Slashdot Mirror
Gridlock In Action: Retailers Demand New Regulations To Protect Consumers
chicksdaddy writes: How bad is the gridlock in Washington D.C.? So bad that the nation's retailers are calling for federal legislation on cyber security and data protection to protect consumer information — even though they would bear the brunt of whatever legislation is passed. The Security Ledger notes that groups representing many of the nation's retailers sent a letter (PDF) to Congressional leaders last week urging them to pass federal data protection legislation that sets clear rules for businesses serving consumers.
"The recent spate of news stories about data security incidents raises concerns for all American consumers and for the businesses with which they frequently interact," the letter reads. "A single federal law applying to all breached entities would ensure clear, concise and consistent notices to all affected consumers regardless of where they live or where the breach occurs."
Retailers would likely bear the brunt of a new federal data protection law. The motivation for pushing for one anyway may be simplicity. Currently, there are 47 different state-based security breach notification laws, as well as laws in the District of Columbia and Guam. There is broad, bi-partisan agreement on the need for a data breach and consumer protection law. However, small differences of opinion on its scope and provisions, exacerbated by political gridlock in Congress since 2010 have combined to stay the federal government's hand. Meanwhile, reader schwit1 points out that banks are now starting to demand that retailers pay for all the financial damage their security breaches cause.
"The recent spate of news stories about data security incidents raises concerns for all American consumers and for the businesses with which they frequently interact," the letter reads. "A single federal law applying to all breached entities would ensure clear, concise and consistent notices to all affected consumers regardless of where they live or where the breach occurs."
Retailers would likely bear the brunt of a new federal data protection law. The motivation for pushing for one anyway may be simplicity. Currently, there are 47 different state-based security breach notification laws, as well as laws in the District of Columbia and Guam. There is broad, bi-partisan agreement on the need for a data breach and consumer protection law. However, small differences of opinion on its scope and provisions, exacerbated by political gridlock in Congress since 2010 have combined to stay the federal government's hand. Meanwhile, reader schwit1 points out that banks are now starting to demand that retailers pay for all the financial damage their security breaches cause.
I think this is just CYA. The government will set a minimum standard of security which the retailers will set as their default level and that way when a breach happens they can say, well we followed the government mandates, we should not be sued. This is not for the customers, it is for the retailers.
In reality they should be securing their systems to the best of their ability.
When you cant win, ad hominem.
What's this got to do with traffic problems?
Regulations protect corporations!!
Regulations protect corporations!!
Regulations protect corporations!!
Regulations protect corporations!!
Say NO to regulation!!!
>> gridlock...nation's retailers
Er...lobbiest fails to do job, so panic?
>> they would bear the brunt of whatever legislation is passed....there are 47 different state-based security breach notification laws
In other words, they want a single Federal law to replace all the state laws, which would do two things: 1) allow them to concentrate their efforts on watering down the federal law 2) take the ability for people to collect damages against it out of state courts and 3) reduce their notification costs because they would only do the bare minimum required by the federal law (e.g., filing it in a basement drawer marked with "beware the leopard"). I see no "brunt" here. (IANAL)
Translation: Please pass a law that dictates the minimum effort we are required to put forward so we can barely meet that very low bar and not get sued. As it is, we have to actually pay attention to security and update constantly. If you pass a law, it will be out of date in about 3 months... but hey! At least we can't get sued. And that's all that really matters.
This consumer protection stuff is just more liberalati socialistic hogwash.
First, they'll want to regulate the hackers, next thing you know they'll be sending jack booted thugs to take your sons and daughters to FEMA homo training camps.
Wake Up America!
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Hmm, are they possibly starting to take computer and electronic security seriously? Not holding my breath, but maybe, just maybe they should throw some of that money at the security folk, rather than lobbyists. Might have a better ROI.
We don't need to pass legislation to ensure retailers have decent security. Europe already has it figured out. You put chips in your credit cards, and your credit card never leaves your sight when paying at a restaurant, etc. *That* would eliminate far more problems than making retailers promise to have good security, which in reality will never be good enough.
This isn't (just) about trying to dodge liability by having defined standards to meet.
The big retailers are all spending shitloads of money on security because they have to. Now they want regulations that require everyone else to do the same.
A few million each year for security compliance is nothing to Target or Walmart. It is a dagger in the heart of their local and regional competition.
See that "Preview" button?
They sent a letter demanding more regulation?
Isn't there already legislation and requirements for this stuff already?
Why now with the stroke of a magic pen will things be fixed?
The banks are not the point of contact for the consumer ... the retailer is. Banks AND retailers want the retailer to bear the cost so the retailer can pass it on to the consumer.
Consumers, in one form or another, will be responsible for breaches.
It little behooves the best of us to comment on the rest of us.
Gridlock? Yes, the democrat Senate has prevented many bipartisan House bills from passing. It will be good to see the Senate in the hands of the GOP. Hopefully Obama won't continue the gridlock by vetoing bills.
When I saw the first three words of the headline, I thought it was going to be about this fucktard.
"Net Neutrality" is Obamacare for the Internet; the Internet should not operate at the speed of government.
Senator Ted Cruz, TX
What an absolutely fucking disgusting display of "If Obama is for it, I'm against it."
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Consumers don't properly appreciate cyber security. Nor do stockholders. This makes it difficult to justify the expense of proper security. But if it is a legal requirement, then you can do it.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
Because really, who wants to deal with 47 different state laws when you can just have one federal law? At the very least, it would save their legal departments a lot of headaches.
Just turn NFC back on while you wait for CurrentC to get off the ground and be tested sometime next year. It's already on your registers, and some of the NFC vendors have high-grade security that sharply reduces the risk of credit card breaches.
If we make the lenders liable for all the damage caused by them. We don't even need any new laws for this. The lender has all the right to be very lax and extend credit to any Tom Dick or Harry. But if they are going to report to credit reporting agencies about default or missed payments, they have to prove that the credit was extended to the correct person. If they mistakenly report missed payments on the victim of identity thefts, the banks should be fully liable for all the damage caused to the innocent party.
The banks are the worst. They extend credit without checking. They destroyed the cheap Point-of-sale pin encoded debit/ATM transactions by conflating it with credit transactions. Merchants who used to pay a flat fees of 25 cents or so per transactions are being saddled with 2%.
The financial sector has gone from less than 5% of S&P500 index to 15% of the index. From all the economic activity going on in the country the banks rake in more than 50% of the profits. Companies that take the risk and actually make products make much less money than the the banks.
The banks have grown too big to fail, too big to jail.
All the talk about government must be small misses a crucial point. The moment the government becomes smaller than the most powerful person, that person would drown the government in a bath tub. The courts have ruled corporations are people. Now corporations are actively drowning the government in a bathtub. The banks are at the forefront. If we don't realize and and reign in the banks, we are doomed.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The gridlock has been so bad that the American public has voted to fix it. Yay!
The cost of fraud and security is built in to the interchange rates that make up the bulk of card-present fees from Visa et al. By and large, the retailers already cover those costs. If specific retailer-focussed fines are put in place they should be accompanied by a drop in interchange rates (not going to hold my breath here). Also, by reducing cost-sharing and increasing self-insurance, that's another way of squeezing out smaller merchants (who can't begin to cover those costs) in favor of the larger ones (who don't need external underwriting to do so).
You're special forces then? That's great! I just love your olympics!
Good regulations are good for business because they establish the ground rules of the game. Good regulations also give business a good legal defense. However, waiting until the day after Republicans had taken control of the Congress before releasing this letter is fairly suspicious. It has the appearance of shopping for regulators in the hopes that any consumer protections passed by a Republican Congress will be weak and ineffective.
If you think any business is asking for new regulation with an eye towards helping consumers, I have a bridge to sell you.
The hope is that the federal law, because it can be lobbied heavily, will be weaker than the individual state laws. Even if not, it will make compliance easier (1 reg to go against vs. 47 with differing requirements).
Now that the Rs are in power, it's time to Obama to lean in and take one (or ten) for the team. Everything that's good, come out against it; everything that's bad, say you support it. The Rs will slavishly oppose and BAM! Progress.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
> and Guam
"Oh no! Someone took the credit card receipts from the grocery's trash! Well, according to Guam law, we must notify consumers."
(Opens window). "Hey, Frank! Charlie took your credit card receipt! Oh, and Paul, get your damned chickens off the runway!"
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
The summary claims that the retailers would bear the brunt of the legislation. The opposite is true. The letter is written by retailers, asking for increased regulation of cloud providers and banks. The letter is specifically calls out Apple and J.P. Morgan as the causes of recent data breaches. It complains that the retailers are responsible for notifying their customers of breaches, but they aren't the only link in the chain.
there are 47 different state-based security breach notification laws
These retailers should be careful what they wish for. One of the main problems with health insurance used to be that every state had its own set of laws and licensing. Now that the feds took over the regulation of it they not only require everyone buy it but also dictate coverage levels, like it or not.
"We don't mind paying a lot for things like this as long as all of our competitors have to pay about the same as well. If none of our competitors can skimp out on these costs, we can all just raise prices and if the consumer really wants or needs the items we sell, he will buy them and he will absorb the cost."
Am I the only one that read the title as Retail stores in Washington, D.C. upset about traffic congestion, beg Congress to fund traffic improvements so people can get to their stores and buy stuff.
... of why libertarians are wrong about the role of governments.
Free markets are nothing that comes about naturally. It is the governments that create the regulatory framework that allows for free markets to function.
Business hurt when governments fail in this most important job.
Here we see people clamoring for government regulation of tech issues after numerous stories on that same government's lack of understanding of tech issues. Really?
If the banks charge the retailer that suffered the breach for the damages resulting from the breach, then only the offenders suffer rather than making everyone suffer under onerous and ill-conceived regulations. Not to mention that charging for the damages from a breach means the punishment will actually fit the crime. Further, punishing a single guilty retailer for a breach means the customers can go to another retailer that is not having to raise prices to cover a breach fine, which is even more incentive for a company to protect against a breach in the first place.
And all this takes place without the need for 2000 pages of regulation that nobody will be able to understand and no risk of unintended consequences resulting from it that nobody can fix because of the same gridlock the article summary complains about.
It's like that scene in Kill Bill where Budd's manager tells him that "fucking with your cash is the only thing you kids seem to understand."
But wouldn't a lot of these problems go away if people started using CASH when they go to a brick-and-mortar to shop? I know retailers and such wouldn't like it, since they couldn't track individual customers nearly as well. But them tracking my habits isn't my problem.
If the Brain dead Bankers would think instead of putting things like peoples social security number and other personal data on the cards, things would improve immensely. I agree, this is just a way for banks and retailer to not be sued.