Evan Schuman's StorefrontBacktalk

A data breach is a nightmare, and not just because it means thieves have broken through a retailer’s security. The second half of the nightmare is dealing with the wide range of state laws about reporting data breaches and managing data privacy. But some help would seem to be on the way, according to a Commerce Department report leaked last Friday (Nov. 12) that recommends new federal laws to standardize data-breach reporting requirements and provide a privacy safe-harbor for businesses.

Really? We’ve seen lawmakers take their best shot at data security and privacy before. This time, it’s a task force of bureaucrats trying to balance the demands of competing interests. But at this point, we don’t need balance. We need clear rules for protecting customer data, and regulations with teeth so there’s a meaningful penalty when data isn’t kept safe. As it is, the Commerce task force has some nice ideas about voluntary privacy principles that won’t go anywhere in Congress—and wouldn’t help even if they did.

A draft version of the task force’s report, which was leaked to the telecom newsletter TRDaily, recommends a new privacy law “built on an expanded set of fair information practice principles,” according to the draft report. Retailers who conform to the principles would get fair-harbor protection from lawsuits and enforcement action by the Federal Trade Commission. Exactly what those principles will be is up in the air, but the task force stresses it wants them to form “voluntary but enforceable codes of conduct.”

The task force also recommends a new federal data-breach law that “includes notification provisions, encourages companies to implement strict data security protocols, and allows states to build upon the law in limited ways. The law should track the effective protections that have emerged from state security breach notification laws and permit enforcement by state authorities,” the report said.

Wait—a safe harbor based on “voluntary but enforceable” codes of conduct for privacy? A law that “encourages” strict data security, and lets states pile on their own extra requirements for data-breach disclosures? Apparently, there’s only one thing less effective than retail self-regulation—that’s the Commerce Department doing it.

What would actually help for data-breach regulation? Real security standards. Real breach disclosure. Real teeth for the FTC in chasing companies with lousy security and privacy. And, oh yes, a safe harbor for retailers who actually protect their payment-card and customer information.