© 2008, Consumer Data Industry Association Congressional Privacy Policy Panel Stuart K. Pratt

© 2008, Consumer Data Industry Association Congressional Privacy Policy Panel Data Security Data Breach Notification Data Brokers Social Security Numbers

© 2008, Consumer Data Industry Association Congressional Privacy Policy Panel Data Security &Data Breach Notification –These are two core issues which create legislative vehicles for a for broader range of issues related to data use and privacy. –Political complexity makes it difficult to move legislation at the federal level. –Media coverage focused on possible risks to consumers due to breaches. Alleged identity theft risks are often cited.

© 2008, Consumer Data Industry Association Congressional Privacy Policy Panel Data Security &Data Breach Notification –Some of the key questions: What data is to be covered? What standard of security is to be applied? When should a consumer be notified. What rights does a consumer then have?

© 2008, Consumer Data Industry Association Congressional Privacy Policy Panel Data Brokers –Several legislative efforts focused on creating a new regulated entity. –Who/what are data brokers? Human resources departments? Non-FCRA third-party databases? ISPs/Telecommunications? –FCRA-like requirements: Verification of data. Right to dispute and correction.

© 2008, Consumer Data Industry Association Congressional Privacy Policy Panel Data Brokers – Problems with current approaches: –Possible tension with the operation of other federal laws. Examples: Gramm-Leach-Bliley Act Fair Credit Reporting Act –Concerns about the operation of products used to fight identity theft. –Impacts on direct-marketing databases.

© 2008, Consumer Data Industry Association Congressional Privacy Policy Panel Data Security, Breach Notices & Data Brokers – why haven’t these bills moved? –Multiple congressional committees involved. –No one winner has emerged. –Jurisdictional issues not resolved. –Bills become complex and laden with too many issues affecting a wide array of industries.

© 2008, Consumer Data Industry Association Congressional Privacy Policy Panel Data Security, Breach Notices & Data Brokers – why haven’t these bills moved? –Conflicts with the operation of other federal laws not adequately addressed. –States are moved where congress has not. 48 states plus the District of Columbia have a credit freeze law. More than 30 states have enacted data breach notification laws. –FTC investigations of unfairness and deception relative to data security and notification have impacted the marketplace.

© 2008, Consumer Data Industry Association Congressional Privacy Policy Panel Regulation of Social Security Numbers –Paralleling the data security/breach/broker efforts in congress. –Some of the underlying issue drivers are the same. –Some of the same problems with moving legislation. –Not a new issue. Efforts have been ongoing in the states and in the congress since the 1990s.

© 2008, Consumer Data Industry Association Congressional Privacy Policy Panel Regulation of Social Security Numbers –Often characterized as a key to a consumer’s identity. –Concerns about it being used as an method of verifying a consumer’s identity. –A symbol of a consumer’s risk of identity theft.

© 2008, Consumer Data Industry Association Congressional Privacy Policy Panel Regulation of Social Security Numbers Goals vary in terms of proposals: –Prohibit most uses. –Establish a federal regulator (SSA or FTC ) to oversee use of the number. –Create a limited set of permissible uses. –Create incentives to end use of the number over time.

© 2008, Consumer Data Industry Association Congressional Privacy Policy Panel Even in the absence of congressional action, what are the facts regarding identity theft risks?

19.8% N/A © 2008, Consumer Data Industry Association

16.2% N/A © 2008, Consumer Data Industry Association

N/A 11% © 2008, Consumer Data Industry Association

Projected 26% NOTE: Through March 31, Of 8.3 million consumers affected in 1Q 2008, 4.2 million were from one breach – Hannaford supermarkets © 2008, Consumer Data Industry Association

Congressional Privacy Policy Panel A 2006 case study in credit fraud prevention – debunking the myth that fast decisions lead to large-scale true name fraud. –Over 33 million in-store applications are processed by a single lender annually or over 90,000 applications per day. –Approximately 60% of all applications are approved or 19.8 million annually. –There is 1 fraudulent account per 1,613 approved applications. –Total fraudulent applications is 0.06% of the 19.8 million approved applications.

45% N/A © 2008, Consumer Data Industry Association

Congressional Privacy Policy Panel What to expect going forward: –Bills will be introduced again in the next congress. –Many of the same jurisdictional conflicts seen in the past will remain. –Bills will be broad and will be complex with tensions between data security, data breach notification and privacy issues (e.g., data brokers, etc.).

© 2008, Consumer Data Industry Association Congressional Privacy Policy Panel Stuart K. Pratt