Bill proposes data breach standards Companies that hold consumers" personal information and fail to notify them as quickly as possible if they suffer a security breach could face fines under a Bill proposed by Senator Pat Toomey and four other Republican senators. Under the proposed Data Security and Breach Notification Act of 2012, companies would be required to inform consumers, as well as the Secret Service and the Federal Bureau of Investigation, "as expeditiously as practicable," of any personal data loss involving more than 10,000 customers. Personal data includes Social Security numbers, financial data, and security codes or passwords. Companies and other entities covered by the Act would have to disclose how the information was stolen and how to contact the company in question. Failure to comply would result in a fines of up to $500,000. The proposed legislation has been prompted by a spate of recent cybersecurity breaches, including those at Citibank, Sony's PlayStation network and LinkedIn, that have highlighted the lack of a single US standard notification procedure for companies that store personal data and suffer a security breach. Companies must currently comply with 46 different state laws in the event of a data breach. Senator Toomey's bill would pre-empt these laws and replace them with a single national standard, providing better protections and swifter responses for consumers. "A number of recent high-profile data breaches combined with the messy patchwork of 46 different state laws highlight how difficult it is for consumers to know their personal information is secure," Senator Toomey said. Congress needs to provide businesses and consumers with certainty and establish a single reasonable standard for information security and breach notification practices. Our bill would eliminate the burden of complying with varying standards and laws, ensuring that all consumers and their personal information are afforded the same level of protection. Senator Olympia Snowe, another of the Bill's sponsors, added: "more than 540m records have been reported breached since 2005, according to the Privacy Rights Clearinghouse, and research from the Ponemon Institute puts the average organisational cost of a breach at $5.5m. While states have led the way in establishing policies to protect consumer data and notify them if such data is compromised, the existing patchwork of state laws and the inherent interstate commerce aspect of this issue warrants action by Congress. Our legislation would implement a national data security breach standard to simplify compliance for businesses and notifications to consumers to reduce undue burden and confusion. The proposed legislation was welcomed by a number of companies including Verizon Communications, the second-largest US telecommunications group, and the CTIA telecoms industry group. The CTIA said: "By advancing a proposal that offers a comprehensive, uniform approach to data security and breach notification, Sen Toomey demonstrates that it is possible to protect consumers while providing clear, consistent guidelines to businesses." Separately, Reuters reported that an Illinois woman has filed a $5m lawsuit against LinkedIn, claiming that the social network violated promises to consumers by not having better security in place when 6.5m customer passwords were stolen by hackers this month. The lawsuit, filed by Katie Szpyrka, one of LinkedIn's 160m users, was brought in federal court in San Jose, California on June 15 and seeks class-action status. In court papers, her Chicago-based lawyers claim LinkedIn had "deceived customers" by having a security policy "in clear contradiction of accepted industry standards for database security." In a statement, LinkedIn said:"A class-action lawsuit has been filed against LinkedIn related to the theft of hashed LinkedIn member passwords that were published on an unauthorised website. We don't believe any member account has been compromised as a result of the password theft, and we have no reason to believe that any LinkedIn member has been injured. Therefore, it appears that these threats are driven by lawyers looking to take advantage of the situation. We believe these claims are without merit, and we will defend the company vigorously against suits trying to leverage third-party criminal behaviour.