Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Compliance

D.C. Council Passes Data Security Legislation

The Council of the District of Columbia on Tuesday unanimously passed a bill whose goal is to expand data breach notification requirements and improve the way organizations protect personal information.

The Council of the District of Columbia on Tuesday unanimously passed a bill whose goal is to expand data breach notification requirements and improve the way organizations protect personal information.

Introduced in March 2019 by the Office of the Attorney General (OAG) for the District of Columbia, the Security Breach Protection Amendment Act of 2019 expands the types of information for which companies are held accountable.

Existing legislation covers social security numbers, payment card details, and driver’s license numbers. The new bill adds passport numbers, military IDs, biometric data, health information, taxpayer identification numbers, health insurance information, and genetic information and DNA profiles to that list.

The new legislation also requires companies to implement measures for protecting personal information, it specifies new reporting requirements for companies whose systems have been breached, and requires firms to provide free identity protection services for 18 months if they expose social security numbers.

“This law brings the District of Columbia into the vanguard of state and local governments that have required companies collecting vast amounts of personal information to take appropriate precautions that safeguard consumers’ health, financial, and other data,” said D.C. Attorney General Karl Racine. “And because laws without enforcement and accountability are toothless, OAG’s Security Breach Protection Amendment Act strengthens the District’s ability to hold companies responsible if they fail to implement reasonable protections for D.C. residents.”

A representative of the OAG told SecurityWeek that the council will now send the bill to the mayor, who has 10 days to either sign the legislation or veto it. If no action is taken during those 10 days, the bill moves forward and is sent to Congress for a 30-day review period — D.C. laws must pass through Congress due to the District’s lack of autonomy. The bill will officially become law if the House and Senate approve it or if no action is taken during the 30-day period.

If the bill becomes law, companies that don’t follow the rules face lawsuits by the OAG or private individuals.

Related: US Congress Passes Bill Funding ‘Rip and Replace’ for Huawei Gear

Advertisement. Scroll to continue reading.

Related: Bill to Protect U.S. Energy Grid From Cyberattacks Passes With NDAA

Related: House Committee Passes Bills Improving CISA Leadership and Authority

Related: Senate Passes DHS Cyber Hunt and Incident Response Teams Act

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

CISO Strategy

SecurityWeek spoke with more than 300 cybersecurity experts to see what is bubbling beneath the surface, and examine how those evolving threats will present...

CISO Conversations

Joanna Burkey, CISO at HP, and Kevin Cross, CISO at Dell, discuss how the role of a CISO is different for a multinational corporation...

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

CISO Conversations

In this issue of CISO Conversations we talk to two CISOs about solving the CISO/CIO conflict by combining the roles under one person.

CISO Strategy

Security professionals understand the need for resilience in their company’s security posture, but often fail to build their own psychological resilience to stress.