Sweeping New Privacy Legislation Introduced In Senate
On June 29, 2005, Senators Leahy and Specter introduced Senate legislation designed in part to stop identity and other information theft. The legislation as introduced is very broad and has already generated some protest from various sectors.

One major potion of the bill, the Personal Data Privacy and Security Act, severely restricts sale or distribution of social security numbers. It also prohibits businesses from requiring SSNs except in a few defined circumstances such as obtaining credit reports and applying for a job or apartment.

The bill also requires extensive federal regulation of data brokers. The term data broker is defined to mean any company or nonprofit "collecting, transmitting, or otherwise providing personally identifiable information" of 5000 or more people who are not employees. Winston can already hear the NGOs squealing over these provisions. What will they do about their fund raising, emailing and mass faxing lists?

The bill also requires businesses and individuals acting as sole proprietors to implement a "comprehensive personal data privacy and security program." Mom and Pop may not like these requirements. They would be piled onto the already heavy burden of red tape borne by sole proprietors.

The bill also requires "privacy impact assessments" when federal agencies rely on commercial databases consisting "primarily" of information on U.S. citizens. Winston suspects that if the bill is enacted containing this provision, agency actions will be challenged in court on the ground that the agency's "privacy impact assessment" is inadequate.

Winston does not yet have an opinion on this bill. It is long, and it is also a long way from being enacted. Winston does advise his readers to take a close look at the bill. It would have a significant impact on many different sectors if it is enacted in its current form.