WASHINGTON – Yesterday, the House Financial Services Committee held a hearing entitled “Protecting Consumers: Financial Data Security in the Age of Computer Hackers.” The hearing focused on actions Congress can take to enhance data security and overall consumer protection. Additionally, members of Congress discussed the technologies designed to mitigate data breaches and fraud, including Chip-and-PIN, encryption and tokenization.

Committee members heard from a large panel of witnesses – all of whom generally supported a federal data breach notification standard – that included representatives of the Financial Services Roundtable, the Retail Industry Leaders Association (RILA), the Electronic Transactions Association, the PCI Security Standards Council and the Open Technology Institute.

During the hearing, there was a brief discussion of H.R. 2205: The Data Security Act of 2015, which was recently introduced by Representatives Randy Neugebauer (R-TX) and John Carney (D-DE), but the majority of the hearing centered on whether PIN authentication actually prevents fraud and the extent to which different entities involved in the payments chain cover fraud costs. 

Specifically, Brian Dodge, RILA’s Executive Vice President had to continually reiterate to lawmakers that despite contentions by the financial services witnesses that banks pay for almost all fraud costs, retailers in fact shoulder immense fraud costs. Dodge stressed to lawmakers that retailers cover fraud costs several times over: they prepay for fraud via swipe fees and are also subject to chargebacks, card reissuance and other related costs after a data breach has occurred.

Data security and data breach notification continues to be a pressing issue on Capitol Hill. Last month, the House Energy and Commerce Committee marked up and favorably reported H.R. 1770: the Data Security and Breach Notification Act of 2015 although it is unclear when that bill will be considered by the full House of Representatives. In the Senate, meanwhile, there are currently four data security and breach bills. It is not certain when the Senate bills will begin to move. At the same time, Senator Mark Warner (D-VA) may soon introduce legislation that NACS supports — that legislation would cover everyone in the payments chain and not exempt favored industries.