NAFCU Letter to Reps. Boehner and Pelosi on Cyber/Data Security

Via CUInsight, a letter that has some recommendations many readers might agree with:

April 23, 2012

The Honorable John Boehner
U.S. House of Representatives
Washington, D.C. 20515

The Honorable Nancy Pelosi
Minority Leader
U.S. House of Representatives
Washington, D.C. 20515

Re: Cyber Security and Data Security

Dear Speaker Boehner and Minority Leader Pelosi:\

On behalf of the National Association of Federal Credit Unions (NAFCU), the only trade association exclusively representing our nation’s federal credit unions, I write today in regards to the issue of cyber security. As the House prepares to tackle this important issue on the floor this week, we urge you to not overlook the importance of data security for personal financial information as part of this larger debate.

The risk of a data breach continues to be a serious problem for both consumers and businesses. Every time a consumer chooses to use a plastic card for payment at a register or makes an online payment from their account, they are unwittingly put at risk. Many are not aware that their financial and personal identities could be stolen or that fraudulent charges could appear on their account, damaging their credit scores and reputations. Consumers trust that entities collecting this type of information will, at the very least, make a minimal effort to protect them from such risks. Unfortunately, this is not always the case.

As you may be aware, financial institutions, including credit unions, have been subject to standards on data security since the passage of Gramm-Leach-Bliley. However, retailers and many other entities that handle sensitive personal financial data are not subject to the same standards and all too often their customers become victims of data breaches and data theft due to their lack of security. Financial institutions bear a significant burden as the issuers of payment cards used by millions of consumers. Credit unions suffer steep losses in re-establishing member safety after a data breach occurs. They are often forced to charge off fraud related losses, many of which stem from a negligent entity’s failure to protect sensitive financial and personal information or the illegal maintenance of such information in their systems. Moreover, as many cases of identity theft have been attributed to data breaches and as identity theft continues to rise, any entity that stores financial or personally identifiable information should be held to a minimum standard for protecting such data.

Recently, there have been several large-scale data breaches, such as the ones at Sony and Michaels Inc. The aftermath of these breaches demonstrates what we have been communicating to Congress all along—credit unions and other financial institutions, not retailers or other business entities are out front protecting consumers when picking up the pieces after a data breach occurs. It is the credit union or financial institution that must notify their account holders, issue new cards, replenish stolen funds, change account numbers, and accommodate increased customer service demands that inevitably follow a major data breach. The negligent entity that caused these expenses by failing to protect consumer data loses nothing and often remains undisclosed to the consumer.

NAFCU is pleased to see the House debate the issue of cyber security, but urge you to not forget the issue of data security and consider adding provisions to protect consumers from breaches that compromise their financial and personally identifiable information. Data security is a commonsense bipartisan issue that must be addressed.

With that in mind, NAFCU specifically recommends that the House consider the following issues related to data security as you tackle the broader issue of cyber security:

  • Payment of Breach Costs by Breached Entities: NAFCU asks that credit union expenditures for breaches resulting from card use be reduced. A reasonable and equitable way of addressing this concern would be to require entities to be accountable for costs of data breaches that result on their end, especially when their own negligence is to blame.
  • National Standards for Safekeeping Information: It is critical that sensitive personal information be safeguarded at all stages of transmission. Under Gramm-Leach-Bliley, credit unions and other financial institutions are required to meet certain criteria for safekeeping consumers’ personal information. Unfortunately, there is no comprehensive regulatory structure akin to Gramm-Leach-Bliley that covers retailers, merchants, and others who collect and hold sensitive information. NAFCU strongly supports the passage of legislation requiring any entity responsible for the storage of consumer data to meet standards similar to those imposed on financial institutions under the Gramm-Leach-Bliley Act.
  • Data Security Policy Disclosure: Many consumers are unaware of the risks they are exposed to by providing their personal information. NAFCU believes that this problem can be alleviated by simply requiring merchants to post their data security policies at the point of sale if they take sensitive financial data. Such a disclosure requirement would come at little or no cost to the merchant, but would provide an important benefit to the public at large.
  • Notification of the Account Servicer: The account servicer or owner is in the unique position of being able to monitor for suspicious activity and prevent fraudulent transactions before they occur. NAFCU believes that it would make sense to include entities such as financial institutions to the list of those to be informed of any compromised personally identifiable information when, associated accounts are involved.
  • Disclosure of Breached Entity: NAFCU believes that consumers should have the right to know which business entities have been breached. We urge Congress to mandate the disclosure of identities of companies and merchants whose data systems have been violated, so consumers are aware of those that place their personal information at risk.
  • Enforcement of Prohibition on Data Retention: NAFCU believes it is imperative to address the violation of existing agreements and law by merchants and retailers who retain payment card information electronically. Many entities do not respect this prohibition and store sensitive personal data in their systems, which can be breached easily in many cases.
  • Burden of Proof in Data Breach Cases: In line with the responsibility for making consumers whole after they are harmed by a data breach, NAFCU believes that the evidentiary burden of proving a lack of fault should rest with the merchant or retailer who incurred the breach. These parties should have the duty to demonstrate that they took all necessary precautions to guard consumers’ personal information, but sustained a violation regardless. The law is currently vague on this issue, and NAFCU therefore asks that this burden of proof be clarified in statute.

In addition to these recommendations, NAFCU would also like to note that there are critical homeland security considerations at stake when deliberating data safety issues. Weaknesses in the protection of consumer financial information can and have helped terrorist networks and organized crime groups fund their operations. NAFCU believes it is critical that these simple changes be enacted, so as not to facilitate the financing of operations that threaten not only the financial stability but also the livelihood of millions of Americans.

Thank you for your kind attention to this important matter. We appreciate the opportunity to voice our concerns and look forward to working with you as you examine this issue. Should you have any questions or need additional information, please do not hesitate to contact myself or NAFCU’s Vice President of Legislative Affairs, Brad Thaler, at 703-842-2204.


Fred R. Becker, Jr.
President and CEO

About the author: Dissent

2 comments to “NAFCU Letter to Reps. Boehner and Pelosi on Cyber/Data Security”

You can leave a reply or Trackback this post.
  1. Bob Smythe - April 24, 2012

    Really?! As a retailer I am double dipped on any fraud, paying for the original transaction, the cost of the product and any fees or penalties. This sounds suspiciously like the card brands thinking they are on an island by themselves.

    Being in the Information Security industry for 20 years i do not disagree that stronger efforts should be applied to protect consumer and company data. The fix here I think is much more complex than an handful of bullet points (no disrespect intended to Mr. Becker). A holistic approach to security is needed beginning with the education of consumers and ending with holding company’s accountable for their in-actions. Any security person worth their weight understands that a corporation’s security program must be built on a sound foundation of awareness and support within the highest levels. I do not believe it is any different here.

    Just my opinion.

    • admin - April 24, 2012

      You raise some valid points. I think I liked their letter, in part, because it makes no sense to me that if SECTOR A holds your name, address, SSN, and credit card number, they are subject to data security standards XYZ, but if SECTOR B or SECTOR C hold the very same data, they may have different data security standards. Consumers cannot opt out of providing certain info (e.g., try to buy a car w/out giving your SSN and you’ll be told that even if you want to pay cash, the PATRIOT Act requires the dealership to get your SSN), yet they do not have to adhere to any particular security practices or standards. Makes me crazy (or crazier than normal).

      I also think if the govt is going to endorse/promote sharing of PII, then the receiving entity should be held to certain data security standards.

Comments are closed.