States Move Forward on
Data Protection and Other Bills

Federal Legislation Potentially Stalled

Data protection legislation continues to be an issue of concern for state legislatures across the country. Fourteen states – Alaska, Arizona, Hawaii, Iowa, Indiana, Illinois, Kentucky, Missouri, Nebraska, New Hampshire, New York, Rhode Island, Virginia, and Vermont – have introduced one or more bills related to data privacy, and most are similar to the 2003 California data protection bill. These bills would not affect Kids in the Know members due to their definition of personal information (an individual’s first name or first initial and last name in combination with one or more of the following elements: social security number, driver’s license number, or credit card number or account number). In addition, the bills state that “personal information” does not include information available to the general public. Kentucky’s proposed legislation, however, has a very broad definition of personal information – including address, e-mail address, and birth date – but would not affect Kids in the Know members due to a clause stating the law would not apply when an individual had voluntarily consented to have the information publicly disseminated or listed.

Data protection bills are not the only privacy related bills being debated in the states. The New Jersey and Virginia legislatures have introduced legislation regarding administering surveys to students in schools.

In both states, the bills would only apply to surveys that include questions about political affiliations, sexual behavior and attitudes, social security numbers, or family income. The New Jersey legislation also states that students cannot participate in voluntary surveys that include questions on these issues unless the school district sends prior written notification to the student’s parents. We will continue to monitor New Jersey, Virginia and other states for bills of this nature.


Federal Legislation

There have recently been rumblings for the first time that no federal legislation may actually be passed this year on this issue. As Congress Daily AM noted, "All sides concede it might be tough to pass a measure this year because of the difficulty of resolving jurisdictional spats and a legislative calendar shortened by an election year."

Overall discussions were triggered by a manager's amendment that was submitted to a bill in the House Energy and Commerce Committee introduced by longtime privacy advocate Rep. Cliff Stearns (R-FL). The legislation, the Data Accountability and Trust Act, was passed out of the Subcommittee late last year. The amendment would modify the standard for notifying consumers of a security breach from a "significant" risk of ID theft to a "reasonable" risk. The bill is still not likely to have an impact on Kids in the Know members due to the way they define "personal information" as name plus social security number, drivers license number, or financial account number.

There has been no further action on the three data protection bills that were placed on the Senate calendar - Personal Data Privacy and Security Act, Notification of Risk to Personal Data Act, and the Identity Theft Protection Act. The legislative schedule for debating these bills remains unclear at this point.

We will continue to monitor the legislation both in Congress and in the state legislatures and keep you informed on all future actions.