United States Draft legislation Personal Businesses that handle Sensitive personally Attorney-General of Lower — — proposed Data Notification & Protection personally identifiable information, the State or the local notification ‘sensitive federal scheme Act identifiable information’ of defined (in summary) as law enforcement threshold with a more than 10,000 an individual’s name in agency on behalf of set time limit, (would replace existing individuals per year must combination with any the residents of the but applies to a laws applying to the notify an individual of a two of the following: agency’s jurisdiction narrower range private sector) security breach of that may bring a civil of information home address, information within 30 days, action telephone number, Applies only to unless there is no mother’s maiden The Federal Trade businesses, not reasonable risk of harm or name or birthday Commission may also government fraud, or the information is various government commence an agencies adequately encrypted identifiers investigation Encryption biometric data provisions similar account identifier to how the draft user name or Bill deals with electronic mail assessing the risk address, in of harm combination with an access code. Exclusion of small businesses would Any combination of an potentially be individual’s name, similar to the account identifier/user Australian name and access Privacy Act. credentials also falls under the definition
United States — proposed federal scheme Draft legislation — Personal Data Notification & Protection Act (would replace existing laws applying to the private sector) Businesses that handle ‘sensitive personally identifiable information’ of more than 10,000 individuals per year must notify an individual of a security breach of that information within 30 days, unless there is no reasonable risk of harm or fraud, or the information is adequately encrypted Sensitive personally identifiable information, defined (in summary) as an individual’s name in combination with any two of the following: home address, telephone number, mother’s maiden name or birthday various government identifiers biometric data account identifier user name or electronic mail address, in combination with an access code. Any combination of an individual’s name, account identifier/user name and access credentials also falls under the definition Attorney-General of the State or the local law enforcement agency on behalf of the residents of the agency’s jurisdiction may bring a civil action The Federal Trade Commission may also commence an investigation Lower notification threshold with a set time limit, but applies to a narrower range of information Applies only to businesses, not government agencies Encryption provisions similar to how the draft Bill deals with assessing the risk of harm Exclusion of small businesses would potentially be similar to the Australian Privacy Act.
Consultation-draft-data-breach-notification-2015-discussion-paper.DOCX