Data security bills await action in U.S. Senate--again.

• Position: INFO SECURITY

The recent Target and Neiman Marcus breaches have drawn a good deal of attention and provided extra fuel for the introduction of two bills in the U.S. Senate in early January.

Sen. Patrick Leahy (D-Vt.) cited the breaches when reintroducing S. 1897--Personal Data Privacy and Security Act of 2014. The legislation would update the Computer Fraud and Abuse Act (CFAA) to allow the U.S. Justice Department to prosecute "significant" attempts of computer hacking and conspiracy to commit computer hacking.

Key provisions in the bill include:

* Tough criminal penalties for individuals who intentionally or willfully conceal a security breach involving personal data when the breach causes economic damage to consumers

* A requirement for companies that maintain personal data to establish and implement internal policies to protect data privacy and security

The U.S. attorney general would also be required to report annually to Congress the number of criminal cases filed under the CFAA that were based solely on the defendant either accessing a nongovernmental computer without authorization or exceeding authorized access.

Leahy first introduced the bill in 2005 and has reintroduced it in the last four congressional sessions.

Less than two weeks later, Senators Roy Blunt (R-Mo.) and Tom Carper (D-Del.) introduced S. 1927 --Data Security Act (DSA) of 2014. This bill would replace a patchwork of state laws with a single set of requirements for...