Privacy Digest

ID Task Force Ideas Receive Cool Reception - washingtonpost.com: "A federal task force Monday urged the Bush administration to back certain policy proposals to help combat identity theft, but critics say the recommendations will do little to curb the loss or needless collection of sensitive consumer data.

President Bush's Identity Theft Task Force, co-chaired by Attorney General Alberto Gonzales and Federal Trade Commission Chairman Deborah Platt Majoras, called for a review at the state and federal level of the use of Social Security numbers in consumer records. The panel also broadly supported national standards for requiring organizations to notify consumers if they experience a data breach or loss that jeopardizes personal or financial data. Thirty-five states have data breach disclosure laws. Lawmakers on Capitol Hill are drafting and circulating similar measures.

"Identity thieves steal consumers' time, money and security, just as sure as they steal their identifying information, and they cost businesses enormous sums," Majoras said in a written statement. "The strategic plan submitted to the president provides a blueprint for increased federal prevention and protection."

Consumer groups were unimpressed with the group's suggestions, which also called for a broader sharing of victim data among state and local identity theft investigators, and amending existing criminal statutes to allow stricter punishment for identity thieves.

Marc Rotenberg of the Electronic Privacy Information Center said the task force's recommendations would create a framework for a weak national privacy law.

"It really seems like the focus of these recommendations is what to do about the crime of identity theft after it occurs, rather than creating a comprehensive approach that would minimize the risk of the crime itself," said Rotenberg, who is executive director the Washington-based policy group. "We really have to go after those practicing bad data practices with the same energy we're willing to use against those who commit identity theft.

The task force said a federal data breach notification law should supersede state laws, and require notification only when there is a significant risk of identity theft due to the loss or compromise of sensitive data. For example, if a victim's Social Security number or driver's license was stolen in tandem with identifying information like the victim's name and address. The panel also said such a law should not create or provide a right for identity theft victims to sue organizations that lose control over consumer data.

Ari Schwartz, deputy director at the Center for Democracy and Technology, noted that federal agencies already are required under a 1974 privacy law to limit the storage and use of Social Security numbers, but added that the Bush administration has failed to consistently enforce it.

"

(Read Original Article.)