A House subcommittee has rejected legislative amendments that would have expanded proposed consumer data protections to cover breaches of certain health-related data, National Journal reports (Gruenwald, National Journal, 7/20).
On Wednesday, the House Commerce, Manufacturing and Trade Subcommittee approved a bill (HR 2577) called the Secure and Fortify Electronic Data Act, or the SAFE Data Act. Subcommittee Chair Mary Bono Mack (R-Calif.) sponsored the legislation (Sasso, "Hillicon Valley," The Hill, 7/20).
Details of the Bill
The SAFE Data Act would pre-empt state laws and mandate that companies and organizations take action to secure certain personal data.
According to the bill, companies and organizations would need to notify consumers of a personal data breach within 48 hours if the breach could lead to identity theft or other harm (National Journal, 7/20).
According to Democrats, the bill would require notification if the breach exposed a consumer's name, phone number or credit card number along with a Social Security number, driver's license number or other government identification. The bill would not require notification if the breach exposed only a Social Security number, credit card number or bank account number without any other personal data (Gross, Computerworld, 7/20).
Amendments on Health-Related Data
The House subcommittee rejected several amendments to the bill proposed by Democratic lawmakers. Democrats attempted to broaden the protections in the SAFE Data Act by expanding the definition of personal data to include information such as:
- Online searches for medical data; and
- Records of over-the-counter drug purchases (National Journal, 7/20).
Rep. Henry Waxman (D-Calif.) expressed concern that the bill could pre-empt a California law that designates over-the-counter drug purchasing data as sensitive information (Eggerton, Broadcasting & Cable, 7/20). Waxman said, "If this data [are] breached, people want to know about it" (National Journal, 7/20).
Bono Mack said that protecting health information is an important issue but that it is not relevant to the purposes of the bill, which focuses on data security rather than privacy (Broadcasting & Cable, 7/20).
The bill now goes to the full House Energy and Commerce Committee ("Hillicon Valley," The Hill, 7/20).