California legislators will hold a hearing to debate on a proposed bill that would create new data security and breach notification requirements for all organizations processing credit and debit card transactions in the state.
The bill, officially known as AB 779, is being sponsored by the California Credit Union League (CCUL). It was introduced in February and has been amended three times since then, most recently on May 14.
If passed, the measure would explicitly prohibit retailers and other merchants from storing certain specific types of authentication data taken from the magnetic stripes on the back of credit and debit cards. This information includes card verification value and personal identification numbers, as well as encrypted PIN block data and payment verification codes.
The bill in California has similar goals as the Plastic Card Security Act that became law in the US state of Minnesota
The legislation would also require merchants to use so-called strong encryption routines and access controls while storing or transmitting other types of data, such as card numbers and the names of account holders.
In addition, the bill would mandate that a breached entity reimburse affected banks and credit unions for all the costs they incur to alert customers and reissue cards. And AB 779 would modify existing California state requirements on providing notifications of security breaches. Retailers would be forced to disclose more details about breaches, including a description of the categories of personal data that might have been compromised. They also would have to set up toll-free numbers for people to get more information.
The bill is scheduled to be discussed before the State Assembly's Committee on Appropriations. If approved by the committee, it would go to the full assembly for a vote before June 8. The measure would also need to be approved by the state Senate and signed by Gov. Arnold Schwarzenegger before it could become law.
Driving the need for such legislation are the burgeoning costs that credit unions have to bear as a result of retail security breaches, said Keri Bailey, a US-based lobbyist for the CCUL. Large and midsize credit unions can easily end up shelling out between $US500,000 and $US750,000 annually in breach notification and card replacement costs, Bailey said. Those figures don't include any fraud-related charges that might stem from breaches, she noted.
"Credit unions are unique in that we are cooperative financial institutions," Bailey said. "We are not-for-profit." As a result, she added, it's harder for credit unions to absorb the costs of responding to security breaches than it is for banks and other financial institutions.
Credit unions also take a bigger hit reputation-wise than banks do whenever they have to inform members of a breach and reissue credit or debit cards, according to Bailey. Currently, notification letters sent by financial institutions can't contain any information about where the breach occurred or the type of data that might have been compromised. AB 779 would allow banks and credit unions to mention the name and contact information of the breached entity and provide details about the data that might have been affected.
"This is an issue of fundamental fairness," Bailey said. "Right now, the burden is entirely on the financial institution." The Gramm-Leach-Bliley Act already requires banks and credit unions "to do a whole lot to protect people's data," she said. "But the folks accepting this data [for payment transactions] have no skin in the game."
The bill in California has similar goals as the Plastic Card Security Act that became law in the US state of Minnesota. The requirements included in the Minnesota law and the California bill codify elements of the Payment Card Industry Data Security Standard, which was developed by the major credit card companies. The standard, known by the acronym PCI, specifies a set of 12 broad security controls that all organizations accepting payment cards are required to implement.
A similar PCI-derived bill proposed in the US state of Texas this year was approved by the state's House of Representatives but didn't make it through the Texas Senate before the latest biennial legislative session ended. As in California, the bills in both Minnesota and Texas were pushed by associations of credit unions in the two states.
Such measures are needed to get retailers to become more serious about data security, said Steve Rowen, an analyst at US-based consulting firm. "What we've found is that without some sort of a prod, there is no compelling reason for retailers to be proactive about security practices," Rowen said.
Despite all the negative publicity generated by high-profile breaches such as the one disclosed earlier this year by The TJX Companies, retailers by and large haven't had to bear much fiscal responsibility for their security lapses, Rowen said. He added that although the PCI standard provides for contractual penalties to be assessed for data breaches, "to my knowledge, no retailer in any privacy breach has been forced to pay any actual costs" beyond their own expenses.
"At this point, it would seem that without legal punishments, lawsuits and hopefully federal law, there will be no catalyst for retailers to do what they should be doing," Rowen said.
Cliff Davidson, an associate at US law firm Proskauer Rose LLP, agreed that bills such as AB 779 are needed. "It is good that legislators are addressing this issue," Davidson said. "It remains to be seen whether the actual proposal imposes too high a burden on retailers and other businesses."
But Jon Hurst, president of the Retailers Association of Massachusetts, voiced concerns about Minnesota's new law and the proposed statute in California. Pointing to stalled efforts to pass similar legislation in Texas, Connecticut and other states, Hurst said he hopes that "cooler heads will prevail" in California as well.
"This is a one-sided proposal pushed by certain smaller banks that are not at the table with the big banks," Hurst said. Retailers already pay upfront for fraud-related costs via the so-called interchange fees associated with card use, he added. If smaller banks and credit unions want to be reimbursed for their breach-related costs, Hurst said, they should go after the bigger banks and credit card companies that collect billions of dollars worth of interchange fees from retailers annually.
"I understand their problem," Hurst said, referring to credit unions and small community banks. "But they should be working with [bigger] banks and the card associations to fix the system, and not trying to pass laws to bring more money their way."
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.