WASHINGTON – Yesterday, the House Energy and Commerce Subcommittee on Commerce, Manufacturing and Trade held a hearing to discuss draft legislation titled “Data Security and Breach Notification Act of 2015.”

The draft legislation aims to enact a national data breach notification standard that preempts existing state law. NACS has been working closely with policymakers to ensure that any data security and consumer notification standards are fair and apply to all parties equally. As part of this ongoing effort, NACS submitted written testimony for the hearing, available here.

Wednesday’s hearing consisted of two panels of witnesses: The first included officials from the Federal Trade Commission (FTC) and Federal Communications Commission (FCC) and the second included the Assistant Attorney General for the state of Massachusetts and representatives of the National Retail Federation, 21st Century Privacy Coalition, Open Technology Institute and Information Technology Industry Council.

The FTC witness expressed concern over the draft legislation, noting that its definition of “personal information” fails to protect certain information that is currently protected under state law, a concern echoed by the consumer groups and Massachusetts Assistant Attorney General. The only witness in favor of the legislation as written was Jon Leibowitz of the 21st Century Privacy Coalition. 

The day before the hearing, health insurer Premera Blue Cross became the latest data breach victim as it announced it experienced a cyberattack potentially affecting 11 million of its customers. This breach was referenced throughout the hearing, and as data breaches continue to occur, Congress will almost certainly continue to pay attention to this issue. Both chambers of Congress have already held multiple hearings on this topic, with more likely to come.