clarke wants Congress to consider updating the 7-year-old Federal Information Security Management Act that regulates how the federal government secures its data and systems, believing that FISMA reform could provide a framework for wider data regulation that she is proposing.
Critics question the effectiveness of government regulation on the private sector, questioning the enforceability. "Like everything else, too much regulation is not helpful," Stanton Sloane, chief executive officer of the information services firm SRA International said. "First of all, too much regulation won't solve the problem. You can regulate whatever you want, but if people aren't able to comply with it or be knowledgeable enough to comply with it, it is kind of pointless."
Stay tuned for further coverage on the proposed data breach regulations.