House Democrats and Republicans split sharply yesterday over how to best protect consumers' personal data, as legislation to curb the persistent scourge of identity theft and fraud began to move on a fast track on Capitol Hill.
In a 13 to 8 vote along party lines, a subcommittee of the House Energy and Commerce Committee approved a bill that would require information brokers to submit plans for safeguarding private data to the Federal Trade Commission for monitoring and review.
The bill also would establish the first nationwide requirement for notification of consumers when certain breaches of data occur and would force brokers to submit to security audits if their data banks are compromised.
But Democrats on the panel said the bill was filled with loopholes and would leave consumers less protected than they are now. They also accused the Republicans of shutting them out of bipartisan negotiations, and of making last-minute changes to agreed-upon provisions.
Under the bill, data brokers and other firms that store consumer data would have to notify consumers that their information was breached only when it was determined that a "significant risk" of identity theft or other fraud might result.
That decision would be made by the company that was breached, which Democrats said was akin to having to no requirement at all.
This year alone, tens of millions of consumers have been notified of breaches at information brokers such as ChoicePoint Inc. and LexisNexis, financial institutions, government agencies, universities, online retailers and other firms.
Many notices were sent out under a California law that covers any firm doing business in the state.
"No notices would have gone out under the standard put forth in this bill," which would preempt state laws, said Rep. Janice D. Schakowsky (D-Ill.). "We would not have known how badly corporations treat personal information, nor would consumers have been able to take action to protect themselves -- even from financial identity theft -- if this bill had been in place in February 2005."
Data brokers, direct marketers, financial institutions and several large technology companies supported the approach of the bill, as did FTC Chairman Deborah P. Majoras. They argue that thieves or hackers cannot always use data they might gain access to, and that bombarding consumers with notices every time a breach occurs would cause people to ignore them.
"That concern is disingenuous," Schakowsky said yesterday. "The right response to over-notification is not to restrict information and to keep consumers and Congress in the dark. If we want to stop over-notification, then corporations need to clean up their act so consumers' personal information is not compromised in the first place."
Forty-seven state attorneys general urged stricter notification rules.
Democrats also criticized the removal of a provision in an earlier version of the bill that would have allowed consumers to examine what data about them is held by brokers, and to have the right to challenge the accuracy of the information.
"What if it's wrong?" asked Rep. Edward J. Markey (D-Mass). "People have a right to know." Amendments on that and other issues were turned back by Republicans.
Rep. Cliff Stearns (R-Fla.), who heads the subcommittee and is chief sponsor of the bill, said the provision was removed because it more properly should be considered as part of a privacy bill to be taken up early next year.
Democrats said the bill also is flawed because it would prevent state attorneys general from enforcing it, putting all the burden on the FTC. The bill would give the FTC $1 million a year for enforcement.
A spokesman for Rep. Joe Barton (R-Tex.) , chairman of the full Energy and Commerce Committee, said negotiations broke down when Democrats reversed field on the "core concept" of the bill.
Barton said there is still time for compromise before the bill passes through the full Energy and Commerce Committee.
But he said he wants the bill passed by the House this year. There has been no consensus on a Senate version of the bill.