Position Paper: Toward One Strong National Breach Disclosure Law - Justification and Requirements

OUR POSITION IN BRIEF) State laws in the U.S. have been very helpful in illuminating breaches of private information by requiring private disclosure between the organization with the breach and the individual owners of the private information that was breached. Although there are currently no public disclosure requirements, these breaches have often been subsequently reported in the mass media. However, as more states are adopting breach disclosure laws, problems and loopholes are arising that beg a uniform federal law. For instance, state breach disclosure laws do not have uniform requirements so networked organizations must comply separately with each state law - Internet businesses must comply with all state breach disclosure laws. Also state disclosure laws have different triggers and timing that allow organizations to delay or even forgo notification of the same breach in different states. Our position is that a strong national breach disclosure law is needed in the U.S. to provide uniform requirements to all organizations as well as mandating meaningful public disclosure of all breaches. Such a federal law would eliminate compliance problems between different state laws and provide a valuable tracking mechanism for continually improving the protection of private information.