Senator Schumer to Propose Identity Theft Bill

March 2005

New identity theft legislation will be proposed by Senator Charles Schumer (D-NY) that would create an Office of Identity Theft in the FTC with jurisdiction over companies dealing in personal consumer data, Schumer said today in a statement to the Senate Banking Committee. The new legislation would also require web sites that collect personal data to give consumers a "clear warning in simple language" if they plan to sell that information, as well as forcing companies to demonstrate a need for customers' personal information before requiring it.

"In my mind," said Schumer, "what bank robbery was to the Depression Era, identity theft is to the Information Age."

Schumer's statement came at a Banking Committee hearing on "Identity Theft: Recent Developments Involving the Security of Sensitive Consumer Information." The hearing was the first of several Senate committee hearings on identity theft announced in the wake of a string of large-scale compromises of personal consumer data — including the loss by Bank of America of computer data tapes containing Social Security numbers, account data, and other personal information on an estimated 1.2 million federal employees, including 60 members of the U.S. Senate.

Citing other high-profile incidents involving DSW, ChoicePoint, Lexis-Nexis, and Westlaw, Schumer decried "recent examples of egregious loopholes which are compromising people's personal information."

"We in the Congress need to learn the lessons of Choice Point and Westlaw," said Schumer. "We need to replace the current patchwork of state and federal laws with a real security blanket — one that protects privacy, keeps Social Security numbers private, and prevents fraud and identity theft."

"It is high time for Congress to fill the breach that hackers, thieves, and the Internet have combined to create — leaving consumers vulnerable and costing our economy billions."

The text of Senator Schumer's statement appears below.

Prepared Statement of Senator Charles Schumer for Senate Banking Committee: "Identity Theft: Recent Developments Involving the Security of Sensitive Consumer Information."

I want to thank you Chairman Shelby and Ranking Member Sarbanes for holding this timely hearing to discuss the numerous and alarming developments in the area of privacy and the protection of personal data in recent weeks.

In my mind, what bank robbery was to the Depression Era, identity theft is to the Information Age.

• Identity theft costs consumers and businesses an estimated 5 billion dollars per year.
• The typical identity theft victim has to spend about 175 hours to clear up his or her credit report.

We in the Congress need to learn the lessons of Choice Point and Westlaw. We need to replace the current patchwork of state and federal laws with a real security blanket — one that protects privacy, keeps Social Security numbers private, and prevents fraud and identity theft.

That is why I intend to introduce comprehensive privacy legislation next week.

Right now:

• There is no arm of the federal government that has clear jurisdiction over online and offline identity theft.
• Companies seeking to obtain personal data from customers are subject to few, if any limitations.
• Customers have no idea if or when a company might transfer personal data to a third party. Too many consumers are entrusting their information to companies for safe keeping only to have it sold away for the highest dollar — often in the dark of night.

Some malicious companies con consumers out of their information with privacy policies that are impossible to understand. Often all those lines of legalese only mean one thing: we will sell your personal information to whoever we want, whenever we want. This must stop.

To plug these loopholes, my identity theft legislation will:

• Create an Office of Identity Theft in the FTC to have jurisdiction over companies that lawfully acquire and keep personal consumer data.
• It will also create a Schumer Box to be posted on any web site that seeks to request personal information from a customer. In that box, companies would give a clear warning in simple language to consumers if they plan to sell their information.
• Finally, it will force companies to demonstrate a need for customers' personal information before requiring it from them.

It is high time for Congress to fill the breach that hackers, thieves, and the Internet have combined to create — leaving consumers vulnerable and costing our economy billions.

I want to ask my friend from Alabama, the Chairman of this committee, who has been a thoughtful and persistent advocate for privacy, to work with me to craft bipartisan, comprehensive legislation that will really get to the heart of this information epidemic.