H.R. 2205, the Data Security Act of 2015
The Data Security Act of 2015 (H.R. 2205), introduced by Financial Institutions Subcommittee
Chairman Randy Neugebauer (R-TX) and Representative John Carney (D-DE), would ensure
that all entities that handle sensitive financial and personal information have common-sense
safeguards and processes in place to protect data and provide notice to consumers in the event of
a breach. The Financial Services Data Security Coalition strongly supports this important
consumer protection legislation.
Despite the alarming rise in the number and sophistication of cyber threats, a federal standard to
protect consumer data across the payment system currently does not exist. With the recent data
security breaches at major retailers that have put millions of consumers at risk, the need to pass
legislation to establish such a standard could not be more evident. Protecting consumer
information is a shared responsibility of all parties involved.
H.R. 2205 would apply data security standards and consumer notification requirements to all
industries that handle sensitive information and would provide meaningful and consistent
protection for consumers nationwide. Importantly, the bill does not attempt to take a one-size
fits all approach as it recognizes that any standards should be appropriate for the size and
complexity of the entity.
H.R. 2205 would effectively replace the current patchwork of state and federal regulations for
data breaches with a national law that provides uniform protections across the country. This
comprehensive approach would better serve consumers by making it easier for businesses and
financial institutions to adequately protect all Americans from identity theft and account fraud.
The bill recognizes that it is not necessary or productive to duplicate data protection and
consumer notice requirements that are already in place for financial institutions under the
Gramm-Leach-Bliley Act (GLBA) and subsequent regulations. Banks and credit unions already
have a system in place that protects sensitive customer information and it makes sense to extend
similar requirements to other industries that handle sensitive information.
Our existing payments system serves hundreds of millions of consumers, retailers, financial
institutions and the economy well. Protecting this system is a shared responsibility of all parties
involved and we must work together and invest the necessary resources to combat increasingly
sophisticated threats to the payments system.
The Financial Services Data Security Coalition strongly supports H.R. 2205 and urges Members
of the House to cosponsor this important legislation to ensure that all entities that handle
sensitive financial and personal information protect consumer information and provide notice in
the event of a breach.
May 2015