Data security advocates gearing up for battle to protect personal information

HELENA – Montana-based data security experts have teamed up with a legislator to make sure individuals' private information does not fall into the wrong hands.

Eric Fulton knows the risks that come with collecting data. He hacks into government agencies' and corporations' networks to find weaknesses in their systems and improve security.

Information that's stolen or sold to a third party can have detrimental effects on people's lives, often without their realization, he said.

Take, for example, the discount cards consumers swipe at grocery stores. Those cards allow supermarkets to keep tabs on what a person buys, and the stores can choose to sell that information to third parties.

Fulton says that data can be used in a variety of ways. Some companies use it to target advertising toward an individual, and others analyze it to learn about consumer trends.

Fulton has drafted legislation with Rep. Daniel Zolnikov, R-Billings, and others from LMG Security, an information security firm in Missoula. Their proposal would ensure that people know when businesses retain their information and protect consumer data from companies with malicious intentions.

"If I'm an insurance agency, I can say, 'Daniel Zolnikov has bought three pints of ice cream a week for the past three months,'" Fulton said. "Because he eats so much ice cream, he's increasing his potential to die, and I'm going to increase his insurance rates."

House Bill 400 would require that companies notify customers when they want to collect their information and give consumers an opportunity to opt out.

"A lot of people think their information is being collected," Zolnikov said. "A lot of people though do not know that it is being sold off, sometimes just to the highest bidder."

The bill is slated for a hearing in the House Business and Labor Committee this week, and it is already on the radar screens of the telecom, retail and banking industries.

Rep. Bryce Bennett, D-Missoula, carried a similar bill during the 2011 Legislature, but it died in committee.

"The room was filled with opponents from every big company across the state and across the country," he said.

Zolnikov expects his bill to face a similar battle, so he's talking to lobbyists and lawmakers to clear up confusion about what the legislation would do.

He and Bennett say regulating privacy data requires a lot of explanation because it is a relatively modern concept.

"I think for a lot of folks, it's just so new that it's hard to wrap your head around," Bennett said.

As technology changes, bills regulating personal information are likely to continue to pop up in state legislatures and Congress, say representatives from groups who could be affected by the laws.

They say the problem with legislation like House Bill 400 is its reach – it tries to do too much without considering all possible implications.

"It's 20 pages of new code," said Glenn Oppel, government relations director for the Montana Chamber of Commerce. "It's easy to say this policy is a good idea, but there's more consideration to take into account."

The chamber and other groups have not yet said what stance, if any, they will take on the bill. Nevertheless, they're studying it and other privacy measures that could arise during the session.

The proposal's drafters say the bill takes a comprehensive approach toward regulating privacy, whereas current law covers only specific industries.

The banking industry, for one, already complies with a number of state and federal privacy regulations, said Steve Turkiewicz, president of the Montana Bankers Association. He's interested to see how a bill like Zolnikov's would stack up against existing statutes.

Furthermore, he said finance officials sometimes need to inspect individuals' files, and banks must report certain client data. He wonders what additional steps banks would have to take under House Bill 400 to notify clients and gain consent to share their information. The banks he represents already send annual mailers outlining clients' privacy rights.

"Those are the things that give us grave concerns on a bill that just circulated a week ago," he said.

Others agree that privacy legislation like House Bill 400 requires more time for analysis.

"This could be where we take a step back during the interim and get all the stakeholders together at a table to do what's right," Oppel said.

Zolnikov, however, said interested parties already know how the bill would impact their industries. He said their call for an interim study is simply a means to buy more time to lobby against the measure.

"I have realized the overwhelming amount of influence special interest groups have in Montana," he said. "Standing up for what's right for Montanans is a much more difficult process than succumbing to the needs of special interests and obtaining support for future elections."