VA Data Loss Could Prompt U.S. Federal Privacy Law

A massive security breach at the U.S. Department of Veterans Affairs (VA) this month may refocus Congress on stalled data breach legislation, some backers of the legislation said.

The VA data theft, involving the unencrypted personal records of 26.5 million military veterans and their spouses, led to a management shakeup at the VA last week. Several members of Congress are calling on colleagues to move ahead with bills that would require breached companies to report losses to affected customers.

More than 10 data breach bills have been introduced in Congress since 2005, but none has made it through in the past year. Congress is scheduled to adjourn for the year in early October, and any bills not passed by then would have to be reintroduced in 2007.

The VA data theft happened May 3 after a break-in at a VA analyst’s home. The analyst had taken home the database of veterans’ names, dates of birth, Social Security numbers, and some health records to work on a project, according to the VA.

Data breaches like the VA’s highlight the need for data breach legislation, Rep. Cliff Stearns, a Florida Republican and sponsor of another data breach-notification bill, said in a statement. Stearns said his bill, which would also require the U.S. Federal Trade Commission to create data-handling rules, “goes to the heart of this problem of the critical need to protect consumers’ personal information.”

Some observers see the VA data theft as a wake-up call for Congress, but that still doesn’t mean that any legislation will pass this year, especially with multiple bills to reconcile, said Ari Schwartz , deputy director at the Center for Democracy and Technology.

“The politics are very complex, and there is not that much time left,” he said.

By Grant Gross, IDG News Service (Washington Bureau)

Follow the whole story. Read Data Theft at the VA.