A variety of technology vendors, consumer advocacy groups and privacy groups have
been calling for Congress to pass a comprehensive federal data-breach notification
bill for a number of years now. Several bills have been introduced in both the House
and the Senate in recent years, but none has made it to the president's desk yet.

The Senate Judiciary Committee on Thursday approved two different bills, each of
which would mandate that organizations that store consumers' sensitive data notify
consumers if that data is breached. Senate bill 139 would require "Federal agencies,
and persons engaged in interstate commerce, in possession of data containing
sensitive personally identifiable information, to disclose any breach of such information."
The language in the bill is quite similar to that in existing state notification bills,
including the landmark California Senate bill 1386.

There are several significant sections in S. 139, also known as the Data Breach
Notification Act, which was introduced by Dianne Feinstein of California. Most importantly,
federal agencies and other organizations subject to the bill would not have to disclose a
breach if the data involved in the breach was encrypted. This is a clause that has caused
some controversy, as some experts say that simply encrypting data does not render it
useless.

Also, the Data Breach Notification Act would grant an exemption for data that "was
rendered indecipherable through the use of best practices or methods, such as redaction,
access controls, or other such mechanisms, that are widely accepted as an effective industry
practice, or an effective industry standard."

That is a very broad exemption that could become a sticking point as the bill moves along.
The terms "access controls" and "other such mechanisms" encompass a huge number of
technologies.

The other breach-notification bill, known as the Personal Data Privacy and Security Act,
deals more with federal law and potential punishment than with breaches themselves.
The bill, sponsored by Patrick Leahy of Vermont, would establish a fine and a jail term
of up to five years for failing to disclose a breach when required.