Newsroom

NAFCU and six other financial trade associations yesterday wrote Sens. Tom Carper, D-Del., and Roy Blunt, R-Mo., in support of their data security bill, which would bring retailers under a national standard akin to that prescribed under the Gramm-Leach-Bliley Act for financial institutions.

"This important legislation ensures all entities that handle consumers' sensitive financial data have in place a robust process to protect data, which can help prevent breaches from happening in the first place," the signers wrote in a joint letter. "Data breaches impose significant costs on banks, credit unions and other financial institutions of all sizes because our first priority is to protect consumers and make them whole."

The letter's signers included the American Bankers Association, Financial Services Roundtable, The Clearing House, CUNA and the Independent Community Bankers of America.

In a joint statement from his and Carper's offices, Blunt said, "New technologies pose new opportunities – as well as new security challenges. As recent headlines have once again reminded us, now is the time to strengthen our nation's data security and defend consumers against data breaches by both businesses and government agencies."

The bill would consider financial institutions already in compliance due to Gramm-Leach-Bliley – a treatment NAFCU has pushed for. The bill clarifies that financial regulators such as NCUA would maintain authority over financial institutions, while the Federal Trade Commission would have jurisdiction over those currently unregulated, such as retailers.

The bill would also protect consumers' and financial institutions' ability to sue retailers for actual financial damages for negligence in the wake of a data security breach and for punitive damages in the case of a willful violation of the bill's provisions.

Next week, NAFCU President and CEO Dan Berger will discuss this issue further in a hearing of the House Small Business Committee. Berger will testify before the panel on the association's data security principles.