Senate Democrats, led by Senate Judiciary Committee Ranking Member Patrick Leahy of Vermont, introduced legislation on April 30, 2015 directed to online consumer privacy and data protection. The Consumer Privacy and Protection Act of 2015, one of multiple proposals before Congress this year, requires companies storing sensitive personal or financial information on 10,000 or more U.S. customers in a twelve month period to provide notice of security breaches affecting customers within thirty days. Of note, the proposed legislation protects not just personal identifying and financial information (such as driver’s license and credit card numbers), but also password-protected digital photographs, videos and communications. Interestingly, while the Act would supersede state laws mandating less stringent data security practices, stronger state laws would not be preempted. As the Act would not impose a national standard for notice following a data breach, opposition to the legislation will likely focus on the challenges businesses face complying with state-by-state notice requirements. We will continue to monitor the various legislative proposals that could affect covered businesses.
