Slashdot Mirror
The Data Accountability and Trust Act (DATA)
An anonymous reader writes "The U.S. House of Representatives will soon be considering the Data Accountability and Trust Act (DATA). If passed it would require all companies to inform customers of security breaches that affect their personal data. The bill requires consumers to be told if their privacy has been violated because of a breach. Under the proposals, if a breach does occur, a company must notify any customers concerned and the FTC, which can then demand an audit."
Fear not! If the data is "encrypted", they don't have to do anything!
From H.R. 4127
(1) BREACH OF SECURITY- The term `breach of security' means the unauthorized acquisition of data in electronic form containing personal information that establishes a reasonable basis to conclude that there is a significant risk of identity theft to the individual to whom the personal information relates. The encryption of such data, combined with appropriate safeguards of the keys necessary to enable decryption of such data, shall establish a presumption that no such reasonable basis exists. Any such presumption may be rebutted by facts demonstrating that the method of encryption has been or is likely to be compromised.
(4) ENCRYPTION- The term `encryption' means the protection of data in electronic form in storage or in transit using an encryption algorithm implemented within a validated cryptographic module that has been approved by the National Institute of Standards and Technology or another comparable standards body recognized by the Commission, rendering such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data. Such encryption must include appropriate management and safeguards of such keys to protect the integrity of the encryption.
This is going to lead to a certain amount of data hysteria once it gets passed.
Since most people don't know that shit like this happens on a regular basis, once it starts getting reported regularly, the news media is going to pick up and run with it.
"Your information is unsafe" will become a new media theme, along with "kids shooting up schools", "female teachers sleeping with students" and "pretty white girl goes missing".
BTW - businesses cannot go around redefining "breach" or "personal information", because the bill defines exactly what those are.
If you read the text of the bill they've dodged out on specifying some of the trickier parts by using language like "Not later than 270 days after the date of enactment of this Act" to require the definition of certain aspects of the bill. Very poor idea, as it gives the lobbyists something to aim at weakening.
It's sponsored by a Republican from Florida and co-sponsored by a stack of other R's. Good idea, possibly poor implementation.
[Fuck Beta]
o0t!
It doesn't say that! Stop making stuff up.
The term `encryption' means the protection of data in electronic form in storage or in transit using an encryption algorithm implemented within a validated cryptographic module that has been approved by the National Institute of Standards and Technology or another comparable standards body recognized by the Commission, rendering such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data. Such encryption must include appropriate management and safeguards of such keys to protect the integrity of the encryption.
Now perhaps there are encryption algorithms approved by the NIST that you feel are not sufficiently strong - though you haven't given any examples - but to claim that you can use any old encryption algorithm is FUD, pure and simple.
If you don't know where you are going, you will wind up somewhere else.
I don't think it counts as recursive, because the "Data" that is in the name of the act is NOT referring to the acronym "DATA," it's referring to the actual word "Data." To be recursive, an acronym must be self-referential, but this one is not.
If you don't know where you are going, you will wind up somewhere else.
That's nice in theory, but one of the reasons we have government regulation is to help mitigate the asymmetry of power that prevents individuals from ever negotiating contract terms at all with companies that hold their data, much less terms about privacy. This legislation flows from the same river as the FCRA, FDCPA, and FACTA -- it addresses abuses of individual customers (a.k.a. "consumers" or "cattle") by the industry when the market has failed.
I too have felt the cold finger of injustice.